Check VPN status | Google Cloud (2024)

After you configure your peer VPN gateways, check the following components toensure that they are communicating correctly with Cloud VPN:

Check the status of the HA VPN or Classic VPNtunnels that you configured, including the operational state.
Check the high availability status of tunnels on anHA VPN gateway.
View the status of Cloud Router Border Gateway Protocol (BGP) sessions orthe routes that Cloud Router is advertising.

For more information about Cloud VPN, see the following resources:

For best practices to consider before setting up Cloud VPN, seeBest practices.
For more information about Cloud VPN, see theCloud VPN overview.
For definitions of terms used on this page, seeKey terms.

Check HA VPN tunnels

Use this procedure to check the status of tunnels on both interfaces ofan HA VPN gateway.

Console

In the Google Cloud console, go to the VPN page.
Go to VPN
View the VPN tunnel status and the BGPsession status.
To view tunnel details, click the Name of a tunnel.
Under Logs, click View for Cloud Logging logs.
You can also modify the BGP session associated with this tunnel.

gcloud

There are two steps to viewing tunnel status. First, identify the tunnelname and region, and then use the describe command option to view tunneldetails.

In the following commands, replace the following:

PROJECT_ID: the ID of your project
GW_NAME: the name of the gateway
REGION: the region where the gateway or tunnel resides
NAME: the name of the tunnel

To view tunnel status, complete the following steps:

Identify the name and region of the VPN tunnel whose status youneed to check. You can identify the tunnel by using either of thefollowing methods:

Option 1: To list all VPN tunnels in your project, run thefollowing command:

gcloud compute vpn-tunnels list --project=PROJECT_ID

The command output should look similar to the following example:

NAME REGION GATEWAY VPN_INTERFACE PEER_ADDRESStunnel-a-to-b-if-0 us-central1 ha-vpn-gw-a 0 10.242.123.165tunnel-a-to-b-if-1 us-central1 ha-vpn-gw-a 1 10.220.75.213tunnel-b-to-a-if-0 us-central1 ha-vpn-gw-b 0 10.242.127.148tunnel-b-to-a-if-1 us-central1 ha-vpn-gw-b 1 10.220.66.156

Option 2: If you know the name of the VPN gateway that containsthe tunnel, to retrieve the list of the gateway's associatedtunnels, run the following command:
```
gcloud compute vpn-gateways describe GW_NAME \ --region=REGION \ --project=PROJECT_ID \ --format='flattened(tunnels)'
```

After you know the name and region of the tunnel, use the describeoption of the vpn-tunnels command to determine the tunnel's status:

gcloud compute vpn-tunnels describe NAME \ --region=REGION \ --project=PROJECT_ID \ --format='flattened(status,detailedStatus)'

The basic status message and a more detailed message are returned.The command output should look similar to the following example.For a full listing, omit the --format option.

detailedStatus: Tunnel is up and running.

The following four command output examples show a full listing for a pairof tunnels on each of two HA VPN gateways that areconnected to each other. That is, on ha-vpn-gw-a, the tunnels oninterface 0 and interface 1 are connected to tunnels on thecorresponding interfaces of ha-vpn-gw-b.

Example 1: tunnel-a-to-b-if-0

 creationTimestamp: '2018-10-11T13:12:33.851-07:00' description: '' detailedStatus: Tunnel is up and running. id: '2919847494518181982' ikeVersion: 2 kind: compute#vpnTunnel labelFingerprint: LABEL_FINGERPRINT localTrafficSelector: — 0.0.0.0/0 name: tunnel-a-to-b-if-0 peerIp: GW_A_IF_0_IP region: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1 remoteTrafficSelector: — 0.0.0.0/0 router: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/routers/router-a selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-b-if-0 sharedSecret: '*************' sharedSecretHash: SECRET_HASH vpnGateway: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-a vpnGatewayInterface: 0

Example 2: tunnel-a-to-b-if-1

 creationTimestamp: '2018-10-11T13:14:21.630-07:00' description: '' detailedStatus: Tunnel is up and running. id: '178016642781024754' ikeVersion: 2 kind: compute#vpnTunnel labelFingerprint: LABEL_FINGERPRINT localTrafficSelector: —0.0.0.0/0 name: tunnel-a-to-b-if-1 peerIp: GW_B_IF_1_IP region: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1 remoteTrafficSelector: — 0.0.0.0/0 router: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/routers/router-a selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-a-to-b-if-1 sharedSecret: '*************' sharedSecretHash: SECRET_HASH vpnGateway: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-a vpnGatewayInterface: 1

Example 3: tunnel-b-to-a-if-0

 creationTimestamp: '2018-10-11T13:16:19.345-07:00' description: '' detailedStatus: Tunnel is up and running. id: '1183416925692236156' ikeVersion: 2 kind: compute#vpnTunnel labelFingerprint: LABEL_FINGERPRINT localTrafficSelector: — 0.0.0.0/0 name: tunnel-b-to-a-if-0 peerIp: GW_A_IF_0_IP region: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1 remoteTrafficSelector: — 0.0.0.0/0 router: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/routers/router-b selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-b-to-a-if-0 sharedSecret: '*************' sharedSecretHash: SECRET_HASH vpnGateway: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-b vpnGatewayInterface: 0

Example 4: tunnel-b-to-a-if-1

 creationTimestamp: '2018-10-11T13:19:01.562-07:00' description: '' detailedStatus: Tunnel is up and running. id: '8199247227773914842' ikeVersion: 2 kind: compute#vpnTunnel labelFingerprint: LABEL_FINGERPRINT localTrafficSelector: — 0.0.0.0/0 name: tunnel-b-to-a-if-1 peerIp: GW_A_IF_1_IP region: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1 remoteTrafficSelector: — 0.0.0.0/0 router: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/routers/router-b selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnTunnels/tunnel-b-to-a-if-1 sharedSecret: '*************' sharedSecretHash: SECRET_HASH vpnGateway: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/vpnGateways/ha-vpn-gw-b vpnGatewayInterface: 1

API

To view tunnel details, you can use either of the following API calls:

To list the attributes and status of all VPN tunnels in a specificproject and region, make a GET request by using thevpnTunnels.listmethod:
```
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnTunnels
```
To list the attributes and status of a specific tunnel in a specificproject and region, make a GET request by using thevpnTunnels.get method:
```
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnTunnels/TUNNEL_NAME
```

Check Classic VPN tunnels

Use this procedure to check the status of tunnels on aClassic VPN gateway.

Console

In the Google Cloud console, go to the VPN page.
Go to VPN
View the VPN tunnel statusand the BGP sessionstatus.
To view tunnel details, click the Name of a tunnel.
Under Logs, click View for Logging logs.
You can also modify the BGP session associated with this tunnel.

gcloud

The procedure for checking Classic VPN tunnel status issimilar to the one for HA VPN.

In the following commands, replace the following:

PROJECT_ID: the ID of your project
GW_NAME: the name of the gateway
REGION: the region where the gateway or tunnel resides
NAME: the name of the tunnel

To view tunnel status, complete the following steps:

Identify the name and region of the VPN tunnel whose status youneed to check. You can identify the tunnel by using either of thefollowing methods:
1. Option 1: To list all VPN tunnels in your project, run thefollowing command:
```
gcloud compute vpn-tunnels list --project=PROJECT_ID
```
2. Option 2: If you know the name of the VPN gateway that containsthe tunnel, to retrieve the list of the gateway's associated tunnels,run the following command:
```
gcloud compute target-vpn-gateways describe GW_NAME \ --region=REGION \ --project=PROJECT_ID \ --format='flattened(tunnels)'
```
Describe the tunnel to determine its status by running the followingcommand. The basic status message and a more detailed message are returned.For a full listing, omit the --format option.
```
gcloud compute vpn-tunnels describe NAME \ --region=REGION \ --project=PROJECT_ID \ --format='flattened(status,detailedStatus)'
```

