Cloud VPN Gateway
Does ZopNight manage Cloud VPN Gateway?
Cloud VPN bills each IPsec tunnel by the hour plus egress, and a tunnel to a decommissioned site meters on until someone deletes it. ZopNight discovers VPN gateways through Cloud Asset Inventory, attributes tunnel charges from billing actuals, and flags tunnels that carry zero traffic.
Rules that fire on Cloud VPN Gateway
No active rule family targets Cloud VPN Gateway today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.
A Cloud VPN gateway provides IPsec tunnels between your VPC and external networks, billed hourly per tunnel plus egress. Tunnels for decommissioned sites keep billing until deleted.
Every tunnel meters hourly, traffic or not
The unit of VPN cost is the tunnel, not the gateway. Each IPsec tunnel bills for every hour it exists, and traffic through it adds egress charges on top. Whether packets flow is irrelevant to the hourly component: a tunnel negotiated once and never used again costs the same as one carrying a site’s whole workload. HA VPN compounds this gently: its redundant interfaces mean a single logical connection is usually a pair of tunnels, both metering.
Dead tunnels found through billing actuals
ZopDev discovers VPN gateways via Cloud Asset Inventory, attributes per-tunnel charges from billing actuals, and flags tunnels with no traffic. That last signal is the one that matters: a zero-traffic tunnel that still appears on the bill is either a standby that should be documented or a leftover that should be deleted, and only a human can say which. Gateways have no pausable meter and no stop operation, so this type is discovery and detection only. The saving comes from deleting what the detection surfaces.
How VPN waste outlives the sites it served
The recurring shapes: tunnels to offices, partners, or data centers that were decommissioned, where the far end went dark but the GCP side was never cleaned up; migration-era tunnels kept “temporarily” after a workload moved fully into the cloud; and proof-of-concept connections from an integration that shipped years ago. Each is small individually, and that is exactly why they survive, since no single line item is alarming enough to trigger a cleanup.
Tracing tunnels through the console
Google Cloud console → Network Connectivity → VPN shows every gateway with its tunnels, each tunnel’s IKE status, and the peer it points at. Cross-checking that list against the sites a team actually still connects to is a five-minute audit that routinely finds hourly meters with no purpose.