---
title: Add a Network for site-to-site connectivity
canonical: https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/
product: CloudConnexa Docs
description: The Network Wizard provides a convenient way to configure a CloudConnexa Network, representing the physical network you intend to connect to CloudConnexa. Here, the wizard is used to configure site-to-site network access.
---

# Add a Network for site-to-site connectivity

The Network wizard is an intention-based configuration wizard that can be skipped to continue with form-based Network configuration.

It is recommended that you use the Wizard for the following reasons:

- Configuration steps are tailored based on your intention(s) behind connecting your physical network to CloudConnexa so that no configuration is missed.
- Information is collected, and task sequencing is done logically, making it easier to understand and connect your physical network to CloudConnexa.

On completion of the Network Wizard steps, a CloudConnexa Network is added.

A CloudConnexa Network is a representation of your actual physical private network. It represents the reachable general internet, private and public Applications, and IP Services. Connectors connecting your physical private network to your WPC are also associated with the CloudConnexa Network.

The Network Wizard guides you in setting up a single Network and provides you with the information needed to set up static routes in your network's gateway router to enable communication between the devices connected to your networks at various sites.

> **Note**
>
> You must repeatedly run this wizard for every network you want to add to your site-to-site network and add the static routes in each network's gateway router.

## Add a network for site-to-site networking using the Network Configuration Wizard

To use the Network Wizard to connect a physical network that you want to use for site-to-site networking, follow the steps below:

1. Sign in to your WPC's Administration Portal at your **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Networks \> Networks**.
3. Click **Add Network**.
4. Select the **Site-to-site** network scenario from the three choices: **Remote Access, Site-to-site, and Secure Internet Access**.

   > **Note**
   >
   > Multiple scenarios can be chosen as the same network can be used for multiple kinds of access.
5. Click **Continue**. The [configuration wizard can be skipped](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-remote-access-using-the-network-wizard/#skip-wizard-to-add-network-146404) by clicking **Skip Wizard**.
6. The Network Configuration wizard is displayed with a progress bar on the right that leads you through six steps:
   1. [Define Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#define-network-146407)
   2. [Deploy OpenVPN Network Connector](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#deploy-openvpn-network-connector-146407) or [Deploy IPsec Network Connector](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#deploy-ipsec-network-connector-146407)
   3. [Configure Routing](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#configure-routing)
   4. [Add Application](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#add-application-146407)
   5. [Add IP Service](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#add-ip-service-146407)
   6. [Configure Access Group (Optional)](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#configure-access-group--optional--146407)

### Define Network

1. Enter a Network **Name**.
2. (Optional) Enter a **Description**.
3. Choose either **OpenVPN** or **IPsec** as the tunneling protocol from the **Connector Tunneling Protocol**.

   > **Note**
   >
   > The chosen protocol will apply to all the Connectors for this Network. A Network cannot have a mix of Connectors with both protocols.
4. In the **Connector** section, edit the default **Name** and **Region** if needed and optionally add a description.
5. Click **Add Additional Connector** to configure more Connectors.
6. Click **Next** to move to the next step of the Wizard.

### Deploy OpenVPN Network Connector

If the OpenVPN tunneling protocol was chosen in the earlier step, follow the steps below:

1. Select the Operating System, Virtual Private Server (VPS) provider, OpenVPN-compatible router, or the IaaS provider where you will install the Connector from the **Provider Type** drop-down menu. Refer to [About Connectors](https://openvpn.net/cloud-docs/owner/get-started/about-cloudconnexa/cloudconnexa-connectors.md) and [About Network Connectors](https://openvpn.net/cloud-docs/owner/networks/networks---connectors/about-network-connectors.md).
2. Follow the displayed steps to install the Connector.
3. Click **Next** to move to the next step of the Wizard.
4. A test is run to check if the Connector is online. Click **Next** if it passes. If it fails, click **Back to Instructions** to see the installation steps or click **Proceed Without Testing** to continue with the configuration.

   > **Note**
   >
   > If multiple Connectors were added in the [Define Network](https://openvpn.net/cloud-docs/owner/hosts/hosts---hosts/add-a-host-to-access-an-application-server/#define-host) section, the deploy Connector steps will repeat for the additional Connectors.

### Deploy IPsec Network Connector

If the IPsec tunneling protocol was chosen, follow the steps below:

1. Select the IPsec-compatible router or an IaaS provider for the IPsec connection from the **Platform to Connect** drop-down menu. Refer to [About Connectors](https://openvpn.net/cloud-docs/owner/get-started/about-cloudconnexa/cloudconnexa-connectors.md), and [About Network Connectors](https://openvpn.net/cloud-docs/owner/networks/networks---connectors/about-network-connectors.md).
2. Follow the displayed steps and provide the needed configuration information.
3. Test the connectivity and view logs if needed.
4. Click **Next** to move to the next step of the Wizard.