API

To view tunnel details, you can use either of the following API calls:

To list the attributes and status of all VPN tunnels in a specificproject and region, make a GET request by using thevpnTunnels.listmethod:
```
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnTunnels
```
To list the attributes and status of a specific tunnel in a specificproject and region, make a GET request by using thevpnTunnels.get method:
```
GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnTunnels/TUNNEL_NAME
```

Check Classic VPN forwarding rules

Use this procedure to check the forwarding rules that you created for yourClassic VPN gateway.

Console

In the Google Cloud console, go to the VPN page.
Go to VPN
Click a Gateway name.
On the VPN details page, view the forwarding rules that you created.

gcloud

To view the forwarding rules for a Classic VPN gatewayin a specific region, run the following command:

gcloud compute target-vpn-gateways describe GW_NAME --region=REGION \ --project=PROJECT_ID

API

To view the forwarding rules for a Classic VPN gateway in aspecific region, use thetargetVpnGateways.getmethod. Replace RESOURCE_ID with the name of the gateway.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/targetVpnGateways/RESOURCE_ID

Interpret tunnel status messages

To interpret tunnel status messages from the Google Cloud console or theGoogle Cloud CLI, use the following table.

Status	Detailed status message	Notes
Allocating resources	Allocating resources. VPN tunnel will start soon.	The initial state for a newly created Cloud VPN tunnel.
Waiting for full config	Waiting for route configuration.	Routes or routing configuration is being prepared.
First Handshake	Handshake with peer broken for unknown reason. Trying again soon.	Phase 1 (IKE SA) negotiation with the peer VPN is in progress. It might have failed at least once.
Established	Tunnel is up and running.	The tunnel is up, and routes have been configured.
No Incoming Packets	No incoming packets from peer.	No traffic is being received from the peer VPN gateway.

Check high availability status for HA VPN gateways

To check the high-availability configuration status for tunnels on anHA VPN gateway, use the Google Cloud console, thecompute vpn-gateways get-status command, or the vpnGateways.getStatus method.

The output displays the high-availability redundancyrequirement state for VPN tunnels associated with each peer gateway to which theHA VPN gateway is connected.

The peer gateway can be another HA VPN gateway or anexternal VPN gateway. If there are multiple peer gateways connected to theHA VPN gateway, multiple high-availability configurationstatuses are displayed, one status per each peer gateway.

The command output indicates the correct tunnel amount and coverage in thefollowing ways:

VPN gateways configured with adequate redundancy (coverage) show thefollowing status:
HighAvailabilityRedundancyRequirementState: CONNECTION_REDUNDANCY_MET.
VPN gateways that are not configured with adequate redundancy show thefollowing status:
HighAvailabilityRedundancyRequirementState: CONNECTION_REDUNDANCY_NOT_MET.
If there are not enough tunnels configured between yourHA VPN gateway and another HA VPNgateway or a peer gateway, the command output shows the following status:
redundancyUnsatisfiedReason: INCOMPLETE_TUNNELS_COVERAGE.

For additional information, seeView logs and metrics.

Console

In the Google Cloud console, go to the VPN page.
Go to VPN
To view gateway details for the gateway and its tunnels, clickGateway name. For HA VPN gateways, you can alsoview high-availability status for the gateway.

gcloud

To display tunnel status for the HA VPN gateway,run the following command. Replace the following:

GW_NAME: the name of the HA VPNgateway
REGION: the region where the gateway resides

gcloud compute vpn-gateways get-status GW_NAME \ --region=REGION

The following command output example shows information for anHA VPN gateway connected to a peer gateway with twointerfaces:

 peerGateways: — peerExternalGateway: peer-gw tunnels: — localGatewayInterface: 0 peerGatewayInterface: 0 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-0 — localGatewayInterface: 1 peerGatewayInterface:1 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-on-prem-if-1 HighAvailabilityRedundancyRequirementState: state: CONNECTION_REDUNDANCY_MET

