Menu

Lumen help

Configuring a site-to-site VPN for IPsec VPN sites

This KB article steps through the process to stand up a site-to-site VPN between Lumen Private Cloud on VMware Cloud Foundation™ (LPC on VCF) and Lumen Cloud (CLC).
 

  • LPC on VCF account.
  • CLC account.
  • Local endpoint (public IP for IPsec VPN on the LPC on VCF side).
  • Local subnets in CIDR format (local networks to be accessible to IPsec VPN on the LPC on VCF side).
  • Peer endpoint (public IP for IPsec VPN on the CLC side).
  • Peer subnets in CIDR format (local networks to be accessible to IPsec VPN on the CLC side).
  • Firewall ports IP protocol ID 50 (ESP), UDP port 500 (IKE), and UDP port 4500 are configured on both ends.

To configure a site-to-site VPN for IPsec VPN sites:

  1. On the top menu, click Data Centers.

    The Lumen Private Cloud on VMware Cloud Foundation portal shows Virtual Data Center dashboard.
Virtual Data Center
  1. Click inside the Data Center summary box.
  1. On the left panel, click Edges.
  1. Select the Edge Gateway you want to work with.
  1. Click IPSec VPN.
  1. Click NEW.
Edge Gateway (showing detail for an edge gateway)
  1. On the Add IPSec VPN Tunnel popup, add your new configuration.

    1. Name: (Preferred name)
    2. Description: (Preferred description)
    3. Enabled: (Checked)
    4. Enabled: (Your Pre-Shared Key)
    5. Security Profile: (Default)
  1. For Local Endpoint:

    1. IP Address: (Available IP Address)
    2. Networks: (Available Networks)
  1. For Remote Endpoint:

    1. IP Address: (Available IP Address)
    2. Networks: (Available Networks)
    3. Logging: (Default)
  1. Click SAVE.
Add IPSec VPN Tunnel
  1. In the IPsec VPN Configuration page, click Save changes.
Edge Gateway (showing unsaved changes)
  1. On the IPsec VPN Configuration page, click the Activation Status tab, and then click the slider to enable the IPsec VPN Service Status.
  1. Click Save changes.
Edge Gateway (showing unsaved changes)
  1. Sign in to your Lumen Cloud environment.
  1. On the left pane, click Network, then click Site-To-Site VPN.
Network menu
  1. In the Site-to-Site VPN page, click + SITE TO SITE VPN.
Site-to-Site VPN
  1. In the Create Site-to-Site VPN page, select your Control Portal Site (CLC data center), then click ADD NETWORK BLOCK.
Create Site-to-Site VPN
  1. In the Select Destination Network or Subnet page, select your network, subnet size and starting IP address, then click ADD NETWORK BLOCK.
Select Destination Network or Subnet
  1. In Create Site-to-Site VPN page, in the Your Site section, type your Site Name, Device Type and VPN Peer IPv4 Address, then click ADD NETWORK BLOCK.
Create Site-to-Site VPN
  1. In the new field (Tunnel Encrypted Subnets) that appears, type your local network subnet block (on the LPC on VCF side), then click next: phase 1.
Your Site
  1. In the Phase 1 (IKE) page, type or select the following:

    1. IKE Protocol: IKEv1
    2. Protocol Mode: Main
    3. Encryption Algorithm: AES-256
    4. Hashing Algorithm: SHA1 (96)
    5. Pre-Shared Key: Same pre-shared key you used previously
    6. Diffie-Hellman Group: Group 2
    7. Lifetime Value: 8 hours
    8. DPD State: On
    9. NAT-T State: Default
Phase 1
  1. Click next: phase 2.
Phase 2
  1. On the Phase 2 (IPSEC) page, type or select the following:

    1. IPSEC Protocol: ESP
    2. Encryption Algorithm: AES-256
    3. Hashing Algorithm: SHA1 (96)
    4. PFS Enabled: On, Group 2
    5. Lifetime Value: 1 hour
  1. Click finish.

    Once completed, the summary page appears.
Site-to-Site VPN Details
  1. To test the site-to-site VPN, try pinging the gateway of a tunneled subnet of the other side. (i.e. ping from a VM in CLC on the 10.100.67.0/24 network to the gateway on the LPC on VCF side - 10.23.30.1.)