Manage VPNs

This page describes how to use the VPN feature that enables you to create site-to-site VPNs between virtual datacenters and other virtual datacenters, or other entities. 

For details of the VPN feature and how to configure it for specific providers, see:

This feature is available in:

  • Datacenters using VMware with NSX-V (and the NSX-NAT or NSX-gateway plugin)

  • Datacenters using VMware with NSX-T (requires NAT IPs as endpoints).

  • AWS

  • Azure

 

To manage VPNs:

  1. Go to MyCloud view → Virtual datacenters

  2. Select a virtual datacenter

  3. Go to Network → VPN

VPNs in virtual datacenter view
VPNs in virtual datacenter view

Support for VPNs is per VDC, which means you need to create a separate VPN site for each connected virtual datacenter. Both sites of a VPN must have the same encryption and authentication settings, and inverse local and remote network configurations.

The following table describes VPN functionality in the providers. You can further configure the NSX-T options using Abiquo configuration properties.

 

AWS

VMware NSX-V

VMware NSX-T

Azure

 

AWS

VMware NSX-V

VMware NSX-T

Azure

Encryption

AES

AES,
AES256,
Triple DES,
AES-GCM

AES_128,
AES_256,
AES_GCM_128,
AES_GCM_192,
AES_GCM_256,
NO_ENCRYPTION_AUTH_AES_GMAC_128,
NO_ENCRYPTION_AUTH_AES_GMAC_192,
NO_ENCRYPTION_AUTH_AES_GMAC_256,
NO_ENCRYPTION

AES128_SHA1, AES128_SHA256, AES256_SHA1,
AES256_SHA256, _3DES_SHA1, _3DES_SHA256

Perfect forward secrecy enabled

always enabled

optional

optional

always disabled

DH group

DH2

DH2, DH5, DH14

DH2,DH5,DH14,DH15,DH16,DH19,DH20,DH21

DH2, DH14

Authentication

PSK (mandatory)

PSK (mandatory)

PSK (mandatory)

PSK (mandatory)

 

 

Create a VPN

To connect private cloud with public cloud, define the VPN site in private cloud first. 

  • In Azure you can create a VPN using a placeholder address for the local gateway (site 1) and edit it after you create the Azure VPN site

  • In NSX-T you can delete and re-create a site instead of editing it

  • Azure may automatically select a compatible encryption type

  • In AWS you must supply the IP address of site 1 and you cannot edit it, so you must create site 1 first and the VPN site in AWS will always be site 2

To create a VPN site in a virtual datacenter:

  1. We recommend that you check that the private networks for your VPN sites (local and remote) have different IP address ranges. If necessary create a new private network, and you may also decide to make it the default network for the virtual datacenter. See Manage networks

  2. In NSX-T, for the VPN endpoint, obtain a NAT IP for the virtual datacenter.
    You don’t need to create any NAT rules to create a VPN. Tip: check if your provider allows SNAT and DNAT traffic to VMs in the VDC from the internet or from IP/network addresses or NSX-T groups.
    For more details see Manage NAT for virtual datacenters

  3. Create a firewall to allow traffic to the VMs in your VPN. See Manage firewalls

  4. Obtain the values of the remote endpoint and network. They don’t need to exist when you create the VPN, but if you need to change them, you will need to delete the site and recreate it.

  5. Go to myCloud view → Virtual datacenters and select a virtual datacenter

  6. Go to Networks → VPN

  7. To create the VPN site, click the + add button and enter the VPN details. For full details see the Create VPN reference table below

  8. Go to your other VDC or provider and create the remote VPN site.

Create VPN (part 1)

To create the VPN site for site2 in another VDC:

  1. Select the virtual datacenter

  2. Add another VPN site using the same encryption and authentication settings, and the remote network configuration of the first VPN site as the local values. 

 

To check the status of your VPN in a virtual datacenter:

  1. Go to myCloud → Virtual datacenters → select the virtual datacenter

  2. Go to Networks → VPN

  3. Beside the VPN details, click Check

 

Create VPN reference table

This table describes all of the fields for creating a VPN.

Button

Action

Button

Action

Name

Name of the VPN

Encryption algorithm

Select the encryption algorithm

Perfect forward secrecy enabled

Select to enable perfect forward secrecy to protect your session keys

DH group

Diffie-Hellman group for the VPN

Authentication

Select for PSK authentication (Preshared key authentication), which is mandatory in the providers

Preshared key

Enter preshared key to use for this session.
Click the link beside the text entry box to show or hide the value of the key.
For AWS the PSK must be alphanumeric or "." or"_", between 8 and 64 characters, and cannot start with 0.

Local endpoint

NAT IP in the VDC or an automatically generated address in public cloud

Local networks

Select VDC networks. We recommend that you do not use the default private network addresses for both sides of a VPN

Remote endpoint

NAT IP in the remote VDC

Remote networks

Add network addresses using CIDR notation. Click x beside a network to remove it from the VPN configuration

Copyright © 2006-2024, Abiquo Holdings SL. All rights reserved