# Cloud HA VPN Module This module makes it easy to deploy either GCP-to-GCP or GCP-to-On-prem [Cloud HA VPN](https://cloud.google.com/vpn/docs/concepts/overview#ha-vpn). ## Examples ### GCP to GCP ```hcl module "vpn_ha-1" { source = "./modules/net-vpn-ha" project_id = "" region = "europe-west4" network = "https://www.googleapis.com/compute/v1/projects//global/networks/network-1" name = "net1-to-net-2" peer_gcp_gateway = module.vpn_ha-2.self_link router_asn = 64514 router_advertise_config = { groups = ["ALL_SUBNETS"] ip_ranges = { "10.0.0.0/8" = "default" } mode = "CUSTOM" } tunnels = { remote-0 = { bgp_peer = { address = "169.254.1.1" asn = 64513 } bgp_peer_options = null bgp_session_range = "169.254.1.2/30" ike_version = 2 peer_external_gateway_interface = null router = null shared_secret = "" vpn_gateway_interface = 0 } remote-1 = { bgp_peer = { address = "169.254.2.1" asn = 64513 } bgp_peer_options = null bgp_session_range = "169.254.2.2/30" ike_version = 2 peer_external_gateway_interface = null router = null shared_secret = "" vpn_gateway_interface = 1 } } } module "vpn_ha-2" { source = "./modules/net-vpn-ha" project_id = "" region = "europe-west4" network = "https://www.googleapis.com/compute/v1/projects//global/networks/local-network" name = "net2-to-net1" router_asn = 64513 peer_gcp_gateway = module.vpn_ha-1.self_link tunnels = { remote-0 = { bgp_peer = { address = "169.254.1.2" asn = 64514 } bgp_peer_options = null bgp_session_range = "169.254.1.1/30" ike_version = 2 peer_external_gateway_interface = null router = null shared_secret = module.vpn_ha-1.random_secret vpn_gateway_interface = 0 } remote-1 = { bgp_peer = { address = "169.254.2.2" asn = 64514 } bgp_peer_options = null bgp_session_range = "169.254.2.1/30" ike_version = 2 peer_external_gateway_interface = null router = null shared_secret = module.vpn_ha-1.random_secret vpn_gateway_interface = 1 } } } # tftest modules=2 resources=18 ``` ### GCP to on-prem ```hcl module "vpn_ha" { source = "./modules/net-vpn-ha" project_id = var.project_id region = var.region network = var.vpc.self_link name = "mynet-to-onprem" peer_external_gateway = { redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT" interfaces = [{ id = 0 ip_address = "8.8.8.8" # on-prem router ip address }] } router_asn = 64514 tunnels = { remote-0 = { bgp_peer = { address = "169.254.1.1" asn = 64513 } bgp_peer_options = null bgp_session_range = "169.254.1.2/30" ike_version = 2 peer_external_gateway_interface = 0 router = null shared_secret = "mySecret" vpn_gateway_interface = 0 } remote-1 = { bgp_peer = { address = "169.254.2.1" asn = 64513 } bgp_peer_options = null bgp_session_range = "169.254.2.2/30" ike_version = 2 peer_external_gateway_interface = 0 router = null shared_secret = "mySecret" vpn_gateway_interface = 1 } } } # tftest modules=1 resources=10 ``` ## Variables | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [name](variables.tf#L17) | VPN Gateway name (if an existing VPN Gateway is not used), and prefix used for dependent resources. | string | ✓ | | | [network](variables.tf#L22) | VPC used for the gateway and routes. | string | ✓ | | | [project_id](variables.tf#L45) | Project where resources will be created. | string | ✓ | | | [region](variables.tf#L50) | Region used for resources. | string | ✓ | | | [peer_external_gateway](variables.tf#L27) | Configuration of an external VPN gateway to which this VPN is connected. | object({…}) | | null | | [peer_gcp_gateway](variables.tf#L39) | Self Link URL of the peer side HA GCP VPN gateway to which this VPN tunnel is connected. | string | | null | | [route_priority](variables.tf#L55) | Route priority, defaults to 1000. | number | | 1000 | | [router_advertise_config](variables.tf#L61) | Router custom advertisement configuration, ip_ranges is a map of address ranges and descriptions. | object({…}) | | null | | [router_asn](variables.tf#L71) | Router ASN used for auto-created router. | number | | 64514 | | [router_create](variables.tf#L77) | Create router. | bool | | true | | [router_name](variables.tf#L83) | Router name used for auto created router, or to specify an existing router to use if `router_create` is set to `true`. Leave blank to use VPN name for auto created router. | string | | "" | | [tunnels](variables.tf#L89) | VPN tunnel configurations, bgp_peer_options is usually null. | map(object({…})) | | {} | | [vpn_gateway](variables.tf#L114) | HA VPN Gateway Self Link for using an existing HA VPN Gateway, leave empty if `vpn_gateway_create` is set to `true`. | string | | null | | [vpn_gateway_create](variables.tf#L120) | Create HA VPN Gateway. | bool | | true | ## Outputs | name | description | sensitive | |---|---|:---:| | [bgp_peers](outputs.tf#L18) | BGP peer resources. | | | [external_gateway](outputs.tf#L25) | External VPN gateway resource. | | | [gateway](outputs.tf#L34) | VPN gateway resource (only if auto-created). | | | [name](outputs.tf#L43) | VPN gateway name (only if auto-created). . | | | [random_secret](outputs.tf#L52) | Generated secret. | | | [router](outputs.tf#L57) | Router resource (only if auto-created). | | | [router_name](outputs.tf#L66) | Router name. | | | [self_link](outputs.tf#L71) | HA VPN gateway self link. | | | [tunnel_names](outputs.tf#L76) | VPN tunnel names. | | | [tunnel_self_links](outputs.tf#L84) | VPN tunnel self links. | | | [tunnels](outputs.tf#L92) | VPN tunnel resources. | |