Skip to main content

IaaS

Tutorial: Connect AWS to CloudConnexa with IPsec using VPG

Abstract

Configure an AWS site-to-site VPN between your VPC and CloudConnexa using a Virtual Private Gateway (VPG), including connector setup, AWS configuration, and connectivity verification.

This tutorial walks you through connecting your AWS VPC to CloudConnexa using an IPsec tunnel with a Virtual Private Gateway.

You'll complete steps in both the AWS Console and the Cloud Connexa Administration Portal. To make this easier to follow, each step is labeled with an icon:

  • ☁️ AWS Console steps — performed in AWS

  • 🔐 CloudConnexa steps — performed in CloudConnexa

To complete this setup, you'll configure:

  • A Customer Gateway to represent the CloudConnexa endpoint.

  • A Virtual Private Gateway attached to your VPC.

  • A site-to-site VPN connection between AWS and CloudConnexa.

  • Tunnel configuration using an AWS-generated configuration file.

Once configured, users and networks connected to CloudConnexa can securely access resources in your AWS VPC.

When to use this setup

Use this configuration when you want to connect a single VPC to CloudConnexa via a virtual private gateway, which only provides access to resources within that VPC. If you need broader connectivity (for example, access to multiple VPCs or public resources), use a Transit Gateway instead. Refer to Tutorial: Connect AWS VPC to CloudConnexa with IPsec using Transit Gateway.

Before you begin

  • Ensure you have a CloudConnexa account and Cloud ID.

  • Ensure you have access to your AWS account and VPC.

  • Ensure your VPC is created and properly configured, including routing and subnets.

🔐 Step 1: Create a Network (CloudConnexa)

  2. Navigate to Networks → Networks.

  3. Click Add Network.

  4. Select at least one Network Scenario. Refer to these tutorials for details:

  5. Click Continue.

  6. For the Network Configuration, enter a name and description (optional).

  7. Select IPsec as the Connector Tunneling Protocol.

  8. For the Connector, enter a name and description (optional).

  9. Click Next.

🔐 Step 2: Select AWS as the platform (CloudConnexa)

In the Network Configuration Wizard, you'll begin configuring your AWS VPC.

2.1 Select the AWS platform

  1. In Platform to Connect, select AWS. Refer to CloudConnexa Connectors and About Network Connectors.

    Instructions will appear on how to configure IPsec connectivity with CloudConnexa.

  2. Review the step-by-step guide.

  3. Click Next.

2.2 Review AWS configuration details

CloudConnexa displays the values required for AWS configuration.

  1. Note the following values from AWS Configuration Details:

    • CloudConnexa Public IP Address

      Note

      This is the CloudConnexa data center IP address, preselected for you. You can the selected option from the drop-down if desired. You can't change this after the connector is configured; you'll need to delete it and configure a new connector to use a different data center.

    • Target Gateway

    • Virtual Private Gateway / Transit Gateway

    • Customer Gateway

    • Routing Options

    • Static IP Prefixes

  2. You will use these values when configuring AWS resources.

☁️ Step 3: Configure AWS resources (AWS Console)

Set up the required AWS components to establish the IPsec tunnel.

3.1 Create a Customer Gateway

Create an AWS customer gateway as the IPsec endpoint for the CloudConnexa Region.

Note

You can also create the customer gateway while configuring the VPN connection.

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. Navigate to Customer gateways.

  3. Click Create customer gateway.

  4. Enter:

    • Name tag (optional): This creates a tag with a Name key and the value that you specify.

    • BGP ASN: Enter a Border Gateway Protocol Autonomous System Number (ASN) for your customer gateway.

      Note

      The IPsec VPN is going to use static routing. Therefore, the BGP ASN doesn't matter here. You can enter any number here.

    • IP address: Use the CloudConnexa Public IP Address displayed for your network connector configuration.

  5. (Optional) Configure certificate authentication if you'll be using certificate-based authentication. Refer to Creating and managing a private CA.

  6. (Optional) For Device, enter a name for the customer gateway device associated with this customer gateway.

  7. Click Create customer gateway.

3.2 Create a Virtual Private Gateway

To establish an IPsec VPN connection between your VPC and CloudConnexa, create an AWS target gateway. This target gateway will be a virtual private gateway.

  1. Navigate to Virtual private gateways.

  2. Click Create virtual private gateway.

  3. (Optional) Enter a name.

