IPsec VPN

As explained in Google Anthos in Action

An IPsec VPN tunnel is an encrypted tunnel using IPsec to carry traffic between peer networks.

An IPsec VPN tunnel securely connects peer VPC networks by encrypting traffic at one VPN gateway and decrypting it at the other while traversing the public internet. section 10.1.1 section 10.1.2

Use IPsec VPN when network separation or cross-environment connectivity is required:

• Connect services in separate VPCs, such as Anthos workloads in anthos_vpc and non-Anthos resources in product_1_vpc. section 10.1.1
• Connect GCP with on-premises data centers or other public-cloud environments through Cloud VPN. section 10.1.2
• Add redundant VPN connectivity when higher uptime and throughput justify the additional cost. section 10.1.2
• Increase ingress and egress bandwidth by deploying multiple tunnels; each tunnel supports up to 3 gigabits per second total. section 10.1.2

Choosing connectivity for separated environments

A platform can connect Anthos GKE services in anthos_vpc to product services in product_1_vpc with an IPsec VPN tunnel. This avoids exposing traffic directly to the public internet, but internet transit may reduce performance. VPC Network Peering offers stronger performance when administrative coordination, non-overlapping addresses, and separate firewall rules are acceptable. Cloud Interconnect is the recommended robust option for GCP-to-on-premises connectivity, while Cloud VPN is easier to establish and can serve as a secondary connection. section 10.1.1 section 10.1.2

Figure 10.4 Multiple VPC architecture in GCP

Use the multiple-VPC architecture to inspect where an IPsec VPN fits between separated platform and product networks. section 10.1.1

How Google Anthos in Action covers it

How deep it goes

Explains gateway encryption, internet transit, availability options, bandwidth limits, and alternatives including peering and Interconnect.

Examples

Uses anthos_vpc, product_1_vpc, GCP, on-premises data centers, multicloud links, redundant tunnels, and 3-Gbps tunnel capacity.

What it assumes

Requires peer networks, VPCs, VPN gateways, and a decision among VPN, peering, Interconnect, or application-level encryption.

What you can do after

Operate/configure Cloud VPN tunnels for encrypted connectivity, redundancy, bandwidth expansion, and secondary access paths.

How it connects

Connects VPCs with Cloud VPN and contrasts it with VPC Network Peering, Cloud Interconnect, TLS, and mTLS.

liveBookmanning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

• VPC peeringalternative to · VPC peering is a cloud networking capability that privately connects separate virtual private clouds by enabling traffic routing between them.
• IPsecpart of · IPsec is a suite of network-layer protocols that authenticates and protects Internet Protocol communications through cryptographic security services such as encryption and encapsulation.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.