GCP Connection Guide

The following are the detailed steps on how to implement the remote management and application connections to your cloud HSMs under subscription via Google Cloud Platform.

You must first select the appropriate combination of Region with Provider from the following table:

Setup Interconnect with GCP

1. Search marketplace for “Interconnect” and select Get Started.

   

2. Select Partner Interconnect Connection, and then click Continue.

   

3. Click I ALREADY HAVE A SERVICE PROVIDER.

   

   a. Select an appropriate option for VLAN attachment (The example shown below uses single VLAN.).
   b. Select the Network as Default.
   c. Select the appropriate region e.g., us-east4 (Northern Virginia) for US East.

   

4. To setup VLAN, select Create new router in the Cloud Router field.

   

   The next step is to create a cloud router.

5. Enter a name in the Name field for the cloud router as per your preference.

   

6. Provide a suitable description in the Description section.

7. Enter BGP peer keepalive interval.

8. Select Advertise all subnets to the Cloud Router and then select Create.

   The next step is to configure the VLAN Cloud Router created in the previous steps.

9. Enter a VLAN attachment name.

   • Provide a suitable Description (optional)
   • MTU: 1440

   

10. Click Create.

    The interconnect attachment creation starts at this point.

11. Copy Pairing key and select OK.

    

12. Provide the Pairing key to Thales in the On-boarding form.

    

    In the image above, interconnect completes with Status as “Waiting for service provider”.
    Thales initiates interconnect setup between Google Cloud and HSM.
    Once you receive confirmation from Thales, it is now time for you to activate the interconnect.

13. Click Accept.

    

    After interconnect activation, status changes to “BGP Configuration needed”.

14. Select CONFIGURE BGP.

    

15. Complete as follows:

    • Peer ASN:

    Region	Data Center	Peer ASN
    US East	US DC13	65013
    US East	US CU02	65014
    EU West	NL AM02	65021
    EU West	DE FR04	65022

    • BGP peer: Enabled

    

16. Click SAVE AND CONTINUE.

    The connection status appears Down at this point.

    

17. Provide the following information to Thales:

    a. VLAN ID
    b. Cloud Router IP
    c. On Premises Router IP

    Wait for the BGP connection status to be “UP”.

18. Create a Virtual Machine and add it to the same VPC network.

    Use the virtual machine to connect to the payShield HSM to commission it using payShield Manager.