Site to Site VPNs¶

Services¶

A VPN Service has a one-to-one mapping with a Router in eCloud VPC. This means if you want to have a VPN to two different eCloud VPC Routers, you will need to create a separate VPN Service for each of them.

To create, select “Create Service”, choose a name, select the relevant VPN and Router, then select “Create Service”.

Endpoints¶

A VPN Endpoint is where the IPsec VPN will terminate at the eCloud VPC side. A VPN Endpoint has a One-to-One mapping with a VPN Service, but you can have multiple Endpoints mapped to the same Service.

A VPN Endpoint is also where the FIP (external IP) is assigned.

To create, select “Create Endpoint”, choose a name and select the VPN Service you would like this Endpoint to be mapped to. You then have the option to choose either an existing Floating IP (external IP) or request a new one. Finally, select “Create Endpoint” to create the VPN Endpoint (this could take a few minutes to complete).

Sessions¶

A VPN Session has to map to a specific VPN Endpoint and the associated Service. This is the object which will contain all of the configuration required to set up the VPN tunnel on the eCloud VPC side.

To create, select “Create Session”, choose a name and then select the VPN Service and Endpoint you would like this Session to use.

The Profile Group defines what encryption settings are applied, such as the Ciphers. It is critical that the profile used in eCloud VPC matches the configuration of the remote device or the tunnel will not establish. We have a range of generic profiles which are detailed here.

The Local IP (external) will automatically be selected, as it is defined in the Endpoint you will have already created.

The “Remote IP” will be the external IP of the device you are setting up a VPN connection to. This will either be an external device or the external IP of a different eCloud VPC Endpoint.

The “Local Networks” are the local eCloud VPC internal IPs and/or Subnets, which you would like to be part of this VPN Tunnel. These can only include IPs or Subnets, which are defined on networks associated with the Router the Service is linked to. It is critical that these match the configuration on the remote device.

The “Remote Networks” are the internal IPs and/or Subnets from the remote site, which you would like to be part of this VPN Tunnel. It is critical that these match the configuration on the remote device.

A “Pre-Shared Key (PSK)” needs to be defined, which will need to match the PSK on the remote device.