Skip to main content

VPN Setup Guide — E2E Cloud to Google Cloud Platform

Introduction​

This guide provides a complete step-by-step walkthrough for configuring a Site-to-Site IPsec VPN between an E2E Cloud FortiGate Firewall and Google Cloud Platform (GCP). Once configured, private resources in your E2E Cloud VPC can communicate directly and securely with resources in your GCP VPC over an encrypted IPsec tunnel.

E2E Cloud to Google Cloud VPN Architecture

Before You Begin​

Ensure the following are in place before starting:

  • A FortiGate Firewall already deployed and running on E2E Cloud (status: Running). See Create a Firewall for setup instructions.
  • The public IP of your FortiGate (available from the E2E Cloud Console under Network → Firewall).
  • The private CIDR of your E2E Cloud VPC (e.g., 10.11.14.0/23).
  • Access to the GCP Console with permissions to manage VPC, Compute Engine, and VPN resources.
VPN Type

This guide uses Classic VPN with static (policy-based) routing, which is compatible with FortiGate. HA VPN requires BGP dynamic routing and is out of scope for this guide.

Part 1 — Google Cloud Configuration​

Step 1 — Create a VPC Network​

  1. Sign in to the Google Cloud Console.
  2. In the left sidebar, navigate to VPC network → VPC networks.

Navigate to VPC Networks

  1. Click Create VPC network.

Create VPC Network button

  1. Configure the network:
    • Name: e2e-gcp
    • Subnet creation mode: Custom

VPC Network name

  1. In the New subnet section, configure:
    • Name: e2e-gcp
    • Region: asia-south1 (Mumbai) — select the region closest to your workload
    • IP range: 10.128.0.0/20

Subnet configuration

  1. Click Create. Once created, the subnet details page confirms the network is ready.

Subnet created

note

The GCP VPC subnet CIDR (10.128.0.0/20) must not overlap with your E2E Cloud VPC CIDR (10.11.14.0/23).

Step 2 — Create a Test Virtual Machine in GCP​

This VM will be used to verify connectivity through the VPN tunnel after setup.

  1. Navigate to Compute Engine → VM instances.

Navigate to VM Instances

  1. Click Create instance.

Create instance button

  1. Configure the instance:
    • Name: e2e-gcp-test-vm
    • Region: asia-south1 (Mumbai) — same region as the VPC subnet

Instance name and region

  1. In the Networking section, attach the instance to the VPC created in Step 1:
    • Network: e2e-gcp
    • Subnetwork: e2e-gcp IPv4 (10.128.0.0/20)

Attach VM to VPC

  1. Click Create. Wait 1–2 minutes for the VM to reach the Running state.

  2. Note the Internal IP (e.g., 10.128.0.2) — you will use this to test connectivity later.

VM running with private IP

Step 3 — Reserve a Static Public IP Address​

The Classic VPN Gateway requires a static external IP address.

  1. Navigate to VPC network → IP addresses.
  2. Click Reserve external.

Reserve external IP button

  1. Configure:
    • Name: vpn-gateway
    • Type: Regional
    • Region: asia-south1 (Mumbai)
  2. Click Reserve.

Reserve static IP form

  1. The reserved IP (e.g., 34.100.222.133) appears in the IP addresses list. Note this address — it will be assigned to the VPN Gateway.

Static IP reserved

Step 4 — Create a Classic VPN Gateway and Tunnel​

  1. In the search bar, search for VPN and navigate to Network Connectivity → VPN.

Search VPN

  1. Click Create VPN connection.
  2. Select Classic VPN and click Continue.

Select Classic VPN

  1. Configure the VPN Gateway:
    • Name: e2e-gcp
    • Network: e2e-gcp
    • Region: asia-south1 (Mumbai)
    • IP address: vpn-gateway (the static IP reserved in Step 3)

Configure VPN Gateway

  1. In the Tunnels section, configure the VPN tunnel:
    • Tunnel name: e2e-gcp-tunnel
    • Remote peer IP address: Public IP of your E2E FortiGate Firewall
    • IKE version: IKEv2
    • IKE pre-shared key: Enter a secure key or click Generate. Record this key — you will enter the same key on the FortiGate.
    • VPN cipher selection: Select Custom

Configure VPN Tunnel

  1. Configure the ciphers as follows:
PhaseParameterValue
IKE Phase 1EncryptionAES-GCM-16-256
IKE Phase 1PRFPRF-HMAC-SHA2-256
IKE Phase 1Diffie-Hellman Groupmodp_2048 (Group 14)
IKE Phase 2EncryptionAES-GCM-16-256
IKE Phase 2PFSmodp_2048 (Group 14)

Cipher selection — Phase 1 and Phase 2

warning

The Phase 1 and Phase 2 cipher settings on GCP must match exactly the settings configured on the FortiGate in Part 2. Mismatched ciphers are the most common cause of tunnel failure.