  4. Keep the default ASN.

  5. Click Create.

  6. Select the VPC, then click Actions → Attach to VPC.

  7. Select your VPC and confirm.

3.3 (Optional) Enable route propagation

Turn on route propagation on your AWS VPC route table if you want site-to-site connectivity between your VPC and other private networks connected to CloudConnexa.

  1. Navigate to Route tables.

  2. Select your route table associated with the subnet.

  3. On the Route propagation tab, click Edit route propagation.

  4. Select your new virtual private gateway.

  5. Save changes.

    Routes from your VPN connection are automatically added to the route table and directed to the virtual private gateway when the connection is active.

3.4 Create the VPN connection

  1. Navigate to Site-to-Site VPN connections.

  2. Click Create VPN connection.

  3. Configure:

    • Target gateway type: Select Virtual private gateway, and select the new virtual private gateway.

    • Customer gateway: Select the newly created customer gateway.

    • Routing options: Select Static.

  4. For Static IP Prefixes, copy and paste the Static IP Prefixes displayed on the CloudConnexa Administration Portal's Connector Configuration page, as shown in AWS Configuration Details.

    Note

    The Static IP Prefixes include the Routes of all CloudConnexa Networks configured so far. If you add new Networks or Routes and want site-to-site networking with your VPC, you must update the Static IP Prefixes.

  5. Click Create VPN connection.

3.5 Download the AWS configuration file

  1. Navigate to Site-to-Site VPN connections.

  2. Select your new VPN connection.

  3. Click Download configuration.

  4. Select Generic for the customer gateway device.

  5. Download the file.

    Important

    To properly load the download configuration screen from the AWS Management Console, ensure that your IAM role or user has permission for the following Amazon EC2 APIs: GetVpnConnectionDeviceTypes and GetVpnConnectionDeviceSampleConfiguration.

🔐 Step 4: Configure the Network Connector (CloudConnexa)

In this step, configure the IPsec tunnels on the CloudConnexa side using the AWS configuration.

CloudConnexa supports two tunnels for high availability. You can configure them manually or upload the AWS configuration file.

4.1 Configure CloudConnexa tunnel

Return to the CloudConnexa network wizard configuration to set up the CloudConnexa tunnel. Choose to upload a file or a manual configuration:

Option 1: Upload AWS configuration file (recommended)

  1. Click Upload Generic Configuration File.

  2. Select the configuration file downloaded from AWS.

    CloudConnexa automatically populates the tunnel settings.

Note

AWS creates two tunnels by default. CloudConnexa creates two corresponding Connectors.

Option 2: Configure tunnels manually

If you prefer, you can configure each tunnel manually using the values provided by AWS.

  1. Expand Tunnel 1.

  2. Enter the following:

    • Connector Public IP Address: Enter the AWS tunnel endpoint IP address (from AWS configuration, Tunnel 1).

    • Pre-shared Key (PSK): Enter the pre-shared key provided by AWS.

      Important

      You must specify a pre-shared key for each tunnel configuration.

  3. (Optional) Configure advanced settings: Expand Advanced Configuration to customize IPsec parameters:

    • IKE Version: Select the version: IKEv1 or IKEv2.

      Tip

      If using IKEv2 and only GCM encryption algorithms (AES-128-GCM-16 and/or AES-256-GCM-16), the integrity algorithm and a DH group are optional in phase 2.

      For non-GCM encryption algorithms, an integrity algorithm and a DH group are required. The default values are applied automatically.

    • Phase 1 settings:

      Setting

      Description

      Encryption Algorithm

      Select one or more supported encryption algorithms.

      Integrity Algorithm

      Select a supported integrity algorithm.

      Diffie-Hellman Group

      Select a DH group supported by your device.

      Lifetime (sec)

      Enter a value between 901 and 86400.

    • Phase 2 settings:

      Setting

      Description

      Encryption Algorithm

      Select one or more supported encryption algorithms.

      Integrity Algorithm

      Select a supported integrity algorithm.

      Diffie-Hellman Group

      Select a DH group supported by your device.

      Lifetime (sec)

      Enter a value between 900 and 28800.

    • IKE rekey settings:

      Setting

      Description

      Rekey Margin Time (sec)

      Value between 60 and half of Phase 2 lifetime.

