Create a VPN endpoint

A VPN endpoint links your private networks to another site, such as an office, over an encrypted tunnel. It sits on one of your routers. Each connection on it is one tunnel to one device at the far end, such as an office firewall. VPN endpoints are in beta.

Before you start

• You need a router with a public gateway, and at least one network connected to it. The far end connects to the gateway’s public address. See Set up a router.
• Creating a VPN endpoint needs the Manage Networks permission. Ask your account owner if you don’t have it. Without it, you see You Can’t Create VPN Endpoints.
• Have the far end’s details ready: its public address, the networks behind it, and a pre-shared key you will set on both sides. A pre-shared key is a shared password that both ends use to prove who they are.

Create the VPN endpoint

1. In the side menu, open Infrastructure, then select VPN Endpoints under Networking.
2. Select Create VPN Endpoint. The form has three steps: Details, Router And Networks and Review.
3. In Name, type a name you’ll recognize, for example office-vpn. Select Continue.
4. In Router, choose the router. A router that can’t hold a VPN endpoint says why, for example No Public Gateway or Not Created Here.
5. Under Local Networks, tick the private networks the far end can reach, up to 10. Choose all IPv4 or all IPv6. Select Continue.
6. Check the details, then select Create VPN Endpoint. The router and networks can’t be changed after creation.

You see Creating office-vpn., and the endpoint’s page opens, or the list if the page isn’t ready yet. You add its connections there.

Add a connection

1. On the VPN endpoint’s page, select Add Connection.
2. Fill in the fields:
   • Connection Name: a name for this tunnel, for example toronto-office.
   • Peer Address: the public IP address or host name of the device at the far end, for example 198.51.100.10.
   • Peer Networks: the networks behind that device, separated by commas, for example 192.0.2.0/24.
   • Pre-Shared Key: 8 to 128 printable characters. Set the same key at the far end. It can’t be shown again.
   • Security Policy: the encryption both ends use. The default uses IKE version 2 with AES-256, SHA-256 and Diffie-Hellman group 14. The others are IKE version 2 with AES-128, and IKE version 1 with AES-256, SHA-1 and group 5, for older devices. It is fixed after creation.
   • Peer ID (Optional): only if the far end identifies itself by something other than its address.
3. Under Advanced Settings, you can set the MTU (Optional) and the dead peer detection (DPD) settings. DPD checks whether the far end is still there. DPD Action says what to do when it stops answering: Hold, Clear, Restart, Restart By Peer or Disabled. DPD Interval (Seconds) and DPD Timeout (Seconds) set how often to check and how long to wait. The defaults are Hold, 30 and 120.
4. Select Add Connection.

You see toronto-office Was Added. The connection stays Pending or Down until the device at the far end answers. That’s expected.

Set up the far end

The Settings For The Far End card lists every value to enter on the device at the other site, connection by connection. They include the Address On This Side, the Networks On This Side, the IKE and IPsec settings and the tunnel settings. Select Copy All to copy them in one go, or copy one value at a time.

The pre-shared key isn’t shown. Use the one you set for this connection.

Read the list

The list shows each endpoint’s Name, Status, Router, Public Address, Local Networks and Connections. Select a name to open the endpoint’s page.

Manage it afterwards

On the endpoint’s page, you read each connection’s status, copy the settings for the far end, edit or delete connections, and rename or delete the endpoint. See Manage a VPN endpoint.

If something goes wrong

• This project has no router with a public gateway. Set one up first, then come back.
• This router connects no network yet. Connect one, then come back.
• If the page says the endpoint has reached its limit of connections, delete a connection you don’t use to add another.
• For your security, the key was cleared after sending. Enter it again before you try again.
• The VPN Endpoint Wasn’t Created means the platform refused it. The message says why, and the form goes back to the field to fix.