  1. Configure routing:
    • Routing option: Policy-based
    • Remote network IP ranges: E2E Cloud VPC CIDR (e.g., 10.11.14.0/23)
    • Local subnetworks: e2e-gcp
    • Local IP ranges: 10.128.0.0/20

Routing options

  1. Click Create. The VPN gateway and tunnel are created.

VPN Gateway created

Record the following before moving to Part 2:
  • GCP VPN Gateway Public IP Address
  • Pre-Shared Key (PSK)
  • GCP VPC Subnet CIDR (10.128.0.0/20)

Step 5 — Verify the VPN Route​

  1. Navigate to VPC network → Routes.
  2. Select network e2e-gcp and region asia-south1, then click View.
  3. Verify that a static route for the E2E Cloud CIDR (e.g., 10.11.14.0/23) exists with Next hop: VPN tunnel (e2e-gcp-tunnel).

VPN route verification

note

The route may show a warning — "Next hop VPN tunnel is not in the ESTABLISHED state". This is expected at this stage. The warning disappears once the FortiGate tunnel is configured and the connection is established.

Step 6 — Configure Firewall Rules in GCP​

This rule allows traffic from the E2E Cloud VPC to reach GCP resources through the VPN tunnel. Without this rule, the tunnel may connect but GCP will silently block all inbound traffic.

  1. Navigate to VPC network → Firewall (via the left sidebar).

Navigate to Firewall

  1. Click Create firewall rule.

Create firewall rule

  1. Configure the rule:
FieldValue
Namee2e-vpc
Networke2e-gcp
Direction of trafficIngress
Action on matchAllow
TargetsAll instances in the network
Source IPv4 rangesE2E Cloud VPC CIDR (e.g., 10.11.14.0/23)
Protocols and portsTCP: 22, 80, 443 and ICMP

Firewall rule configuration

  1. Click Create.
note

Add additional ports as required by your application. Port 22 is needed for SSH testing; ports 80 and 443 for web traffic.

GCP configuration is complete. Proceed to configure the FortiGate on the E2E Cloud side.

Part 2 — FortiGate Configuration (E2E Cloud Side)​

Step 1 — Access the FortiGate Firewall​

  1. Note the Public IP of your FortiGate from the E2E Cloud Console under Network → Firewall.
  2. Open a browser and navigate to: https://<FortiGate-Public-IP>
  3. Log in using:
    • Username: admin
    • Password: Sent to your E2E Cloud account's registered email address

FortiGate login page

  1. After login, the FortiGate dashboard is displayed.

FortiGate dashboard

Step 2 — Change the HTTPS Management Port​

FortiGate uses port 443 for HTTPS management by default. This conflicts with the VPN tunnel. Change it before creating the tunnel.

  1. Navigate to System → Settings.
  2. Under Administration Settings, change the HTTPS port from 443 to 10443.
  3. Click Apply.

Change HTTPS port to 10443

  1. Log in again using the new port: https://<FortiGate-Public-IP>:10443

Step 3 — Create a Custom IPsec VPN Tunnel​

  1. Navigate to VPN → VPN Tunnels.
  2. Click Create New and select Custom IPsec Tunnel.

Select Custom IPsec Tunnel

Step 4 — Configure VPN Settings​

Configure the following in the Network and Authentication sections:

Network section:

ParameterValue
Namee2e-gcp
Remote gatewayStatic IP Address
IP addressGCP VPN Gateway Public IP
Interfaceport1
NAT traversalEnable
Keepalive frequency10
Dead peer detectionEnable
DPD retry count3
DPD retry interval20 seconds

VPN tunnel network settings

Authentication section:

ParameterValue
MethodPre-shared Key
Pre-shared keySame PSK configured in GCP Step 4
IKE versionVersion 2

Authentication settings

Step 5 — Configure Phase 1 Settings​

In the Phase 1 proposal section, configure:

ParameterValue
EncryptionAES256GCM
PRFPRFSHA256
Diffie-Hellman group14
Key lifetime86400 seconds

Phase 1 proposal settings

Cipher name mapping

GCP and FortiGate use different names for the same algorithms: GCP's AES-GCM-16-256 = FortiGate's AES256GCM. GCP's PRF-HMAC-SHA2-256 = FortiGate's PRFSHA256. Both DH Group 14 = modp_2048.