The following command output example is for two HA VPNgateways connected to each other. For this type of configuration, run thecommand for each HA VPN gateway name:

Getting status for ha-vpn-gw-a shows its connection to ha-vpn-gw-b:

peerGateways:— peerGcpGateway: ha-vpn-gw-btunnels:— localGatewayInterface: 0 peerGatewayInterface: 0 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-b-if-0— localGatewayInterface: 1 peerGatewayInterface: 1 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-b-if-1 HighAvailabilityRedundancyRequirementState: state: CONNECTION_REDUNDANCY_MET

Getting status for ha-vpn-gw-b shows its connection to ha-vpn-gw-a:

peerGateways:— peerGcpGateway: ha-vpn-gw-atunnels:— localGatewayInterface: 0 peerGatewayInterface: 0 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-b-to-a-if-0— localGatewayInterface: 1 peerGatewayInterface: 1 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-b-to-a-if-1 HighAvailabilityRedundancyRequirementState: state: CONNECTION_REDUNDANCY_MET

The following command output example is for one HA VPNgateway connected to an AWS virtual gateway with two connections andfour IP addresses:

 peerGateways: - peerExternalGateway: peer-gw tunnels: - localGatewayInterface: 0 peerGatewayInterface: 0 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-aws-connection-0-ip0 - localGatewayInterface: 0 peerGatewayInterface: 1 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-aws-connection-0-ip1 - localGatewayInterface: 1 peerGatewayInterface: 2 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-aws-connection-1-ip0 - localGatewayInterface: 1 peerGatewayInterface: 3 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-a-to-aws-connection-1-ip1 HighAvailabilityRedundancyRequirementState: state: CONNECTION_REDUNDANCY_MET

The following command output example is for two HA VPNgateways connected to each other with a single tunnel. This configurationdoes not meet the 99.99% availability SLA:

 peerGateways: - peerGcpGateway: ha-vpn-gw-a tunnels: - localGatewayInterface: 0 peerGatewayInterface: 0 tunnelUrl: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/ regions/us-central1/vpnTunnels/tunnel-b-to-a-if-0 HighAvailabilityRedundancyRequirementState: state: CONNECTION_REDUNDANCY_NOT_MET detailedStatus: redundancyUnsatisfiedReason: INCOMPLETE_TUNNELS_COVERAGE

API

To get the status of a specific HA VPN gateway in aspecific project and region, make a GET request by using thevpnGateways.getStatusmethod:

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/vpnGateways/GATEWAY_NAME/getStatus

Check BGP status

For tunnels that use dynamic routing with BGP, you cancheck Cloud Router statusto view details such as the status of a router's BGP sessions or the routes thatthe Cloud Router is advertising.

What's next

To use high-availability and high-throughput scenarios or multiplesubnet scenarios, seeAdvanced configurations.
To help you solve common issues that you might encounter when usingCloud VPN, see Troubleshooting.

FAQs

Check VPN status | Google Cloud? ›

In the Google Cloud console, go to the Logs Explorer page. VPN logs are indexed by the VPN gateway that created them: To view all VPN logs, in the first drop-down menu, select Cloud VPN gateway, and then click All gateway_id. To view logs for only one gateway, select a single gateway name from the menu.

Know More ›

How can I check my VPN status? ›

How to check if a VPN is working

Turn off your VPN.
Visit WhatIsMyIPAddress.com. You'll see your public IP address — the one that's assigned to you by your internet service provider (ISP). ...
Turn on your VPN and connect to a server in your chosen location. ...
Check your IP address again using the same method as before.