   > **Note**
   >
   > If multiple Connectors were added in the [Define Network](https://openvpn.net/cloud-docs/owner/hosts/hosts---hosts/add-a-host-to-access-an-application-server/#define-host) section, the deploy Connector steps will repeat for the additional Connectors.

### Configure Routing

When you connect a site's network to WPC, you must ensure devices connected to that site's network are able to route traffic to other sites and remote users. This can be achieved by adding static routes to that network's gateway router.

The static routes need to provide the Connector as the next hop for IP address destinations that match WPC Subnets and Subnets of networks at other sites.

The list of routes that should be configured with the private IP address of Connector as the target are:

- The configured subnets for your WPC. Refer to [WPC Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-tunnel-ip-addresses.md). The default IPV4 subnet is 100.96.0.0/11, and the IPv6 subnet is fd:0:0:8000::/49.
- The configured subnets for [Domain Routing](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-application-domain-based-routing.md). Refer to [Domain Routing Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-domain-routing-ip-addresses.md). The default IPv4 subnet is 100.80.0.0/12, and the IPv6 subnet is fd:0:0:4000::/50.
- The configured Routes of the other Networks with which you want site-to-site communications. Navigate to **Networks \> IP Services** to view a list of the routes for configured Networks. The subnets for the configured IP Services serve as implicit routes to the network. Explicit Routes may be present if Route Configuration has been enabled. See [Routes Configuration](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/enable-configuring-routes-for-networks.md).

  > **Note**
  >
  > Application Domain-based Routing can be used for site-to-site routing too. Refer to [Video: Use CloudConnexa To Create a Site-to-Site Network With Application Domain-Based Routing](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-create-a-site-to-site-network-with-application-domain-based-routing.md) and [About Networks](https://openvpn.net/cloud-docs/owner/networks/networks---networks/about-networks.md).

> **Note**
>
> After adding the networks in all your sites, each site's gateway router should have static routes to account for the Routes configured for all the other network sites, and the WPC and domain routing subnets.

### Add Application

Applications that are reachable by this network are identified by their domain names and act as routes to this network. Refer to [About Network Applications](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-network-applications.md).

> **Note**
>
> Either an Application or an IP Service must be added.

1. Click **Next** to skip adding an Application, or click **Add Application** and continue.
2. Provide a **Name** for the Application.
3. Add an optional **Description**.
4. Change the **All** for **Application Type (Network) protocols** to select specific application protocols to permit while restricting all others.
5. Provide a domain name for the Application in the **Domain** field.
6. Enable **Allow Embedded IP** if you will use the above domain to create domain names with IP addresses.

   Embedded IP enables you to append an IP address to a domain and resolve such domains without adding a DNS record. This is useful for IoT networks. For example, ssh root@192-168-1-1.server.example.com can be used to SSH into the computer with a private IP address of 192.168.1.1 on the Network that has the domain name of server.example.com configured as an Application with **Allow Embedded IP** ON.
7. Additional Domain names with the corresponding **Allow Embedded IP** setting can be added as desired. For example, for a web application, you could add two domain names: cnn.com and www.cnn.com
8. Click **Add Application**.

   The newly added Application will be listed. Click **Add Application** to add additional Applications.
9. Click **Next** to move to the next step of the Wizard.

> **Note**
>
> The Applications added can represent private applications or internet applications reachable from this Network.
>
> [DNS Records](https://openvpn.net/cloud-docs/owner/settings/settings---dns/set-dns-records.md) in CloudConnexa or in your Private DNS Server for private applications.

### Add IP Service

If you need to provide access to any applications explicitly using IP addresses, you must create IP Services. An IP Service defines public or private IP address subnets and optional protocols that should be accessible through this Network. For IP Services to be accessible, Routes are pushed to the routing table of those clients for whom an Access Group is defined, allowing access to an IP Service. If the Routes Configuration is enabled and custom Routes are added, only those Routes will be pushed that provide access to allowed IP Services, not all Routes added under a Network. If an Access Group defines access to the entire Network, all Routes related to this Network will be pushed to the corresponding client. Refer to [About Network Routes and IP Services](https://openvpn.net/cloud-docs/owner/networks/networks---ip-services/about-network-routes-and-ip-services.md)

> **Note**
>
> Add IP Services if your site-to-site network routing relies on adding static routes to subnet IP addresses of other site networks in your gateway router.

It is recommended to use Applications whenever possible instead of IP Services because with [Application Domain-Based Routing](https://openvpn.net/cloud-docs/owner/networks/networks---applications/about-application-domain-based-routing.md), you can:

- Hide the routes to your private networks, even from clients connected to CloudConnexa
- Hide the IP address of the actual application server because the client receives an intermediary IP address from the WPC domain routing range.
- Reduce the possibility of lateral movement because private network routes are not exposed.
- Enforce least privilege policies and use zero trust principles, as all Applications need to be identified.

> **Note**
>
> Either an Application or an IP Service must be added.