Step 6 — Configure Phase 2 Settings​

  1. In the Phase 2 selectors section, click Create new.

Phase 2 selectors — Create new

  1. Configure the selector:
ParameterValue
Namee2e-gcp
EncapsulationTunnel Mode
IP versionIPv4
Local addressE2E Cloud VPC CIDR (e.g., 10.11.14.0/23)
Remote addressGCP subnet CIDR (e.g., 10.128.0.0/20)

Phase 2 selector addresses

  1. In the Advanced section, configure:
ParameterValue
EncryptionAES256GCM
Replay detectionEnable
Perfect Forward Secrecy (PFS)Enable
Diffie-Hellman group14

Phase 2 advanced settings

  1. Configure additional Phase 2 settings:
ParameterValue
Local portAll
Remote portAll
ProtocolAll
Auto-negotiateEnable
Autokey keep aliveEnable
Key lifetime43200 seconds

Phase 2 additional settings

  1. Click OK to save the Phase 2 selector, then click OK to save the tunnel.

Step 7 — Add a Static Route (E2E → GCP)​

  1. Navigate to Network → Static Routes → Create New.
  2. Configure:
ParameterValue
DestinationGCP subnet CIDR (e.g., 10.128.0.0/20)
Interfacee2e-gcp (VPN tunnel)

New static route

  1. Click OK. This directs all GCP-bound traffic through the VPN tunnel.

Step 8 — Create Firewall Policy (E2E → GCP)​

  1. Navigate to Policy & Objects → Firewall Policy → Create New.
  2. Configure:
Policy 1: E2E → GCP
FieldValue
NameE2E-to-GCP
Incoming interfaceport2 (internal/LAN interface)
Outgoing interfacee2e-gcp (VPN tunnel)
SourceE2E local network address object
DestinationGCP subnet address object
ServiceALL
ActionACCEPT
NATDisable

Firewall policy E2E to GCP

  1. Click OK.

Step 9 — Create Firewall Policy (GCP → E2E)​

  1. Click Create New again to create the reverse policy.
  2. Configure:
Policy 2: GCP → E2E
FieldValue
NameGCP-to-E2E
Incoming interfacee2e-gcp (VPN tunnel)
Outgoing interfaceport2 (internal/LAN interface)
SourceGCP subnet address object
DestinationE2E local network address object
ServiceALL
ActionACCEPT
NATDisable

Firewall policy GCP to E2E

  1. Click OK.

Both policies are required for bidirectional communication through the VPN tunnel.

Step 10 — Verify VPN Tunnel Status​

GCP side:

  1. Navigate to Network Connectivity → VPN → Cloud VPN tunnels.
  2. Verify that the e2e-gcp-tunnel status shows Established.

GCP VPN tunnel Established

FortiGate side:

  1. Navigate to VPN → VPN Tunnels.
  2. Verify that the e2e-gcp tunnel status shows Up.

FortiGate VPN tunnel Up

note

The tunnel must show Established on GCP and Up on FortiGate before connectivity testing. If either side shows a different status, verify that the PSK and cipher settings match exactly on both sides.

Part 3 — Connectivity Testing​

Step 1 — Note the E2E Cloud VM Details​

In the E2E Cloud Console, go to your Nodes list and note the Private IP of your E2E Cloud VM (e.g., 10.11.14.16).

E2E Cloud VM private IP

A test VM was already created in GCP in Part 1, Step 2 (private IP: 10.128.0.2).

Step 2 — Add a Route on the E2E Cloud VM​

Log in to the E2E Cloud VM via SSH and add a route to the GCP network:

sudo ip route add 10.128.0.0/20 via 10.11.14.6 dev ens4

Add route on E2E VM

Route explanation
  • 10.128.0.0/20 — GCP VPC CIDR
  • 10.11.14.6 — FortiGate private IP on the E2E side
  • ens4 — network interface connected to the E2E Cloud VPC

This ensures GCP-bound traffic is forwarded to the FortiGate, which routes it through the VPN tunnel.

Step 3 — Verify Ping Connectivity​

E2E Cloud VM → GCP VM

From the E2E Cloud VM, ping the GCP VM's private IP:

ping 10.128.0.2

Ping from E2E to GCP — Successful

GCP VM → E2E Cloud VM

From the GCP VM (via browser-based SSH in GCP Console), ping the E2E Cloud VM's private IP:

ping 10.11.14.16

Ping from GCP to E2E — Successful

Successful pings in both directions confirm the VPN tunnel is fully active and routing correctly.

Step 4 — Verify SSH Connectivity​

Generate an SSH key on the E2E Cloud VM:

ssh-keygen -t ed25519 -C "e2e-gcp-vpn"

Press Enter to accept defaults.

Copy the public key:

cat ~/.ssh/id_ed25519.pub

Add the key to the GCP VM:

  1. In GCP Console, go to Compute Engine → VM Instances.
  2. Select the GCP test VM and click Edit.
  3. Scroll to SSH Keys → Add Item, paste the public key, and click Save.

Connect from E2E Cloud VM to GCP VM:

ssh e2e-gcp-vpn@10.128.0.2

SSH from E2E to GCP — Successful

Successful SSH access confirms full end-to-end private connectivity between E2E Cloud and Google Cloud Platform.

Conclusion​

The Site-to-Site IPsec VPN between E2E Cloud and Google Cloud Platform is now fully configured and verified. Traffic between the E2E Cloud VPC and the GCP VPC is securely routed through an encrypted IPsec tunnel, enabling private communication between resources in both environments without traversing the public internet.