Google Cloud Platform

Introduction

This guide aims to facilitate the process of setting up a Site-to-Site VPN tunnel between your Harmony SASE network and Google Cloud Platform (GCP).

Establishing this secure connection ensures that your local networks and the cloud infrastructure seamlessly integrate, paving the way for resource accessibility and data transfer with increased security.

Breakdown of topics

1. Pre-requisites
2. Configuration Steps
3. Verifying the Setup
4. Troubleshooting
5. Support Contacts

Pre-requisites

To successfully follow this guide, you should have:

1. An active Harmony SASE account and a functional network.
2. Installed the Harmony SASE app on your devices.
3. An active Google Cloud Platform (GCP) account with the necessary administrative permissions.

Configuration Steps

GCP includes a few steps throughout the configuration and needs to be applied for every VPC.

1. Create Virtual Private Gateway.
   • Go to the Network Connectivity in the Google Cloud Platform Console.
   • Under the left menu go to VPN, select Cloud VPN Gateways, then create VPN Gateway.
     
   • Select Classic VPN.
     
   • Fill in the following information:
     
   • Name: Enter a name of your choice.
   • Network: Select default or a specific VPC.
   • Region: Preferably the region in which your resources lie.
   • IP Address: Create an IP address that will serve to connect your gateway.
     
2. Create a Tunnel
   • Scroll to the lower part of the page. Fill in the following information:
     
   • Name: Enter a name of your choice.
   • Remote peer IP address: Enter your Harmony SASE Gateway IP (to obtain this, open the Harmony SASE Platform, and under Network select the network that contains the gateway to which you'd like to create a tunnel).
     
   • IKE Version: IKEv2
     
   • IKE pre-shared key: Select Generate and copy or choose a key of your own and write it down.
   • Routing options: Route-based
   • Remote network IP ranges: 10.255.0.0/16 (unless customized)
   • Select Done, then Create.

Harmony SASE Platform configurations

1. Enter the Harmony SASE Management Platform. Under the Networks tab in the left menu, select the network name in which you'd like to set the Tunnel.
2. Locate the desired gateway, select the three-dotted menu (...), Add Tunnel, and then IPSec Site-2-Site Tunnel.
3. In the General Settings section, fill in the following information:
   • Name: Choose whatever name you find suitable for the Tunnel.
   • Harmony SASE Gateway Proposal Subnets: Leave Any (0.0.0.0/0) selected here.
   • Remote Gateway Proposal Subnets: Leave Any (0.0.0.0/0) set here.
     
4. At the Advanced Settings section, fill in the following information:
   
   • IKE Version: V2
   • IKE Lifetime: 8h
   • Tunnel Lifetime: 1h
   • Dead Peer Detection Delay: 10s
   • Dead Peer Detection Timeout: 30s
   • Encryption(Phase 1): aes256
   • Encryption(Phase 2): aes256
   • Integrity (Phase 1): sha512
   • Integrity (Phase 2): sha512
   • Diffie-Hellman Groups (Phase 1): 21
   • Diffie-Hellman Groups (Phase 2): 21
     (These are suggestions, other supported ciphers can be found in this Google article)
5. Select Add Tunnel.
6. In the network menu, select the three dots and click on Routes Table:
7. Click the Add Route button on the top right, then on this popup, fill out accordingly and click the Add Route button:
   • Subnets - Copy the subnets of the regions where your resources are installed. This can be queried in the Google Cloud Console here:
8. Be sure to click Apply Configuration when done.
   

Configuring the routing rules to the VPC network

1. Go to the VPC Network in the Google Cloud Platform Console. Under the left menu go to Routes.

2. Select Create Route Rule and fill in the following information:

• Name: The name of the VPN gateway.
• Network: The VPC network containing the instances that the VPN gateway will serve (should be the same network as selected in the previous steps).
• Destination Network IP range: Specify 10.255.0.0/16 (or customized)
• Priority: 1000
• Next hop: Select Specify VPN Tunnel.
• Next hop VPN tunnel: Select the VPN tunnel you created in the previous steps.
• Select Create.

Allowing incoming connections from Harmony SASE local network using firewall rules

1. Go to the VPC Network in the Google Cloud Platform Console.
2. Under the left menu go to Firewall Rules.
   
3. Select Create Firewall Rule and fill in the following information:
   
   • Name: Enter a name of your choice.
   • Logs: Off
   • Network: The VPC network containing the instances the VPN gateway will serve (should be the same network as selected in the previous steps).
   • Priority: 1000
   • The direction of traffic should be Ingress.
     
   • Action on match: allow
   • Target tags: optional
   • Source filter: IP Ranges
   • Source IP ranges: 10.255.0.0/16 (unless customized)
   • Second source filter: none
   • Allowed protocols or ports: all

Verifying the Setup

After following the above steps, your tunnel should be active.
To verify, go to your Harmony SASE dashboard, locate the tunnel you just created, and check the tunnel status.
It should indicate that the tunnel is "Up", signifying a successful connection.
Next, connect to your network using the Harmony SASE agent and attempt to access one of the resources in your environment.

Troubleshooting

If you encounter issues during or after the setup, try reviewing your settings to ensure everything matches the instructions. In particular, check the IP addresses and other details you entered during setup. If issues persist, please consult our dedicated support.

Support Contacts

If you have any difficulties or questions, don't hesitate to contact Harmony SASE's support team. We offer 24/7 chat support on our website at Perimeter81.com, or you can email us at sase-support@checkpoint.com. We're here to assist you and ensure your VPN tunnel setup is a success.