Skip to main content
resource · gcp

Cloud VPN Gateway

schedulable
no
category
networking-services

Does ZopNight manage Cloud VPN Gateway?

Cloud VPN bills each IPsec tunnel by the hour plus egress, and a tunnel to a decommissioned site meters on until someone deletes it. ZopNight discovers VPN gateways through Cloud Asset Inventory, attributes tunnel charges from billing actuals, and flags tunnels that carry zero traffic.

Rules that fire on Cloud VPN Gateway

no live rules

No active rule family targets Cloud VPN Gateway today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.

Browse every live recommendation for this platform →

A Cloud VPN gateway provides IPsec tunnels between your VPC and external networks, billed hourly per tunnel plus egress. Tunnels for decommissioned sites keep billing until deleted.

Every tunnel meters hourly, traffic or not

The unit of VPN cost is the tunnel, not the gateway. Each IPsec tunnel bills for every hour it exists, and traffic through it adds egress charges on top. Whether packets flow is irrelevant to the hourly component: a tunnel negotiated once and never used again costs the same as one carrying a site’s whole workload. HA VPN compounds this gently: its redundant interfaces mean a single logical connection is usually a pair of tunnels, both metering.

Dead tunnels found through billing actuals

ZopDev discovers VPN gateways via Cloud Asset Inventory, attributes per-tunnel charges from billing actuals, and flags tunnels with no traffic. That last signal is the one that matters: a zero-traffic tunnel that still appears on the bill is either a standby that should be documented or a leftover that should be deleted, and only a human can say which. Gateways have no pausable meter and no stop operation, so this type is discovery and detection only. The saving comes from deleting what the detection surfaces.

How VPN waste outlives the sites it served

The recurring shapes: tunnels to offices, partners, or data centers that were decommissioned, where the far end went dark but the GCP side was never cleaned up; migration-era tunnels kept “temporarily” after a workload moved fully into the cloud; and proof-of-concept connections from an integration that shipped years ago. Each is small individually, and that is exactly why they survive, since no single line item is alarming enough to trigger a cleanup.

Tracing tunnels through the console

Google Cloud console → Network Connectivity → VPN shows every gateway with its tunnels, each tunnel’s IKE status, and the peer it points at. Cross-checking that list against the sites a team actually still connects to is a five-minute audit that routinely finds hourly meters with no purpose.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·