      Rekey Fuzz (%)

      Value between 0 and 100.

      Replay Window Size (packets)

      Value between 64 and 2048.

    • Connection behavior:

      Setting

      Description

      Startup Action

      Defines how the tunnel is initiated.

      CloudConnexa Connection Restoration

      Controls whether the tunnel automatically reconnects if interrupted:

      • Defaults to Yes when Startup Action = Start.

      • Automatically set to No when Startup Action = Attach and can't be changed.

      AWS-specific note

      When you set AWS connectors to Attach for the Startup Action, CloudConnexa doesn't initiate the tunnel.

  4. (Optional but recommended) Expand Tunnel 2 and repeat the same configuration steps using AWS Tunnel 2 values.

    Tip

    Using both tunnels provides high availability and failover.

4.2 Verify connectivity

  1. Click Test Connection 1.

    CloudConnexa attempts to establish a connection to your AWS network.

  2. Check the connection status:

    • Connected — The tunnel is successfully established.

    • Offline — The connection failed or hasn't been established yet.

      Tip

      If the connection status is Offline:

      • Click View Logs to review connection details.

      • Verify the following:

        • PSK or certificates match on both sides.

        • IPsec parameters (encryption, DH group, lifetimes) are aligned.

        • Firewall rules allow IPsec traffic.

        • The correct public IP address is configured.

  3. Click Test Connection 2 (if configured).

  4. Check the connection status:

    • Connected — The tunnel is successfully established.

    • Offline — The connection failed or hasn't been established yet.

      Tip

      If the connection status is Offline:

      • Click View Logs to review connection details.

      • Verify the following:

        • PSK or certificates match on both sides.

        • IPsec parameters (encryption, DH group, lifetimes) are aligned.

        • Firewall rules allow IPsec traffic.

        • The correct public IP address is configured.

CloudConnexa attempts to establish a connection to your AWS network.

🔐 Step 5: Complete the Setup (CloudConnexa)

  1. Click Finish to complete the Network configuration.

  2. Confirm that:

    • The Network is created.

    • The Connectors shows a Connected status.

Tutorial: Connect AWS VPC to CloudConnexa with IPsec using Transit Gateway

Abstract

Configure an AWS Transit Gateway VPN between your VPC and CloudConnexa to enable scalable connectivity across multiple VPCs, including routing setup and tunnel configuration.

This tutorial walks you through setting up an IPsec tunnel between your AWS environment and CloudConnexa using a Transit Gateway.

You'll complete steps in both the AWS Console and the Cloud Connexa Administration Portal. To make this easier to follow, each step is labeled with an icon:

  • ☁️ AWS Console steps — performed in AWS

  • 🔐 CloudConnexa steps — performed in CloudConnexa

Use this configuration when you need connectivity across multiple VPCs, shared services, or internet-bound traffic through CloudConnexa.

To complete this setup, you'll configure:

  • A Transit Gateway to act as a central routing hub.

  • A Transit Gateway attachment to connect your VPC.

  • A site-to-site VPN connection between AWS and CloudConnexa.

  • Routing tables for:

    • Your VPC subnets.

    • The Transit Gateway.

  • (Optional) A NAT Gateway for internet-bound traffic from private subnets.

  • Tunnel configuration using an AWS-generated configuration file.

Once configured, users and networks connected to CloudConnexa can securely access resources in your AWS environment.

Overview

In this setup, AWS Transit Gateway acts as a central routing hub that connects:

Compared to a virtual private gateway, a Transit Gateway supports broader and more flexible connectivity.

When to use this setup

Use this configuration when you need connectivity across multiple VPCs or more advanced routing scenarios. If you only need a connection to a single VPC, refer to ???.

Before you begin

  • Ensure you have a CloudConnexa account and Cloud ID.

  • Ensure your AWS VPC and subnets are configured.

  • Ensure you have permissions to create AWS networking resources.

🔐 Step 1: Create a Network (CloudConnexa)

  2. Navigate to Networks → Networks.

  3. Click Add Network.

  4. Select at least one Network Scenario. Refer to these tutorials for details:

  5. Click Continue.

  6. For the Network Configuration, enter a name and description (optional).

  7. Select IPsec as the Connector Tunneling Protocol.

  8. For the Connector, enter a name and description (optional).

  9. Click Next.

🔐 Step 2: Select AWS as the platform (CloudConnexa)

In the Network Configuration Wizard, you'll begin configuring your AWS VPC.

