Google Cloud BOVPN Virtual Interface Integration Guide

Deployment Overview

This integration guide describes how to configure a BOVPN virtual interface tunnel between a WatchGuard Firebox and Google Cloud Platform.

• This integration guide describes three methods to configure a BOVPN on a Firebox. The methods are equivalent and independent. You can use any one of these methods.
  • Fireware Web UI
  • WatchGuard System Manager (WSM)
  • Cloud-Managed Firebox

WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, go to the documentation and support resources for that product.

Topology

This diagram shows the topology for a BOVPN virtual interface connection between a Firebox and Google Cloud Platform.

Configure the Firebox (WebUI)

To configure a BOVPN virtual interface connection on the Firebox:

1. Log in to Fireware Web UI.
2. Select VPN > BOVPN Virtual Interfaces.
3. Click Add.
   The BOVPN Virtual Interfaces page opens.
4. In the Interface Name text box, type a name to identify this BOVPN virtual interface.
5. From the Remote Endpoint Type drop-down list, select Cloud VPN or Third-Party Gateway.
6. From the Gateway Address Family drop-down list, select IPv4 Addresses.
7. In the Credential Method section, select Use Pre-Shared Key.
8. In the adjacent text box, type the pre-shared key.
9. Keep the default String-Based setting.

10. In the Gateway Endpoint section, click Add.
    The Gateway Endpoint Settings dialog box opens.
11. From the Physical drop-down list, select External.
12. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
    The primary interface IP address is the primary IP address you configured on the selected external interface.
13. Select By IP Address.
14. In the adjacent text box, type the primary IP address of the external Firebox interface.
    

15. Select the Remote Gateway tab.
16. Select Static IP Address.
17. In the adjacent text box, type the external IP address of your Google Cloud connection.
18. Select By IP Address.
19. In the adjacent text box, type the external IP address of your Google Cloud connection.

20. Click OK.
21. In the Gateway Endpoint section, select Start Phase 1 Tunnel When It Is Inactive.
22. Select Add This Tunnel to the BOVPN-Allow Policies.

Add VPN Routes

To configure VPN routes on the Firebox:

1. Select the VPN Routes tab.
2. In the VPN Routes section, click Add.
   The VPN Route Settings dialog box opens.
3. From the Choose Type drop-down list, select an address type. In our example, we select Network IPv4.
4. In the Route To text box, type the IP address of a route that uses this virtual interface.

5. Click OK.

Configure Phase 1 Settings

To configure Phase 1 settings on the Firebox:

1. Select the Phase 1 Settings tab.
2. From the Version drop-down list, select IKEv2.
3. For all other settings, keep the default values.

4. Keep the default settings on the Phase 2 Settings tab.
5. Click Save.

For more information about BOVPN virtual interface configuration on the Firebox, go to Configure a BOVPN Virtual Interface.

Configure the Firebox (WSM)

To configure a BOVPN virtual interface connection on the Firebox:

1. Connect to the Firebox from WSM.
2. Select Tools > Policy Manager.
   
3. Select VPN > BOVPN Virtual Interfaces.
   
4. Click Add.
   The BOVPN Virtual Interface configuration page opens.

5. In the Interface Name text box, type a name to identify this BOVPN virtual interface.
6. From the Remote Endpoint Type drop-down list, select Cloud VPN or Third-Party Gateway.
7. From the Gateway Address Family drop-down list, select IPv4 Addresses.
8. In the Gateway Settings section, from the Credential Method section, select Use Pre-Shared Key.
   
9. In the adjacent text box, type the pre-shared key.
10. In the adjacent drop-down list, keep the default String-Based value.
11. From the Gateway Endpoint section, click Add.
    The Gateway Endpoint Settings dialog box opens.

12. In the Local Gateway area, from the Physical drop-down list, select External.
13. From the Interface IP Address drop-down list, select Primary Interface IPv4 Address.
    The Primary Interface IP Address is the primary IP address you configured on the selected external interface.
14. To specify the gateway ID for tunnel authentication, select By IP Address.
15. In the adjacent text box, type the primary IP address of the external Firebox interface.
    
16. In the Remote Gateway area, to specify the remote gateway IP address for a tunnel, select Static IP Address.
17. In the adjacent text box, type the external IP address of your Google Cloud connection.
18. To specify the remote gateway ID for tunnel authentication, select By IP Address.
19. In the adjacent text box, type the external IP address of your Google Cloud connection.
20. Keep the default values for all other options.
21. Click OK.
    

