Configure VPN on an Edge Gateway

The VPN server feature is built into Edge Routers. The following VPN types are available:

IPSec (Site-to-site VPN) is used to create a secure tunnel between sites. For example, between the head office network and a network at a remote site or in the cloud;
SSL VPN (Remote Access VPN) is used to connect individual users to organization private networks using a VPN client;
L2 VPN allows you to combine networks located at different sites (in different Cloud Director infrastructures) into a single broadcast domain, for example, during virtual machine migration.

Connect IPsec

From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
Open the virtual data center page.
Go to Networking → Edges.
Open the page of the required Edge.
Click Services.
Open the VPN → IPsec VPN → IPsec VPN Sites tab.
Click +.
Optional: to activate the remote site, turn on the Enabled toggle.
Optional: to ensure that each new cryptographic key is not related to any previous key, turn on the PFS toggle.
In the Local Endpoint field, enter the external address of the NSX Edge.
In the Local Subnets field, enter the local subnets in CIDR format that will use IPsec VPN.
In the Peer ID field, enter the address of the remote site.
In the Peer Endpoint field, enter the address of the remote site.
In the Peer Subnets field, enter the subnets that will use IPsec VPN on the remote side.
In the Encryption Algorithm field, select the tunnel encryption algorithm.
In the Authentication field, select how the peer will be authenticated: using a Pre-Shared Key or a certificate.
In the Pre-Shared Key field, enter the key that will be used for authentication. The key must match on both sides.
In the Diffie-Hellman Group field, select the key group number in the key exchange algorithm.
In the Digest algorithm field, select the hashing algorithm for packet integrity check.
In the IKE option field, select the IKE (Internet Key Exchange) protocol version.
To ensure that Edge waits for a connection from the remote side rather than initiating a connection upon startup, turn on the IKE responder only toggle.
In the Session type field, select the tunnel type. For more information about tunnels, see the Policy-Based IPSec VPN or Route-Based IPSec VPN VMware documentation.
Click Keep.
Open the VPN → IPsec VPN → Activation Status tab.
Turn on the IPsec VPN Service Status toggle.
Open the Statistics → IPsec VPN tab.
Check that the VPN status is active in the Channel Status column.

View tunnel status

The number of IPsec tunnels depends on the size of the deployed Edge gateway. By default, 512 IPsec tunnels are available.

From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
Open the virtual data center page.
Go to Networking → Edges.
Open the page of the required Edge.
Click Services.
Open the Edge settings tab.
In the SSH Status block, turn on the Enabled toggle.
Enter the login and password for SSH access and allow it in the Firewall settings. We do not recommend leaving SSH enabled.
In the Edge console, check the service status:
```
show service ipsec
```
Check the site status and negotiated parameters:
```
show service ipsec site
```
Check the Security Association (SA) status:
```
show service ipsec sa
```

Connect SSL VPN

SSL VPN-Plus is a Remote Access VPN option. It allows individual remote users to securely connect to private networks located behind an NSX Edge gateway. In the case of SSL VPN-Plus, an encrypted tunnel is established between the client (Windows, Linux, Mac) and the VMware NSX® Edge™.