2.1 Select the AWS platform

  1. In Platform to Connect, select AWS. Refer to CloudConnexa Connectors and About Network Connectors.

    Instructions will appear on how to configure IPsec connectivity with CloudConnexa.

  2. Review the step-by-step guide.

  3. Click Next.

2.2 Review AWS configuration details

CloudConnexa displays the values required for AWS configuration.

  1. Note the following values from AWS Configuration Details:

    • CloudConnexa Public IP Address

      Note

      This is the CloudConnexa data center IP address, preselected for you. You can the selected option from the drop-down if desired. You can't change this after the connector is configured; you'll need to delete it and configure a new connector to use a different data center.

    • Target Gateway

    • Virtual Private Gateway / Transit Gateway

    • Customer Gateway

    • Routing Options

    • Static IP Prefixes

  2. You will use these values when configuring AWS resources.

☁️ Step 3: Configure AWS resources (AWS Console)

Set up the AWS components required for Transit Gateway-based VPN connectivity.

3.1 Create a Transit Gateway

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. Navigate to Transit Gateways.

  3. Click Create transit gateway.

  4. Configure settings as needed.

  5. Click Create transit gateway.

3.2 Create a site-to-site VPN connection

  1. Navigate to Site-to-Site VPN connections.

  2. Click Create VPN connection.

  3. Configure:

    • Target gateway type: Select Transit gateway, and select the new transit gateway.

    • Customer gateway: Select New, and enter CloudConnexa values.

    • Routing options: Select Static.

  4. For Static IP Prefixes, copy and paste the Static IP Prefixes displayed on the CloudConnexa Administration Portal's Connector Configuration page, as shown in AWS Configuration Details.

    Note

    The Static IP Prefixes include the Routes of all CloudConnexa Networks configured so far. If you add new Networks or Routes and want site-to-site networking with your VPC, you must update the Static IP Prefixes.

  5. Click Create VPN connection.

3.3 Attach your VPC to the Transit Gateway

  1. Navigate to Transit Gateway attachments.

  2. Click Create transit gateway attachment.

  3. Select the new transit gateway for the Transit gateway ID.

  4. Configure your transit gateway attachment as needed for your VPC and subnets.

  5. Click Create transit gateway attachment.

3.4 Create a NAT Gateway (for internet-bound traffic)

  1. Navigate to NAT gateways.

  2. Click Create NAT gateway.

  3. Configure the NAT gateway for your VPC and associate it with an Elastic IP.

  4. Click Create NAT gateway.

3.5 Configure VPC route tables

Configure the private subnet route table

This route table is used by resources that don't have direct internet access.

  1. Navigate to Route tables.

  2. Select the route table associated with your private subnet.

  3. Click Edit routes.

  4. Add the following routes:

    • Destination:0.0.0.0/0 → Target: NAT Gateway

    • Destination: 100.96.0.0/11 → WPC Subnet Target: Transit Gateway

      Note

      This is the default WPC Subnet value. You can configure this under Settings → WPC in the CloudConnexa admin portal.

    • Destination: 100.80.0.0/12 → Domain Routing Subnet Target: Transit Gateway

      Note

      This is the default Domain Routing Subnet value. You can configure this under Settings → WPC in the CloudConnexa admin portal.

  5. Click Save changes.

Configure the public subnet route table

This route table is used by resources that can access the internet directly.

  1. Navigate to Route tables.

  2. Select the route table associated with your public subnet.

  3. Click Edit routes.

  4. Ensure the following routes are present:

    • Destination: 100.96.0.0/11 → WPC Subnet Target: Transit Gateway

      Note

      This is the default WPC Subnet value. You can configure this under Settings → WPC in the CloudConnexa admin portal.

    • Destination: 100.80.0.0/12 → Domain Routing Subnet Target: Transit Gateway

      Note

      This is the default Domain Routing Subnet value. You can configure this under Settings → WPC in the CloudConnexa admin portal.

  5. Click Save changes.

Tip

The public subnet typically has a route to an Internet Gateway for internet access. You don't need to modify this configuration for CloudConnexa connectivity.