22. Select the VPN Routes tab.
23. Click Add.
    The Add Route Settings dialog box opens.

24. From the Choose Type drop-down list, select Network IPv4.
25. In the Route To text box, type the remote IP segment. This is the local network protected by Google Cloud.
26. Keep the default values for all other options.
27. Click OK.

28. Select the Phase 1 Settings tab.
29. From the Version drop-down list, select IKEv2.
30. Keep the default values for all other Phase 1 settings.

31. Click OK.
32. Keep the default values for the Phase 2 Settings tab.

33. Click OK.
34. Click Close.
35. Click Save to Firebox.

Configure The Firebox (Cloud-Managed)

To configure a BOVPN virtual interface connection on the cloud-managed Firebox:

1. Log in to WatchGuard Cloud with your WatchGuard Cloud operator account credentials.
   If you log in with a Service Provider account, you must select a Subscriber account from the Account Manager.
2. From the navigation menu, select Configure > Device Configuration > VPN.
3. Click Branch Office VPN.
4. Click Add BOVPN.
   The Add BOVPN page opens.

5. In the Name text box, type a descriptive name.
6. From the VPN Connection Type drop-down list, select Route-Based IPSec to Locally-Managed Firebox / Third-Party.
7. From the Address Family drop-down list, select IPv4 Addresses.
8. In the Endpoint A section, select your cloud-managed Firebox.
9. In the Endpoint B section, in the Endpoint Name text box, type a name to identify the remote VPN endpoint. In our example, we use GCloud.
10. Click Next.
    The VPN Gateways page opens.

11. In the VPN Gateways (IPv4 Addresses) section:
    1. For your cloud-managed Firebox, select the External network.
    2. For your GCloud connection, in the IP or Domain Name text box, type the external IP address of your Google Cloud connection.
12. In the Pre-Shared Key text box, type the pre-shared key value.
13. Click Next.
    The Traffic page opens.

14. For your cloud-managed Firebox, select the Internal network that you want to be accessible through the VPN tunnel.
15. For your GCloud connection, click Add Network Resource.
16. In the Network Resource text box, type the CIDR for your GCloud. In our example, we type 192.168.1.0/24.
17. In the Distance text box, enter a number from 1 through 254.
    Routes with lower metrics have higher priority. The default value is 1. If this is your second redundant VPN tunnel, type a higher number than the distance for the first VPN tunnel.
18. Click Add.
19. Keep the default value for all other settings.
20. Click Next.
    The Security page opens.

21. In the Phase 1 Settings section:
    1. From the Authentication drop-down list, select SHA2-256.
    2. From the Encryption drop-down list, select AES-CBC (256-bit).
    3. In the SA Life text box, type 8.
    4. From the Diffie-Hellman Group drop-down list, select Diffie-Hellman Group 14.
22. In the Phase 2 Settings section:
    1. From the Authentication drop-down list, select SHA2-256.
    2. From the Encryption drop-down list, select AES-CBC (256-bit).
    3. Select the Use Perfect Forward Secrecy (PFS) check box.
    4. From the PFS Group drop-down list, select Diffie-Hellman Group 14.
23. Keep the default value for all other settings.
24. Click Add.
25. Click Finish.

When you add a BOVPN for a cloud-managed Firebox, WatchGuard Cloud immediately creates and deploys a configuration update for the cloud-managed Firebox.

For more information about BOVPN configuration for a cloud-managed Firebox, go to Manage BOVPNs for Cloud-Managed Fireboxes.

Configure the Google Cloud VPN

To configure the Google Cloud VPN:

1. Log in to the Google Cloud Platform.
2. Select a project or create a new one. In our example, we use GoogleCloudVPN.
3. From the navigation menu, select VPC Network > VPC Networks.
4. Click Continue
   The Product Details page opens.

