Building a Highly Available AWS-GCP VPN with BGP

Multi-cloud architectures are becoming increasingly common as organizations adopt best-of-breed services across cloud providers. One of the most critical requirements in such architectures is secure, reliable, and private connectivity between cloud environments. You can learn more about multi-cloud management here.

In this blog, we’ll walk through how to set up a highly available Site-to-Site VPN connection between Amazon Web Services (AWS) and Google Cloud Platform (GCP) using HA Cloud VPN and BGP-based dynamic routing.

Why Use High Availability VPN with Border Gateway Protocol?

Using High Availability (HA) VPN with BGP routing provides:

• Encrypted, private communication between clouds
• Automatic failover with multiple tunnels
• Dynamic route exchange (no manual route updates)
• Production-grade resiliency for hybrid and multi-cloud workloads

This setup is ideal for:

• Data migration (GCS ↔ AWS S3)
• Hybrid or multi-cloud applications
• Internal service-to-service communication

Architecture Overview

The solution uses two IPsec tunnels for high availability and BGP for dynamic routing.

Traffic Flow:

GCP VPC → HA Cloud VPN → Encrypted IPsec Tunnel → AWS VGW → AWS VPC

Key Components:

• GCP HA Cloud VPN
• GCP Cloud Router
• AWS Virtual Private Gateway (VGW)
• BGP (Dynamic Routing)
• IKEv2 with AES-256 encryption

Prerequisites

a) Network Planning

Ensure both environments have non-overlapping CIDR ranges:

• GCP VPC: 10.10.0.0/16
• AWS VPC: 10.0.0.0/16

b) Permissions

• GCP: Network Admin / Compute Admin
• AWS: AWS EC2 instance and VPC Full Access (or equivalent)

c) ASN Planning

Each side must use a unique ASN for BGP:

Step-by-Step Configuration

Step 1: Create a Cloud Router in GCP

The Cloud Router enables dynamic route exchange using BGP.

• Name: gcp-aws-cloud-router
• Network: Your GCP VPC
• Region: Same region as the VPN=
• Google ASN: 65000

Step 2: Create a GCP High Availability Cloud VPN Gateway

• VPN Type: High-availability (HA) VPN
• Network: GCP VPC
• Region: Same as Cloud Router
• IP Stack: IPv4

After creation, note down the two public IP addresses (Interface 0 and Interface 1). These will be required on the AWS side.

Step 3: Configure AWS VPN Components

Create a Customer Gateway

• Name: gcp-ha-vpn-cgw
• Routing: Dynamic
• BGP ASN: 65000
• IP Address: GCP HA VPN Interface 0 Public IP

Only one Customer Gateway is required.

Create a Virtual Private Gateway (VGW)

• Name: aws-gcp-vgw
• ASN: 65001
• Attach it to your AWS VPC

Step 4: Create the Site-to-Site VPN Connection in AWS

• Target Gateway Type: Virtual Private Gateway
• Virtual Private Gateway: aws-gcp-vgw
• Customer Gateway: Existing (gcp-ha-vpn-cgw)
• Routing Options: Dynamic (BGP)
• Tunnel Options: Default

AWS automatically provisions two VPN tunnels.

Step 5: Download and Share VPN Configuration

Download the VPN configuration using:

• Vendor: Generic

Share the following details with the GCP team:

• Tunnel public IPs
• Inside tunnel IP ranges
• Pre-shared keys

Step 6: Create VPN Tunnels in GCP

Configure two tunnels on the HA VPN gateway.

Tunnel 1

• Interface: 0
• Peer IP: AWS Tunnel 1 Public IP(outside ip of VGW)
• IKE Version: IKEv2
• Pre-Shared Key: From AWS config
• Cloud Router: gcp-aws-cloud-router

Tunnel 2

• Interface: 1
• Peer IP: AWS Tunnel 2 Public IP(outside ip of VG)
• IKE Version: IKEv2
• Pre-Shared Key: From AWS config
• Cloud Router: gcp-aws-cloud-router

Step 7: Configure BGP Sessions

For each tunnel:

• Peer ASN: 65001
• Cloud Router BGP IP: Customer gateway inside tunnel IP
• BGP Peer IP: AWSVGW inside tunnel IP
• Once configured, the BGP status should show Established on both sides.

Validation and Testing

On AWS

• Both VPN tunnels should be UP
• BGP status should be Established

On GCP

• VPN tunnels should be Established
• Cloud Router BGP sessions should be Established

Connectivity Test

Test connectivity using:

• ping
• curl

Between:

• AWS EC2 private IP ↔ GCP VM private IP

Security and Best Practices

• Always use High Availability Cloud VPN (avoid Classic VPN)
• Prefer BGP over static routes
• Rotate pre-shared keys periodically (at least annually)

Enable monitoring:

• AWS CloudWatch VPN metrics
• GCP Cloud Monitoring VPN metrics
• Enable audit logging:
• AWS CloudTrail
• GCP Cloud Audit Logs

Final Thoughts

A highly available, BGP-enabled Site-to-Site VPN between AWS and GCP provides a robust foundation for multi-cloud connectivity. With proper routing, monitoring, and security controls in place, this architecture can reliably support production workloads, migrations, and hybrid applications. For organizations planning or operating multi-cloud environments, CloudKeeper's cloud migration services and multi-cloud expertise can help simplify deployment and ongoing management.