Jun 24, 2024

Discover More Details ›

How to check VPN logs in GCP? ›

How do I know if Google Fi VPN is working? ›

Important: When you're in a country or region that doesn't allow VPN use, you get a notification in the Google Fi app. Android: If the VPN icon is in the status bar, the VPN is on. iPhone and iPad: If the VPN icon is in the status bar, the VPN is on.

Learn More ›

How to check VPN status in CLI? ›

CLI: Checking the VPN Status

Run the display ike sa command to check the establishment of the IPsec tunnel.
Run the display ipsec sa command to check detailed information about the IPsec tunnel.
Run the display ipsec statistics command to check IPsec packet statistics.

Apr 26, 2024

Learn More ›

How do you tell if a VPN is actually working? ›

How do I check if a VPN is working? Visit websites such as WhatIsMyIP or IPLocation to see your original IP address. After connecting to a VPN, revisit the IP address checking website to recheck your IP address. The VPN works if the displayed IP address differs from your original IP address.

Keep Reading ›

How do I know if my VPN is running in the background? ›

You can tell if you are connected to the VPN server by verifying your IP address. You can do this by entering “What is my ip” in your browser. It should be different than what it is before you launch your VPN. Working correctly is much harder to verify.

Get More Info Here ›

Is Google VPN logged? ›

In addition, your network traffic and IP address will never be logged, and Google will never use the VPN connection to track, log, or sell your online activity.

How do I know if Google VPN is working? ›

In the Google Cloud console, go to the VPN page. Go to VPN.
View the VPN tunnel status and the BGP session status.
To view tunnel details, click the Name of a tunnel.
Under Logs, click View for Logging logs.
You can also modify the BGP session associated with this tunnel.

Get More Info ›

How do you know when VPN is connected? ›

When connected, the VPN connection name will display Connected underneath it. To see if you're connected to the VPN while you're doing things on your PC, select the Network icon (either or ) on the far right of the taskbar, then see if the VPN connection says Connected.

Keep Reading ›

Is Google VPN always on? ›

Tip: The VPN will remain paused until your device connects to a different network. (Example: If you pause the VPN on the mobile network when you're not at home, the VPN will reconnect to your home Wi-Fi when you return.)

Explore More ›

How do I check my current VPN? ›

There are several different ways to check that your VPN service is working properly and protecting your internet traffic and personal data. Check your IP address. Take note of your current IP address, connect to a VPN server, and recheck the IP address. If it differs from the one you initially noted, your VPN works.

Know More ›

How to check if a VPN is working by cmd? ›

how to check vpn in cmd

Open the Command Prompt: Press the Windows key + R to open the Run dialog box. ...
Check your IP address: Type “ipconfig” in the CMD and press Enter. ...
Ping the VPN server: Type “ping [VPN server IP address]” and press Enter. ...
Test DNS resolution: Type “nslookup example.com” in the CMD and press Enter.

Apr 16, 2024

Get More Info Here ›

How to check if a VPN is connected or not in Linux? ›

3. Checking VPN Connectivity

3.1. nmcli. nmcli is a command-line front-end to the Network Manager, which is the networking maestro of Linux. ...
3.2. route. route manages how network traffic travels between different networks or hosts. ...
3.3. Client-Specific Commands.

Mar 18, 2024

Discover More Details ›

How is my VPN being detected? ›

VPNs can be detected through simple mechanisms like comparing the actual browser timezone with the target server's exit node or by using databases that store information about whether a given IP address belongs to the VPN.

Show Me More ›

Is My VPN being tracked? ›

Can police track online purchases made with a VPN? There is no way to track live, encrypted VPN traffic. That's why police or government agencies who need information about websites you visited have to contact your internet service provider (ISP for short), and only then your VPN provider.

Is My VPN always on? ›

Yes, you should keep your VPN on whenever you're online. It keeps your sensitive information away from prying eyes and ensures a private, secure connection to the internet. On top of that, setting up and using a VPN is super simple, making it easy for you to protect yourself online.