5. Click Enable.
   The VPC Networks page opens.

6. Click Create VPC Network.
   The Create a VPC Network page opens.
7. In the Name text box, type a name for the VPC network. In our example, we use cloud-vpc-network.
8. In the Subnet Creation Mode section, select Custom.
9. In the Subnets section, create a new subnet or edit the existing Subnet 1.
10. In the New Subnet or Edit Subnet section, in the Name text box, type a name for the subnet. In our example, we use subnet-asia-east1-192-168-1.
11. From the Region drop-down list, select the specific geographical location where you want to host your resources. In our example, we select Asia-East1.
12. From IP stack type section, select IPv4 (single-stack).
13. In the IPv4 Range text box, specify the IP address range for this subnet. In our example, we use 192.168.1.0/24.
14. (Optional) For Flow Logs, select On.
15. Click Done.

16. Keep the default values for all other settings.
17. Click Create.

Reserve a Static Address

To reserve a static address:

1. From the navigation menu, select VPC Network > IP Addresses.
   The IP Addresses page opens.

2. Click Reserve External.
   The Reserve External Static IP Address page opens.

3. In the Name text box, type a name for the external IP address. In our example, we use google-cloud-vpn-ip.
4. From the Region drop-down list, select the region where you want to create the static address. In our example, we select asia-east1 (Taiwan).
5. Keep the default values for all other settings.
6. Click Reserve.

Configure the VPN Connection Settings

To configure the VPN connection settings:

1. In the search box, type VPN, then select VPN.

2. Click Create VPN Connection.
3. In the VPN Options section, select Classic VPN.
4. Click Continue.
   The Create a VPN Connection page opens.

5. In the Google Compute Engine VPN Gateway section, in the Name text box, type a name for the VPN gateway.
6. From the Network drop-down list, select the network you created. In our example, we select cloud-vpc-network.
7. From the Region drop-down list, select a region. In our example, we select asia-east1.
8. From the IP address drop-down list, select the IP address you created. In our example, we select google-cloud-vpn-ip.
9. In the Tunnels section, in the Name text box, type a name for the tunnel.
10. In the Remote Peer IP Address text box, type the external IP address of the remote peer.
11. From the IKE Version drop-down list, select IKEv2.
12. In the IKE Pre-Shared Key text box, type the IKE pre-shared key for this tunnel.
13. For Routing Options, select Route-Based.
14. In the Remote Network IP Ranges text box, type the IP address ranges of the remote networks.
15. Click Done.
16. Click Create.

Create Firewall Rules

To create firewall rules:

1. From the navigation menu, select VPC Network > Firewall.
2. Click Create Firewall Rule.
   The Create a Firewall Rule page opens.

3. In the Name text box, type a name for this rule.
4. For Logs, select On.
5. From the Network drop-down list, select the network you created. In our example, we select cloud-vpc-network.
6. For Direction of Traffic, select Ingress.
7. For Action on Match, select Allow.
8. From the Targets drop-down list, select All Instances In the Network.
9. From the Source Filter drop-down list, select IPv4 Ranges.
10. In the Source IPv4 Ranges text box, type the IP address ranges of remote internal networks.
11. For Protocols and Ports, select Allow All or Specified Protocols and Ports. In our example, we select Allow All.
12. Keep the default values for all other settings.
13. Click Create.
14. To create an egress rule, repeat steps 2-13, but in Step 6, select Egress instead of Ingress

15. Click Create.

Google Cloud VPN automatically negotiates the authentication, encryption, and key group with the Firebox. You cannot edit these settings in the Google Cloud VPN configuration.

For more information about Google Cloud VPN configuration and supported IKE ciphers, go to the Google Cloud VPN Documentation.

Test the Integration

To verify the VPN status in Google Cloud:

1. From the navigation menu, select Networking > Network Connectivity > VPN.
2. Select the Cloud VPN Tunnels tab, and verify that the VPN Tunnel Status is Established.

To verify the VPN status in Web UI:

1. From Web UI, select System Status > VPN Statistics.
   The VPN Statistics page opens.

2. Select the Branch Office VPN tab, and verify the data shows the VPN as established.

To verify the VPN status in WSM:

1. Connect to the Firebox with WSM.
2. Select the Firebox to examine.
3. Verify the data shows the VPN as established.

To verify the VPN status in WatchGuard Cloud:

1. From the WatchGuard Cloud navigation menu, select Monitor > Devices.
   If you log in with a Service Provider account, you must select a Subscriber account from the Account Manager.
2. Select your cloud-managed Firebox, then select Live Status > VPN > Branch Office VPN.
3. Click the BOVPN name, and verify that the VPN is established.