Configuring IPSec VPN between OCI and GCP

Connecting workloads across Oracle Cloud Infrastructure (OCI) and Google Cloud Platform (GCP) often requires private, encrypted network connectivity. An IPSec site-to-site VPN provides an encrypted tunnel between the two cloud environments while allowing private subnets on each side to communicate.

1. Reference architecture

The design uses an OCI Virtual Cloud Network (VCN) on one side and a GCP Virtual Private Cloud (VPC) on the other. The VPN gateways establish IPSec tunnels across the public internet, while application traffic remains addressed using the private CIDRs of the connected networks.

• OCI VCN with a non-overlapping CIDR
• GCP VPC network with a non-overlapping CIDR
• OCI Dynamic Routing Gateway (DRG)
• OCI Site-to-Site VPN
• GCP Cloud VPN
• Routing on both sides for the remote CIDRs

2. Plan the CIDRs

Before configuring the VPN, make sure the OCI and GCP network ranges do not overlap. For example, OCI could use 10.10.0.0/16 and GCP could use 10.20.0.0/16. Use your actual environment CIDRs rather than these example ranges.

3. OCI configuration

In OCI, create or identify the VCN and DRG, attach the VCN to the DRG, and create a Site-to-Site VPN connection. Configure the customer-premises-side information to represent the GCP VPN endpoint and define the IPSec connection parameters.

OCI route tables associated with the workload subnets need routes for the GCP CIDR through the DRG. Security lists or network security groups must also permit the required application traffic.

4. GCP configuration

In GCP, configure the VPC network, Cloud VPN gateway and peer configuration. Define the OCI CIDR as the remote network and establish the corresponding VPN tunnel parameters.

GCP routes must direct traffic destined for the OCI CIDR through the VPN. Firewall rules must permit the required traffic between the relevant source and destination ranges.

5. IPSec parameters

The two VPN endpoints must agree on compatible IKE and IPSec parameters, authentication, encryption and integrity settings. Use the provider documentation and the selected tunnel configuration to ensure both sides use compatible values.

6. Routing is critical

A tunnel can show as established while application traffic still fails if routing is incomplete. Validate the OCI route table, DRG routing, GCP routes and firewall/security rules for both directions.

7. Validation checklist

1. Confirm both cloud CIDRs are non-overlapping.
2. Confirm the OCI VCN is attached to the DRG.
3. Confirm the OCI IPSec tunnels are configured and established.
4. Confirm GCP VPN tunnels and routes are configured.
5. Verify OCI routes to the GCP CIDR.
6. Verify GCP routes to the OCI CIDR.
7. Verify OCI security lists/NSGs.
8. Verify GCP firewall rules.
9. Test connectivity from a workload on each side.
10. Check tunnel and routing logs when connectivity fails.

8. Common troubleshooting areas

• Overlapping CIDRs: redesign the address plan before troubleshooting the tunnel.
• Incorrect routes: verify both forward and return paths.
• Firewall/security rules: allow the required protocols and ports.
• IPSec parameter mismatch: compare IKE and IPSec settings on both endpoints.
• MTU or fragmentation: investigate when small packets work but larger application traffic fails.

Conclusion

An OCI–GCP IPSec VPN is primarily a combination of four areas: gateway configuration, compatible IPSec parameters, correct routing and security policy. Build the connectivity in that order and validate each layer independently before moving to application testing.