Scaling HA VPN Beyond Single Gateway Limits

PCNE By islever Editorial Last updated

Configuring a site-to-site IPSec VPN.

Short answer

B Create two HA VPN gateways, each with two tunnels, and configure BGP with matching MED values to ensure load balancing and meet the 4 Gbps/300k PPS requirement.

Question

You are configuring HA VPN for your organization to connect your on-premises environment to your Google Cloud network. Your on-premises environment is closest to the us-west1 Google Cloud region. You have Google Cloud resources in us-west2, which requires a throughput of 300,000 packets per second (PPS) and an approximate bandwidth of 4 Gbps. You need to have predictable bandwidth management and maintain an SLA of 99.99% with minimal costs. What should you do?
  1. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 200. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
  2. Create two HA VPN gateways, each with two tunnels. Configure BGP on each of the gateways' tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the same corresponding multi-exit discriminator (MED) value. Correct Answer
  3. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
  4. Create an HA VPN gateway with four tunnels. Configure BGP on four tunnels with tunnel 0 configured with a base routing priority metric of 100, tunnel 1 with a base routing priority metric of 200, tunnel 2 with a base routing priority of 300, and tunnel 3 with a base routing priority of 400. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.

Key Takeaways

A single HA VPN gateway is capped at ~3 Gbps and 250k PPS; exceeding these metrics requires deploying multiple gateways with ECMP load balancing.

Learn how to scale HA VPN to meet high-throughput requirements like 4 Gbps and 300k PPS by using multiple gateways instead of a single constrained gateway.

Common mistake: Option C is a common trap because it correctly identifies the need for two tunnels but incorrectly assumes a single gateway can support 4 Gbps, ignoring the hard throughput cap.

Expert Analysis

Gateway Capacity Limits and SLA Requirements

The core constraint in this scenario is the hardware limit of a single HA VPN gateway. According to Google Cloud documentation, a single HA VPN gateway supports a maximum throughput of approximately 3 Gbps and 250,000 packets per second (PPS). The requirement specifies 4 Gbps bandwidth and 300,000 PPS. Even with optimal packet sizes, a single gateway cannot meet the 4 Gbps target because its hard ceiling is ~3 Gbps. Therefore, any solution relying on a single gateway (Options A, C, D) fails immediately.

Multi-Gateway Architecture for Scale

To achieve 4 Gbps and 300,000 PPS, you must deploy multiple HA VPN gateways. Option B suggests creating two HA VPN gateways. Since each gateway can handle up to ~3 Gbps/250k PPS, two gateways provide sufficient aggregate capacity to exceed the 4 Gbps/300k PPS requirement while maintaining redundancy.

BGP MED Configuration for Load Balancing

The question emphasizes "predictable bandwidth management" and "minimal costs." Using Equal Cost Multi-Path (ECMP) routing via BGP Multi-Exit Discriminator (MED) values allows traffic to be distributed across both gateways. By setting identical MED values (100) on both tunnels within each gateway configuration context relative to the peer, you enable load balancing. If different MEDs were used (as in Option A), traffic would prefer one path, potentially bottlenecking at the lower-capacity primary path or failing to utilize the second gateway effectively for throughput scaling. Option D proposes four tunnels on a single gateway, which exceeds the two-tunnel-per-gateway limit and still hits the single-gateway throughput cap.

Operational Consequence

Choosing a single gateway results in service degradation or failure to meet SLA due to throughput limits. Deploying two gateways ensures the SLA of 99.99% is met by providing redundancy and sufficient aggregate bandwidth. This approach balances performance needs with cost efficiency by avoiding over-provisioned dedicated interconnects where possible.

Official Reference

https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies-increase-bandwidth

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check the specific throughput and PPS limits of Google Cloud networking resources before selecting options that seem logically sound but violate capacity constraints. For HA VPN, remember the ~3 Gbps/250k PPS per gateway limit. If requirements exceed this, look for solutions involving multiple gateways rather than more tunnels on a single gateway.

Frequently Asked Questions

What is the maximum throughput of a single HA VPN gateway?

A single HA VPN gateway supports approximately 3 Gbps of bandwidth and 250,000 packets per second (PPS).

How do I load balance across multiple HA VPN gateways?

You can use BGP Multi-Exit Discriminator (MED) values set to the same priority on tunnels from different gateways to enable equal-cost multi-path (ECMP) routing.

More PCNE FAQ →

Community Votes

B
57%
C
43%

57% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. n2183712847 👍 3 Answered C
    C. Create an HA VPN gateway with two tunnels. Configure BGP on both tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the corresponding multi-exit discriminator (MED) value.
  2. certguy99 👍 3 Answered C
    https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#ensuring-ha-peer Each tunnel gives a max of 3 Gbps / 250k pps for 4 Gbps / 300k pps, need 2 tunnels
  3. n2183712847 👍 2 Answered B
    B. Create two HA VPN gateways, each with two tunnels. Configure BGP on each of the gateways' tunnels with tunnel 0 configured with a base routing priority metric of 100 and tunnel 1 with a base routing priority metric of 100. Configure the on-premises router with the same corresponding multi-exit discriminator (MED) value.
  4. glb2 👍 2 Answered C
    HA VPN provides 99.99% SLA when both VPN tunnels are up and properly configured. Each HA VPN gateway provides two tunnels, and each tunnel supports up to 250,000 PPS and 3 Gbps.
  5. Positron75 👍 1
    My problem with C is that the bandwidth of each tunnel can be as low as 1 Gbps depending on packet size. If we assume a worst case scenario, that would only give us 2 Gbps of bandwidth for the gateway. https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/topologies-increase-bandwidth With option B, we have 4 tunnels so even in the worst case scenario we would still have the required 4 Gbps. I would pick B based on this, although if we focus on minimal costs it would be C. Poor question as usual.
Show 3 more comments
  1. 0d2fdfa 👍 1 Answered B
    Correct answer is B Option A & C: These use only one HA VPN gateway. A single gateway is capped at roughly 3 Gbps. Even with both tunnels active, you cannot reliably guarantee 4 Gbps and 300,000 PPS due to the gateway-level processing limits. D makes no sense.
  2. ulkerra 👍 1 Answered B
    1 HA GW has 3G capacity. Two gateways and two tunnels are needed.
  3. Alex3551 👍 1 Answered B
    I choose B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Configuring Policy-Based VPN for Non-BGP On-Premises Networks

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

Hub-and-Spoke Centralized Egress with VPC Peering

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide