---
title: "Configure VPN on an Edge Gateway"
sidebar_label: "Configure VPN"
sidebar_position: 6
description: "How to configure VPN via IPSec, SSL VPN, or L2 VPN protocols"
---

import Formbricks from '@theme/MDXComponents/Formbricks'

# Configure VPN on an Edge Gateway

The VPN server function is built into [Edge Gateways](/public-cloud/manage-networks/edge-routers.mdx). The following VPN types are available:

* [IPSec](#connect-ipsec) (Site-to-site VPN) — used to create a secure tunnel between sites. For example, between a head office network and a network at a remote site or in the cloud;
* [SSL VPN](#connect-ssl-vpn) (Remote Access VPN) — used to connect individual users to private corporate networks using a VPN client;
* [L2 VPN](#connect-nsx-l2-vpn) — allows you to combine networks located at different sites (in different Cloud Director infrastructures) into a single broadcast domain, for example, during virtual machine migration.

## Connect IPsec \{#connect-ipsec}

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based cloud** → the \*\*Cloud Director \*\***. section**.
2. Open the virtual data center page.
3. Go to **Networking** → **Edges**.
4. Open the page of the required Edge.
5. Click **Services**.
6. Open the **VPN** → **IPsec VPN** → **IPsec VPN Sites**.
7. Click **+**.
8. Optional: to activate the remote site, enable the **Enabled** toggle switch.
9. Optional: to ensure each new cryptographic key is not linked to any previous key, enable the **PFS** toggle switch.
10. In the **Local Endpoint** field, enter the external address of the NSX Edge.
11. In the **Local Subnets** field, enter the local networks in CIDR format that will use IPsec VPN.
12. In the **Peer ID** field, enter the address of the remote site.
13. In the **Peer Endpoint** field, enter the address of the remote site.
14. In the **Peer Subnets** field, enter the networks that will use IPsec VPN on the remote side.
15. In the **Encryption Algorithm** field, select the tunnel encryption algorithm.
16. In the **Authentication** field, select how the peer will be authenticated — using a Pre-Shared Key or a certificate.
17. In the **Pre-Shared Key** field, enter the key that will be used for authentication. The key must match on both sides.
18. In the **Diffie-Hellman Group** field, select the key group number in the key exchange algorithm.
19. In the **Digest algorithm** field, select the packet integrity hashing algorithm.
20. In the **IKE option** field, select the IKE (Internet Key Exchange) protocol version.
21. To ensure the Edge does not initiate a connection upon startup but waits for a connection from the remote side, enable the **IKE responder only** toggle switch.
22. In the **Session type** field, select the tunnel type. For more information about tunnels, see the [Policy-Based IPSec VPN](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-604164F4-F855-4B39-B39F-66D2F26CC2C2.html) or [Route-Based IPSec VPN](https://docs.vmware.com/en/VMware-NSX-Data-Center-for-vSphere/6.4/com.vmware.nsx.admin.doc/GUID-FD74058A-B473-4B79-9F50-357DED11649A.html) instructions in the VMware documentation.
23. Click **Keep**.
24. Open the **VPN** → **IPsec VPN** → **Activation Status**.
25. Enable the **IPsec VPN Service Status** toggle switch.
26. Open the **Statistics** → **IPsec VPN**.
27. Check that the VPN status is active in the **Channel Status** column.

### View tunnel status \{#view-tunnel-status}

The number of IPsec tunnels depends on the size of the deployed Edge gateway. By default, 512 IPsec tunnels are available.

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based cloud** → the \*\*Cloud Director \*\***. section**.
2. Open the virtual data center page.
3. Go to **Networking** → **Edges**.
4. Open the page of the required Edge.
5. Click **Services**.
6. Open the **Edge settings** tab.
7. In the **SSH Status** block, enable the **Enabled** toggle switch.
8. Enter the login and password for SSH access and allow it in the Firewall settings. We do not recommend leaving SSH enabled.
9. In the Edge console, check the service status:

   ```bash
   show service ipsec
   ```
10. Check the site status and negotiated parameters:

    ```bash
    show service ipsec site
    ```
11. Check the Security Association (SA) status:

    ```bash
    show service ipsec sa
    ```

## Connect SSL VPN \{#connect-ssl-vpn}

SSL VPN-Plus is a Remote Access VPN option. It allows individual remote users to securely connect to private networks located behind an NSX Edge gateway. In the case of SSL VPN-Plus, an encrypted tunnel is established between the client (Windows, Linux, Mac) and the VMware NSX® Edge™.

