Hybrid Connectivity Decision Guide: Cloud VPN vs Partner vs Dedicated Interconnect | 2026

Overview of GCP Hybrid Connectivity Options

GCP Hybrid Connectivity encompasses network solutions that link on-premises data centers, office branch sites, or third-party clouds (AWS, Azure) directly to Google Cloud VPC networks.

Think of your cloud VPC as an island city. Cloud HA VPN is like establishing an encrypted high-speed ferry route across the open ocean (the public internet) — easy to set up, but subject to sea weather (internet jitter). Partner Interconnect is like booking a dedicated lane on a toll bridge managed by a transit partner. Dedicated Interconnect is like building your own private underground high-speed rail line straight into the city — maximum speed, zero traffic, built for massive cargo.

Architectural Decision Matrix: VPN vs Partner vs Dedicated

Choosing the wrong hybrid connectivity option leads to performance bottlenecks, unexpected cloud egress charges, or failure to meet enterprise 99.99% uptime compliance SLAs.

Evaluate requirements against bandwidth volume, security policies, and SLA mandates. Use HA VPN for encrypted rapid connections, Partner Interconnect for flexible private circuits, and Dedicated Interconnect for high-volume enterprise traffic. Pair with [Cloud DNS Private Zones & Forwarding](/tutorial/cloud-dns-private-zones-forwarding-peering-split-horizon) and deploy within a central [Shared VPC Host Project](/tutorial/shared-vpc-gcp-terraform-host-service-projects-iam).

Prerequisites

• GCP Project with Compute Engine API (`compute.googleapis.com`) enabled
• Custom Mode VPC Network
• On-Premises VPN/Router supporting BGP (e.g. Cisco, Palo Alto, Fortinet) with ASN
• Terraform CLI v1.6+

Step-by-Step Guide

Step 1: Deploy Cloud HA VPN Gateway in Terraform

Provision a dual-interface `google_compute_ha_vpn_gateway` in Terraform. Cloud HA VPN automatically provisions two public IP interfaces across different physical hardware zones to guarantee 99.99% availability.

# ha_vpn_gateway.tf — High Availability VPN Gateway
resource "google_compute_ha_vpn_gateway" "ha_gateway" {
  name    = "prod-ha-vpn-gateway"
  region  = "europe-west1"
  network = google_compute_network.custom_vpc.id
  project = var.project_id
}

output "ha_vpn_interfaces" {
  value = {
    interface_0 = google_compute_ha_vpn_gateway.ha_gateway.vpn_interfaces[0].ip_address
    interface_1 = google_compute_ha_vpn_gateway.ha_gateway.vpn_interfaces[1].ip_address
  }
  description = "Public IP addresses for HA VPN Interface 0 and Interface 1"
}

Step 2: Configure Cloud Router for BGP Dynamic Routing

Deploy a `google_compute_router` configured with a private Autonomous System Number (ASN). BGP dynamic routing allows Cloud Router to dynamically advertise GCP subnet routes and adapt to on-premises link failures automatically.

# cloud_router.tf — Cloud Router with BGP ASN
resource "google_compute_router" "vpn_router" {
  name    = "ha-vpn-cloud-router"
  region  = "europe-west1"
  network = google_compute_network.custom_vpc.id

  bgp {
    asn               = 64514 # GCP Private ASN (64512 - 65534)
    advertise_mode    = "CUSTOM"
    advertised_groups = ["ALL_SUBNETS"] # Automatically advertises all VPC subnets
  }

  project = var.project_id
}

Step 3: Provision Dual IPsec VPN Tunnels and BGP Peers

Configure two `google_compute_vpn_tunnel` resources and `google_compute_router_peer` resources in Terraform to complete the active-active HA topology. Deploying both Tunnel 0 and Tunnel 1 fulfills the architectural requirement for active-active packet routing and 99.99% uptime.

# vpn_tunnels.tf — Dual IPsec Tunnels & BGP Peering
resource "google_compute_external_vpn_gateway" "onprem_gateway" {
  name            = "onprem-router-gateway"
  redundancy_type = "SINGLE_STATIC" # Or "TWO_IPS_REDUNDANT" for dual on-prem routers
  project         = var.project_id

  interface {
    id         = 0
    ip_address = "198.51.100.1" # On-premises public IP address
  }
}

# Shared IKE Secret
resource "random_password" "shared_secret" {
  length  = 32
  special = false
}

# Tunnel 0 (Interface 0)
resource "google_compute_vpn_tunnel" "tunnel_0" {
  name                  = "ha-vpn-tunnel-0"
  region                = "europe-west1"
  vpn_gateway           = google_compute_ha_vpn_gateway.ha_gateway.id
  vpn_gateway_interface = 0
  peer_external_gateway = google_compute_external_vpn_gateway.onprem_gateway.id
  peer_external_gateway_interface = 0
  shared_secret         = random_password.shared_secret.result
  router                = google_compute_router.vpn_router.name
  project               = var.project_id
}

