Dynamic routing or Border Gateway Protocol (BGP) for Classic VPN tunnels is deprecated on August 1, 2025. If your workloads require BGP for VPN connectivity, you must use HA VPN.
For information about HA VPN, see the Cloud VPN overview.
The rest of this page helps you with planning and implementing your migration.
Deprecated configurations
You cannot create new Classic VPN tunnels that use dynamic routing (BGP) that is managed by a Cloud Router.
As of August 1, 2025, the creation of Classic VPN tunnels using dynamic routing (BGP) is no longer supported, regardless of the gateway the tunnel connects to. This includes connections to VPN gateway software running inside a Compute Engine virtual machine (VM) instance or connections outside of Google Cloud.
Existing Classic VPN tunnels that use dynamic routing (BGP) are not supported. While tunnels that are in use will continue to function, but without an availability SLA.
What happens to deprecated configurations?
If you delete a Classic VPN tunnel that was configured with BGP, you won't be able to recreate it with BGP support. While existing, unmodified Classic VPN tunnels may continue to pass traffic (without SLA). You must use HA VPN for any changes requiring recreation or modification of BGP settings configurations.
Supported configurations
You can continue to create and receive support only for the following Classic VPN configurations:
- Classic VPN tunnels using static routing from Classic VPN gateways to on-premises VPN gateways and from on-premises VPN gateways to Classic VPN gateways.
- Classic VPN tunnels using static routing from a Classic VPN gateway to and from a Compute Engine VM that is acting as a VPN gateway.
Recommendations
For all production traffic requiring dynamic routing (BGP), use HA VPN.
We recommend that you only retain Classic VPN if your on-premises VPN devices don't support BGP, and therefore HA VPN cannot be used. However, we strongly recommend upgrading those devices to support BGP, as HA VPN provides a more flexible, reliable, and highly available solution compared to static routing, and is the only path for BGP functionality within Cloud VPN.
For more information, see HA VPN topologies.
Billing changes
After instantiating and using the additional, redundant tunnel for HA VPN, you will see billing changes as described on the Cloud VPN pricing page.
To achieve high availability, HA VPN requires you to create VPN tunnels in pairs. Both tunnels are billed at the same hourly rate. If you use one tunnel solely for failover, outbound data transfer charges apply only to the active tunnel.
As of August 1, 2025, any traffic that has not been migrated to HA VPN and continues to flow through established Classic VPN gateways and tunnels will be charged at the standard Classic VPN rates.
Move to HA VPN
To move to HA VPN, you might need to make some routing or infrastructure changes to support HA VPN. Your network administrators or site reliability engineers (SREs) need to schedule a maintenance window to perform the migration.
To plan and prepare, watch the following video, Upgrade to Google's HA VPN, for guidance on key use cases.
When your organization is ready to switch your production workflows from Classic VPN to HA VPN, use the checklists and instructions provided in Move to HA VPN.
Where to get help
If you have any questions or require assistance, contact Google Cloud Support.