To troubleshoot packet loss and verify if packets are being sent correctly from the VM to the on- premises destination, enabling VPC Flow Logs is the recommended approach.
VPC Flow Logs capture metadata about the traffic flow to and from the VM, including source and destination IPs, ports, protocols, and whether traffic was allowed or denied.
By setting the SAMPLE_RATE to 1.0, you capture all traffic flows for comprehensive analysis, minimizing the chance of missing any intermittent packet flow.
Logs Explorer allows you to query and analyze these logs to identify potential issues, such as dropped packets or routing problems.
This approach aligns with Google-recommended practices for network troubleshooting, providing detailed insights without requiring additional infrastructure like packet mirroring, which may introduce complexity and resource overhead.

The error received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built indicates a mismatch in Phase 2 settings during IPsec negotiation. This happens when the encryption or hashing algorithms, Diffie-Hellman groups, or other Phase 2 parameters configured on the on-premises firewall do not match those configured for the HA VPN on Google Cloud.
1. Phase 2 Settings (Child SA): These settings determine the parameters for securing the actual traffic. They must match on both sides of the VPN (on-premises and Google Cloud) for the connection to establish successfully.
2. Supported Cipher Suites: HA VPN has specific supported cipher suites for Phase 2, which must be adhered to when configuring the on-premises firewall.
3. Action: Review and update the Phase 2 settings on the on-premises firewall to ensure they match Google Cloud's HA VPN requirements.

Cloud CDN needs HTTP(S) Load Balancers and Cloud Storage bucket has to be shared publicly.
https://cloud.google.com/cdn/docs/setting-up-cdn-with-bucket