155 lines
7.2 KiB
Markdown
155 lines
7.2 KiB
Markdown
# Cloud VPN Dynamic Module
|
|
|
|
This module makes it easy to deploy a [Classic VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview#classic-vpn) with dynamic (BGP) routing.
|
|
|
|
<!-- BEGIN TOC -->
|
|
- [Examples](#examples)
|
|
- [Classic VPN with single tunnel](#classic-vpn-with-single-tunnel)
|
|
- [Classic VPN with single tunnel and custom ciphers](#classic-vpn-with-single-tunnel-and-custom-ciphers)
|
|
- [Variables](#variables)
|
|
- [Outputs](#outputs)
|
|
<!-- END TOC -->
|
|
|
|
## Examples
|
|
|
|
### Classic VPN with single tunnel
|
|
|
|
This example shows how to configure a single VPN tunnel using a couple of extra features:
|
|
|
|
- custom advertisement on the tunnel's BGP session; if custom advertisement is not needed, simply set the `custom_advertise` attribute to `null`
|
|
- internally generated shared secret, which can be fetched from the module's `random_secret` output for reuse; a predefined secret can be used instead by assigning it to the `shared_secret` attribute
|
|
|
|
```hcl
|
|
module "vm" {
|
|
source = "./fabric/modules/compute-vm"
|
|
project_id = "my-project"
|
|
zone = "europe-west1-b"
|
|
name = "my-vm"
|
|
network_interfaces = [{
|
|
nat = true
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}]
|
|
service_account = {
|
|
auto_create = true
|
|
}
|
|
}
|
|
|
|
module "vpn-dynamic" {
|
|
source = "./fabric/modules/net-vpn-dynamic"
|
|
project_id = "my-project"
|
|
region = "europe-west1"
|
|
network = var.vpc.name
|
|
name = "gateway-1"
|
|
router_config = {
|
|
asn = 64514
|
|
}
|
|
tunnels = {
|
|
remote-1 = {
|
|
bgp_peer = {
|
|
address = "169.254.139.134"
|
|
asn = 64513
|
|
custom_advertise = {
|
|
all_subnets = true
|
|
all_vpc_subnets = false
|
|
all_peer_vpc_subnets = false
|
|
ip_ranges = {
|
|
"192.168.0.0/24" = "Advertised range description"
|
|
}
|
|
}
|
|
}
|
|
bgp_session_range = "169.254.139.133/30"
|
|
peer_ip = module.vm.external_ip
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=2 resources=12 inventory=vpn-single-tunnel.yaml
|
|
```
|
|
|
|
### Classic VPN with single tunnel and custom ciphers
|
|
|
|
This example shows how to configure a single VPN tunnel with custom ciphers.
|
|
|
|
```hcl
|
|
module "vm" {
|
|
source = "./fabric/modules/compute-vm"
|
|
project_id = "my-project"
|
|
zone = "europe-west1-b"
|
|
name = "my-vm"
|
|
network_interfaces = [{
|
|
nat = true
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}]
|
|
service_account = {
|
|
auto_create = true
|
|
}
|
|
}
|
|
|
|
module "vpn-dynamic" {
|
|
source = "./fabric/modules/net-vpn-dynamic"
|
|
project_id = "my-project"
|
|
region = "europe-west1"
|
|
network = var.vpc.name
|
|
name = "gateway-1"
|
|
router_config = {
|
|
asn = 64514
|
|
}
|
|
tunnels = {
|
|
remote-1 = {
|
|
bgp_peer = {
|
|
address = "169.254.139.134"
|
|
asn = 64513
|
|
custom_advertise = null
|
|
}
|
|
bgp_session_range = "169.254.139.133/30"
|
|
cipher_suite = {
|
|
phase1 = {
|
|
dh = ["Group-14"]
|
|
encryption = ["AES-CBC-256"]
|
|
integrity = ["HMAC-SHA2-256-128"]
|
|
prf = ["PRF-HMAC-SHA2-256"]
|
|
}
|
|
phase2 = {
|
|
encryption = ["AES-CBC-128"]
|
|
integrity = ["HMAC-SHA2-256-128"]
|
|
pfs = ["Group-14"]
|
|
}
|
|
}
|
|
peer_ip = module.vm.external_ip
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=2 resources=12 inventory=vpn-single-tunnel-custom-ciphers.yaml
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [name](variables.tf#L29) | VPN gateway name, and prefix used for dependent resources. | <code>string</code> | ✓ | |
|
|
| [network](variables.tf#L34) | VPC used for the gateway and routes. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L39) | Project where resources will be created. | <code>string</code> | ✓ | |
|
|
| [region](variables.tf#L44) | Region used for resources. | <code>string</code> | ✓ | |
|
|
| [router_config](variables.tf#L49) | Cloud Router configuration for the VPN. If you want to reuse an existing router, set create to false and use name to specify the desired router. | <code title="object({ create = optional(bool, true) asn = number name = optional(string) keepalive = optional(number) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) })">object({…})</code> | ✓ | |
|
|
| [gateway_address](variables.tf#L17) | Optional address assigned to the VPN gateway. Ignored unless gateway_address_create is set to false. | <code>string</code> | | <code>null</code> |
|
|
| [gateway_address_create](variables.tf#L23) | Create external address assigned to the VPN gateway. Needs to be explicitly set to false to use address in gateway_address variable. | <code>bool</code> | | <code>true</code> |
|
|
| [tunnels](variables.tf#L64) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool all_vpc_subnets = bool all_peer_vpc_subnets = bool ip_ranges = map(string) })) }) bgp_session_range = string cipher_suite = optional(object({ phase1 = optional(object({ dh = optional(list(string)) encryption = optional(list(string)) integrity = optional(list(string)) prf = optional(list(string)) })) phase2 = optional(object({ encryption = optional(list(string)) integrity = optional(list(string)) pfs = optional(list(string)) })) })) ike_version = optional(number, 2) peer_ip = string router = optional(string) shared_secret = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [address](outputs.tf#L17) | VPN gateway address. | |
|
|
| [gateway](outputs.tf#L22) | VPN gateway resource. | |
|
|
| [id](outputs.tf#L27) | Fully qualified VPN gateway id. | |
|
|
| [name](outputs.tf#L32) | VPN gateway name. | |
|
|
| [random_secret](outputs.tf#L37) | Generated secret. | |
|
|
| [router](outputs.tf#L43) | Router resource (only if auto-created). | |
|
|
| [router_name](outputs.tf#L48) | Router name. | |
|
|
| [self_link](outputs.tf#L53) | VPN gateway self link. | |
|
|
| [tunnel_names](outputs.tf#L58) | VPN tunnel names. | |
|
|
| [tunnel_self_links](outputs.tf#L66) | VPN tunnel self links. | |
|
|
| [tunnels](outputs.tf#L74) | VPN tunnel resources. | |
|
|
<!-- END TFDOC -->
|