You would want to configure IP Services to:

- Create an implicit IP subnet route for the network
- Designate an IP subnet as a source of traffic to be used later in Access Groups.
- Restrict the protocols that will be used to access the service.
- Define who can access the IP service using Access Groups.
- Easily identify the traffic destined to the IP service by using a named IP Service when viewing statistics in [Access Visibility](https://openvpn.net/cloud-docs/owner/access/access---visibility/about-access-visibility.md).

1. Click **Next** to skip adding an IP Service, or click **Add IP Service** to continue.
2. Provide a **Name** for the IP Service.
3. Add an optional **Description**.
4. Change **All** for **Service Type (Network protocols)** to select specific application protocols to permit while restricting all others.
5. Toggle **Use as Source** if you want to use the IP address or subnets you will provide as a traffic source and as a traffic destination. For example, if the IP service is a software update application, and you want to restrict which destination subnets that software update application can communicate with using [Access Groups](https://openvpn.net/cloud-docs/owner/access/access---groups/about-access-groups.md).
6. Add one or more **Subnet**.
7. Click **Add IP Service**.

   The newly added IP Service will be listed. Click **Add IP Service** to add additional IP Services.
8. Click **Next** to move to the next step of the Wizard.

### Configure Access Group (Optional)

Refer to [About Access Groups](https://openvpn.net/cloud-docs/owner/access/access---groups/about-access-groups.md).

> **Note**
>
> For Access Groups to take effect, the **Topology** of the **WPC** must be set to **Custom.** Refer to [Topology](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-wpc-topology-to-control-the-applicability-of-access-control.md).

1. Click **Finish** to conclude the configuration wizard, or click **Add Access Group** and continue.
2. Provide a **Name** and, optionally, a **Description**.
3. Expand/Collapse and search the **Hosts, Networks, and User Groups** sections in the **Source** column to find the entity that you want to give access to.
4. Click on the check boxes of the source entities to select.
5. Expand/Collapse and search the **Hosts, Networks, and User Groups** sections in the **Destination** column to find the resources you want access to be granted. You will see an **Applications shared with you** section as a **Destination** if you have accepted access to shared applications using **AppHub**. Refer to [Access control](https://openvpn.net/cloud-docs/owner/apphub/app-client-controls-access-to-the-shared-applications.md)
6. Click on the check boxes of destination resources to select.
7. Click **Add Access Group.**

   The newly added Access Group will be listed. Click **Add Access Group** to add additional Access Groups.
8. Click **Finish** to complete the configuration wizard.

You will see a detailed view of the newly configured Network. Refer to [View, make changes, and delete a Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/view-make-changes-and-delete-a-network.md)

> **Warning**
>
> After adding an **Access Group**, delete the **Default Full Mesh Access Group** if it exits. The continued presence of the **Default Full Mesh Access Group** will make other **Access Groups** ineffective.

## Skip Wizard to add Network

When the Network configuration wizard is skipped, instead of a step-by-step wizard, a form-based entry is provided that collects the information needed for the sections below:

1. [Define Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#define-network-146407)
2. [Add Application](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#add-application-146407)
3. [Add IP Service](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity/#add-ip-service-146407)

The **Network Details** section has the **[Internet Access](https://openvpn.net/cloud-docs/owner/access/access---internet/about-internet-access-configuration.md)**configuration and the **[Internet Gateway](https://openvpn.net/cloud-docs/owner/networks/networks---networks/make-a-network-act-as-an-internet-gateway.md)** setting.

The **IP Services** section can contain the Route field if Route Configuration is enabled. See [Routes Configuration](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/enable-configuring-routes-for-networks.md).

Click **Add Network** to submit the configuration, and you will see a detailed view of the newly configured Network. Refer to [View, make changes, and delete a Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/view-make-changes-and-delete-a-network.md)

The Connector needs to be deployed after the Network has been added. Refer to [Deploy a Network OpenVPN Connector for a Configured Network](https://openvpn.net/cloud-docs/owner/networks/networks---connectors/deploy-a-network-openvpn-connector-for-a-configured-network.md). Any needed Access Groups also need to be added separately. Refer to [About Access Groups](https://openvpn.net/cloud-docs/owner/access/access---groups/about-access-groups.md).

## Related Tutorial

[Tutorial: Use CloudConnexa for Private Connectivity Between Multiple Sites (Site-to-Site Networking)](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/site-to-site-networking/tutorial--use-cloudconnexa-for-private-connectivity-between-multiple-sites--site-to-site-networking.md)

## Related Video

[Video: Use CloudConnexa To Create a Site-to-Site Network With Application Domain-Based Routing](https://openvpn.net/cloud-docs/videos/use-cases/video--use-cloudconnexa-to-create-a-site-to-site-network-with-application-domain-based-routing.md)

---

Prev: [Add a Network for secure internet access to select internet destinations](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access-to-select-internet-destinations.md)
Next: [Change the internet access for a Network](https://openvpn.net/cloud-docs/owner/networks/networks---networks/change-the-internet-access-for-a-network.md)
Index: https://openvpn.net/cloud-docs/llms.txt