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based cloud** → the \*\*Cloud Director \*\***. section**.
2. Open the virtual data center page.
3. Go to **Networking** → **Edges**.
4. Open the page of the required Edge.
5. Click **Services**.
6. Open the **SSL VPN-Plus** → **Authentication**.
7. Click **+Local**.
8. Configure and enable the authentication server. During configuration, you can select policies for generating new passwords and set up options for locking user accounts (for example, the number of failed password attempts); see the [Configure an Authentication Service for SSL VPN-Plus on an NSX Data Center for vSphere Edge Gateway](https://docs.vmware.com/en/VMware-Cloud-Director/10.4/VMware-Cloud-Director-Service-Provider-Admin-Portal-Guide/GUID-05CC2A25-F80F-4DF5-B1D5-81950B673938.html) instructions in the VMware documentation.
9. Click **Keep**.
10. Open the **SSL VPN-Plus** → **Server Settings**.
11. In the **IP Address** and **Port** fields, specify the address and port on which the server will listen for incoming connections.
12. Enable the **Enable Logging** toggle switch.
13. In the **Cipher List** block, select the required encryption algorithms.
14. Optional: to change the certificate the server will use, click **CHANGE SERVER CERTIFICATE**.
15. Enable the **Enable** toggle switch.
16. Click **Save changes**.
17. Open the **SSL VPN-Plus** → **Users**.
18. Click **+**.
19. In the **User ID** field, enter the user identifier.
20. In the **Password** field, enter the user password.
21. To enable the user, turn on the **Enabled** toggle switch.
22. Click **Keep**.
23. Open the **SSL VPN-Plus** → **Installation Packages**.
24. To create an installer that a remote employee can download for installation, click **+**.
25. In the **Profile Name** field, enter a name for the installation package profile.
26. In the **Gateway** field, enter the server address; you can view it on the **SSL VPN-Plus** → **Server Settings** → **IP Address**.
27. In the **Port** field, enter the server port; you can view it on the **SSL VPN-Plus** → **Server Settings** → **Port**.
28. Select installation packages for different operating systems. The Windows package is created by default and is always available.
29. Optional: to have the VPN client added to startup on the remote machine, check the **start client on logon** checkbox (Windows only).
30. Optional: to create a VPN client icon on the desktop, check the **create desktop icon** checkbox (Windows only).
31. Optional: to validate the server certificate during connection, check the **server security certificate validation** checkbox (Windows only).
32. Open the **SSL VPN-Plus** → **IP Pools**.
33. Click **+**.
34. In the **IP Range** field, specify the range of addresses to be assigned to users when they connect.
35. In the **Netmask** field, specify the network mask.
36. In the **Gateway** field, specify the network gateway.
37. Optional: configure DNS and WINS servers.
38. Open the **Private Networks** tab.
39. Click **+**.
40. In the **Network** field, add the local network that remote users will be able to access.
41. In the **Send traffic** field, select the traffic forwarding method:

    * **over tunnel** — through the tunnel;
    * **bypass tunnel** — directly, bypassing the tunnel.
42. If you selected **over tunnel** as the traffic forwarding method, check the **Enable TCP Optimization** checkbox.

### Connect to the created installation package \{#connect-created-installation-package}

1. Open a web browser using the external address and port you defined in the Firewall settings.
2. Enter your user credentials. After successful authorization, a list of created installation packages available for download will open.
3. Download the [created installation package](#connect-ssl-vpn).
4. Unpack the downloaded archive.
5. Install the client.
6. Run the client.
7. In the authorization window, click **Login**.
8. In the certificate verification window, click **Yes**.
9. Enter your user credentials.