# Tunnel 1 (Interface 1)
resource "google_compute_vpn_tunnel" "tunnel_1" {
  name                  = "ha-vpn-tunnel-1"
  region                = "europe-west1"
  vpn_gateway           = google_compute_ha_vpn_gateway.ha_gateway.id
  vpn_gateway_interface = 1
  peer_external_gateway = google_compute_external_vpn_gateway.onprem_gateway.id
  peer_external_gateway_interface = 0
  shared_secret         = random_password.shared_secret.result
  router                = google_compute_router.vpn_router.name
  project               = var.project_id
}

# BGP Peer for Tunnel 0
resource "google_compute_router_peer" "peer_0" {
  name            = "bgp-peer-0"
  router          = google_compute_router.vpn_router.name
  region          = "europe-west1"
  peer_asn        = 65001 # On-Premises BGP ASN
  peer_ip_address = "169.254.0.1"
  ip_address      = "169.254.0.2/30"
  vpn_tunnel      = google_compute_vpn_tunnel.tunnel_0.name
  project         = var.project_id
}

# BGP Peer for Tunnel 1
resource "google_compute_router_peer" "peer_1" {
  name            = "bgp-peer-1"
  router          = google_compute_router.vpn_router.name
  region          = "europe-west1"
  peer_asn        = 65001 # On-Premises BGP ASN
  peer_ip_address = "169.254.1.1"
  ip_address      = "169.254.1.2/30"
  vpn_tunnel      = google_compute_vpn_tunnel.tunnel_1.name
  project         = var.project_id
}

Step 4: 99.99% Availability Architecture for Dedicated Interconnect

Understand the required physical layout for a 99.99% SLA Dedicated Interconnect deployment. Google requires four VLAN attachments across two separate edge availability zones (EAZ) and two independent GCP metros to grant the 99.99% SLA.

# Topology Requirement for 99.99% Dedicated Interconnect SLA:
#
# ┌────────────────────────────────────────────────────────────────────────┐
# │                      On-Premises Data Center / Co-Lo                   │
# │             Router A                               Router B            │
# └─────────────────┬──────────────────────────────────────┬───────────────┘
#                   │ 10G/100G Fiber                      │ 10G/100G Fiber
#                   ▼                                      ▼
# ┌──────────────────────────────────┐   ┌──────────────────────────────────┐
# │  GCP Metro 1 (Edge Zone A)       │   │  GCP Metro 2 (Edge Zone B)       │
# │  Interconnect Circuit 1          │   │  Interconnect Circuit 2          │
# └─────────────────┬────────────────┘   └─────────────────┬────────────────┘
#                   │                                      │
#                   ▼                                      ▼
# ┌────────────────────────────────────────────────────────────────────────┐
# │             GCP Region (europe-west1) Cloud Router (BGP)               │
# └────────────────────────────────────────────────────────────────────────┘

# Key Rule:
# 2 Circuits + 2 Metropolitan Locations + 2 On-Prem Routers = 99.99% SLA

Step 5: Verify BGP Session Status and Test Failover

Execute gcloud commands to verify BGP route propagation and simulate a tunnel failover. Verifying BGP route convergence confirms that traffic automatically reroutes to the surviving tunnel during a network impairment.

# Step 1: Check HA VPN Gateway Status
gcloud compute vpn-gateways describe prod-ha-vpn-gateway --region=europe-west1

# Step 2: Verify BGP Router Status and learned routes
gcloud compute routers get-status ha-vpn-cloud-router --region=europe-west1

# Expected output:
# bgpPeerStatus:
# - name: bgp-peer-0
#   status: ESTABLISHED
# - name: bgp-peer-1
#   status: ESTABLISHED

# Step 3: Test failover by manually disabling Tunnel 0 on-premises
# Observe BGP automatically shifting all active traffic to Tunnel 1 via Cloud Router in <3 seconds!

Verification & Health Check

Best Practices

• Always Deploy Both Tunnels of Cloud HA VPN
• Set IPsec Path MTU to 1440 Bytes

Common Mistakes

• {"errorCode":"BGP_SESSION_DOWN","symptoms":"BGP status shows `CONNECT` or `ACTIVE` instead of `ESTABLISHED`.","rootCause":"Firewall blocking ESP/UDP 500/4500 or BGP link-local IP (`169.254.x.x`) address misconfiguration.","fixCommand":"gcloud compute firewall-rules create allow-vpn-ike --allow=udp:500,udp:4500,50 --network=VPC_NAME","code":"resource \"google_compute_firewall\" \"allow_ike\" {\n name = \"allow-ike-vpn\"\n network = google_compute_network.custom_vpc.id\n allow {\n protocol = \"udp\"\n ports = [\"500\", \"4500\"]\n }\n allow {\n protocol = \"50\" # ESP Protocol\n }\n source_ranges = [\"198.51.100.1/32\"]\n}\n","language":"hcl","filename":"fix_vpn_fw.tf","prevention":"Verify IKE UDP ports 500/4500 and ESP protocol 50 are allowed on both network firewalls."}

Cost Analysis

References

• Choosing a Hybrid Connectivity Product
• 99.99% Availability for Dedicated Interconnect
• google_compute_ha_vpn_gateway Terraform Resource