From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
Open the virtual data center page.
Go to Networking → Edges.
Open the page of the required Edge.
Click Services.
Open the SSL VPN-Plus → Authentication tab.
Click +Local.
Configure and enable the authentication server. During configuration, you can choose policies for generating new passwords and configure options for locking user accounts (for example, the number of retry attempts when an incorrect password is entered); for more information, see the VMware documentation Configure an Authentication Service for SSL VPN-Plus on an NSX Data Center for vSphere Edge Gateway.
Click Keep.
Open the SSL VPN-Plus → Server Settings tab.
In the IP Address and Port fields, specify the IP address and port on which the server will listen for incoming connections.
Turn on the Enable Logging toggle.
In the Cipher List block, select the required encryption algorithms.
Optional: to change the certificate that the server will use, click CHANGE SERVER CERTIFICATE.
Turn on the Enable toggle.
Click Save changes.
Open the SSL VPN-Plus → Users tab.
Click +.
In the User ID field, enter the user ID.
In the Password field, enter the user password.
To enable the user, turn on the Enabled toggle.
Click Keep.
Open the SSL VPN-Plus → Installation Packages tab.
To create an installer that a remote employee can download for installation, click +.
In the Profile Name field, enter the installation package profile name.
In the Gateway field, enter the server address; you can view it on the SSL VPN-Plus → Server Settings → IP Address tab.
In the Port field, enter the server port; you can view it on the SSL VPN-Plus → Server Settings → Port tab.
Select installation packages for different operating systems. The Windows package is created by default and is always available.
Optional: to add the VPN client to startup on the remote machine, select the start client on logon checkbox (Windows only).
Optional: to create a VPN client desktop icon, select the create desktop icon checkbox (Windows only).
Optional: to validate the server certificate upon connection, select the server security certificate validation checkbox (Windows only).
Open the SSL VPN-Plus → IP Pools tab.
Click +.
In the IP Range field, specify the range of addresses that will be assigned to users upon connection.
In the Netmask field, specify the network mask.
In the Gateway field, specify the network gateway.
Optional: configure DNS and WINS servers.
Open the Private Networks tab.
Click +.
In the Network field, add the local network that remote users will have access to.
In the Send traffic field, select the traffic sending method:
- over tunnel — through the tunnel;
- bypass tunnel — directly, bypassing the tunnel.
If you selected the traffic sending method over tunnel, select the Enable TCP Optimization checkbox.

Connect to the created installation package

Open a web browser using the external address and port you defined in the Firewall settings.
Enter your user credentials. After successful authorization, a list of created installation packages available for download will open.
Download the created installation package.
Unpack the downloaded archive.
Install the client.
Run the client.
In the login window, click Login.
In the certificate verification window, click Yes.
Enter your user credentials.

Connect NSX L2 VPN

When moving to a different geographical site, the virtual machine will retain its IP addressing settings and will not lose connectivity with other virtual machines in the same L2 domain. You can use this feature if you have two virtual machines located in different virtual data centers or regions.

The first VM has the address 10.10.10.2/24, the second VM — 10.10.10.200/24.

Sites being combined into a single broadcast domain must be built on the NSX platform. Using standalone NSX Edge is possible; for more information, see the VMware Customer Connect documentation (website registration is required for viewing).

From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
Open the virtual data center page.
Go to Networking → Networks.
Click New.
Create a network with the following parameters:
- Scope — select Current Organization Virtual Data Center;
- Network Type — select Routed;
- Interface Type — select subinterface;
- Gateway CIDR — specify 10.10.10.1/24.
Open the Data Centers → Virtual Data Center tab.
Open the page of the second virtual data center.
Add a network with the same parameters.

Configure the NSX L2 VPN server

From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
Open the virtual data center page.
Go to Networking → Edges.
Open the page of the required Edge.
Click Services.
Open the VPN → L2VPN tab.
Turn on the L2VPN toggle.
In the L2VPN mode field, select Server.
On the Server Global tab, enter the external IP address of the Edge router on which the port for the tunnel will listen. By default, the socket will open on port 443, but it can be changed.
Specify the encryption settings for the tunnel.
Open the Server Sites tab.
Click +.
Turn on the Enabled toggle.
Enter the peer name.
Enter the user name and password.
In the Egress Optimization Gateway Address field, enter the gateway address to prevent an IP address conflict, as the gateway for the created networks has the same address.
Click Select sub-interfaces.
Select the required subinterface.
Save the settings. The created client site will appear in the settings.

Configure the NSX L2 VPN client

From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
Open the virtual data center page.
Go to Networking → Edges.
Open the page of the required Edge.
Click Services.
Open the VPN → L2VPN tab.
Turn on the L2VPN toggle.
In the L2VPN mode field, select Client.
On the Client Global tab, specify the NSX Edge IP address and port of the first virtual data center that were specified in the Listening IP and Port fields on the server side.
Configure encryption the same way as on the server so that settings match when the tunnel is established.
Click SELECT SUB-INTERFACES.
Select the subinterface through which the tunnel for L2VPN will be established.
In the Egress Optimization Gateway Address field, enter the gateway address.
In the User Id field, enter the username.
In the Password field, enter the password.
In the Confirm Password field, confirm the password.
Save the settings.
On any Edge router, on the Statistics → L2VPN tab, check the tunnel.