## Connect NSX L2 VPN \{#connect-nsx-l2-vpn}

When moving to a different geographical site, the virtual machine will retain its IP addressing settings and will not lose connectivity with other virtual machines in the same L2 domain. You can use this feature if you have two virtual machines located in different virtual data centers or regions.

The first VM has the address `10.10.10.2/24`, and the second VM has `10.10.10.200/24`.

Sites combined into a single broadcast domain must be built on the NSX platform. Using a standalone NSX Edge is possible; see the [VMware Customer Connect documentation](https://customerconnect.vmware.com/login?bmctx=296D2E0AAD70CA31C97E695D763C13F7622392514A6552A849FE0184F298DF1D\&password=secure_string\&contextType=external\&action=%2F\&OverrideRetryLimit=1\&creds=username%20password\&username=string\&challenge_url=https:%2F%2Fcustomerconnect.vmware.com%2Flogin\&request_id=-2159477946587673279\&authn_try_count=0\&locale=en_US\&resource_url=%252Fuser%252Floginsso) (registration on the site is required to view).

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based cloud** → the \*\*Cloud Director \*\***. section**.
2. Open the virtual data center page.
3. Go to **Networking** → **Networks**.
4. Click **New**.
5. [Create a network](/public-cloud/manage-networks/create-network/) with the following parameters:

   * **Scope** — select **Current Organization Virtual Data Center**;
   * **Network Type** — select **Routed**;
   * **Interface Type** — select **subinterface**;
   * **Gateway CIDR** — specify `10.10.10.1/24`.
6. Open the **Data Centers** → **Virtual Data Center**.
7. Open the page of the second virtual data center.
8. Add a network with the same parameters.

### Configure the NSX L2 VPN server \{#configure-nsx-l2-vpn-server}

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based cloud** → the \*\*Cloud Director \*\***. section**.
2. Open the virtual data center page.
3. Go to **Networking** → **Edges**.
4. Open the page of the required Edge.
5. Click **Services**.
6. Open the **VPN** → **L2VPN**.
7. Enable the **L2VPN** toggle switch.
8. In the **L2VPN mode** field, select **Server**.
9. On the **Server Global** tab, enter the external IP address of the Edge gateway on which the tunnel port will be listened to. By default, the socket will open on port 443, but you can change it.
10. Specify the encryption settings for the tunnel.
11. Open the **Server Sites** tab.
12. Click **+**.
13. Enable the **Enabled** toggle switch.
14. Enter the peer name.
15. Enter the user name and password.
16. In the **Egress Optimization Gateway Address** field, enter the gateway address to avoid IP address conflicts, as the created networks use the same gateway address.
17. Click **Select sub-interfaces**.
18. Select the required subinterface.
19. Save the settings. The created client site will appear in the settings.

### Configure the NSX L2 VPN client \{#configure-nsx-l2-vpn-client}

1. From the [control panel](https://my.selectel.ru/vmware/), open the Cloud Director panel: in the top menu, click **Products** → **VMware-based cloud** → the \*\*Cloud Director \*\***. section**.
2. Open the virtual data center page.
3. Go to **Networking** → **Edges**.
4. Open the page of the required Edge.
5. Click **Services**.
6. Open the **VPN** → **L2VPN**.
7. Enable the **L2VPN** toggle switch.
8. In the **L2VPN mode** field, select **Client**.
9. On the **Client Global** tab, specify the address and port of the NSX Edge of the first virtual data center, which was specified in the **Listening IP** and **Port** fields on the server side.
10. Configure encryption the same way as on the server so that settings match when the tunnel is established.
11. Click **SELECT SUB-INTERFACES**.
12. Select the subinterface through which the tunnel for L2VPN will be established.
13. In the **Egress Optimization Gateway Address** field, enter the gateway address.
14. In the **User Id** field, enter the user name.
15. In the **Password** field, enter the password.
16. In the **Confirm Password** field, confirm the password.
17. Save the settings.
18. On any Edge gateway, on the **Statistics** → **L2VPN** tab, check the tunnel.

<Formbricks />