VPN Gateway: connect offices and staff to your VPCs

A gateway is a spoke of the hub, so it reaches the VPCs its role allows, like any other spoke. Create a Network Hub first and attach the VPCs your offices and staff need (see Network Hub).

A gateway is one kind for life. If you need both, create two.

Choose a SKU

The SKU, Gw1 to Gw5, sets the throughput the whole gateway is held to, how many tunnels a Site-to-Site gateway takes (many branches share the throughput), or how many people a Client-to-Site gateway takes at once. One tunnel carries at most about 1 Gbps. The create page shows what each SKU gives, and you can change the SKU later.

• High availability (HA), on by default: a spare instance in another zone. If one fails, the rest carry on at once at the full SKU.
• Without HA, if its machine fails, connections stop for about two minutes while the gateway moves. It keeps the same IP.

Site-to-Site: connect an office

1. On the hub’s page, under VPN Gateways, click Create VPN Gateway and choose Site-to-Site (BGP).
2. Choose the project it belongs to (it is billed to that project), a name, the region nearest your offices and the Address name, which can’t change later. On a Star hub, choose its Role on the hub.
3. Choose the SKU and HA. Under Routing (BGP), keep Our AS number unless your devices already use it; the hub’s VPC ranges are announced to offices for you. Turn on Let offices reach each other through the hub if branches should talk to each other.
4. Click Create VPN Gateway. Each instance gets its own static public IP.
5. Click Add tunnel: enter the office device’s public IP (and its IKE ID if it is behind NAT) and its AS number, and choose Primary or Standby. Turn on BFD to notice a dead tunnel within seconds, on the device too.
6. Click Device settings on the tunnel. It lists every parameter, the pre-shared key (click Show) and example settings for FortiGate, MikroTik RouterOS 7, Cisco IOS-XE, pfSense / OPNsense and Palo Alto. Enter them on the office device.

With HA, make one tunnel from the office device to each instance and turn on BGP multipath (ECMP) on the device to use them all, or set some tunnels as Standby.

Client-to-Site: let staff in

1. In the same project, create a company user list under Identity. If the account has no organization domain yet, its owner creates one on that page first. The same list can also sign people in to Wi-Fi.
2. Create a VPN gateway, choose Client-to-Site, then the SKU and the Company user list.
3. If you like, set the Address range for devices (leave it empty to get one that doesn’t overlap the hub; it can’t change later), DNS servers, extra ranges to send through the VPN, or Send all traffic through the VPN (full tunnel), so people reach the internet from the gateway’s static IPs.
4. Give staff the steps under Device setup: a PowerShell command for Windows, a profile to download for macOS, iPhone and iPad, and settings to type in on Android. They sign in as username@address-name with their own password.

Connected now on the gateway’s page shows who is connected, updated every half minute.

Services still accept only what their security groups allow. Add a rule for the office ranges or the device address range, or choose Network Hub as the source.