3.6 Configure Transit Gateway route table

  1. Navigate to Transit gateway route tables.

  2. Click on the route table for your new transit gateway.

  3. Click the Routes tab.

  4. Create the following static routes:

    • 0.0.0.0/0 (default route, points to the VPC resource)

    • 100.96.0.0/11 (WPC subnet, points to the VPN resource)

    • 100.80.0.0/12 (Domain routing subnet, points to the VPN resource)

3.7 Download the AWS configuration file

  1. Navigate to Site-to-Site VPN connections.

  2. Select your new VPN connection.

  3. Click Download configuration.

  4. Select Generic for the customer gateway device.

  5. Download the file.

    Important

    To properly load the download configuration screen from the AWS Management Console, ensure that your IAM role or user has permission for the following Amazon EC2 APIs: GetVpnConnectionDeviceTypes and GetVpnConnectionDeviceSampleConfiguration.

🔐 Step 4: Configure the Network Connector (CloudConnexa)

In this step, configure the IPsec tunnels on the CloudConnexa side using the AWS configuration.

CloudConnexa supports two tunnels for high availability. You can configure them manually or upload the AWS configuration file.

4.1 Configure CloudConnexa tunnel

Return to the CloudConnexa network wizard configuration to set up the CloudConnexa tunnel. Choose to upload a file or a manual configuration:

Option 1: Upload AWS configuration file (recommended)

  1. Click Upload Generic Configuration File.

  2. Select the configuration file downloaded from AWS.

    CloudConnexa automatically populates the tunnel settings.

Note

AWS creates two tunnels by default. CloudConnexa creates two corresponding Connectors.

Option 2: Configure tunnels manually

If you prefer, you can configure each tunnel manually using the values provided by AWS.

  1. Expand Tunnel 1.

  2. Enter the following:

    • Connector Public IP Address: Enter the AWS tunnel endpoint IP address (from AWS configuration, Tunnel 1).

    • Pre-shared Key (PSK): Enter the pre-shared key provided by AWS.

      Important

      You must specify a pre-shared key for each tunnel configuration.

  3. (Optional) Configure advanced settings: Expand Advanced Configuration to customize IPsec parameters:

    • IKE Version: Select the version: IKEv1 or IKEv2.

      Tip

      If using IKEv2 and only GCM encryption algorithms (AES-128-GCM-16 and/or AES-256-GCM-16), the integrity algorithm and a DH group are optional in phase 2.

      For non-GCM encryption algorithms, an integrity algorithm and a DH group are required. The default values are applied automatically.

    • Phase 1 settings:

      Setting

      Description

      Encryption Algorithm

      Select one or more supported encryption algorithms.

      Integrity Algorithm

      Select a supported integrity algorithm.

      Diffie-Hellman Group

      Select a DH group supported by your device.

      Lifetime (sec)

      Enter a value between 901 and 86400.

    • Phase 2 settings:

      Setting

      Description

      Encryption Algorithm

      Select one or more supported encryption algorithms.

      Integrity Algorithm

      Select a supported integrity algorithm.

      Diffie-Hellman Group

      Select a DH group supported by your device.

      Lifetime (sec)

      Enter a value between 900 and 28800.

    • IKE rekey settings:

      Setting

      Description

      Rekey Margin Time (sec)

      Value between 60 and half of Phase 2 lifetime.

      Rekey Fuzz (%)

      Value between 0 and 100.

      Replay Window Size (packets)

      Value between 64 and 2048.

    • Connection behavior:

      Setting

      Description

      Startup Action

      Defines how the tunnel is initiated.

      CloudConnexa Connection Restoration

      Controls whether the tunnel automatically reconnects if interrupted:

      • Defaults to Yes when Startup Action = Start.

      • Automatically set to No when Startup Action = Attach and can't be changed.

      AWS-specific note

      When you set AWS connectors to Attach for the Startup Action, CloudConnexa doesn't initiate the tunnel.

  4. (Optional but recommended) Expand Tunnel 2 and repeat the same configuration steps using AWS Tunnel 2 values.

    Tip

    Using both tunnels provides high availability and failover.

4.2 Verify connectivity

  1. Click Test Connection 1.

    CloudConnexa attempts to establish a connection to your AWS network.

  2. Check the connection status:

    • Connected — The tunnel is successfully established.

    • Offline — The connection failed or hasn't been established yet.

      Tip

      If the connection status is Offline:

      • Click View Logs to review connection details.

      • Verify the following:

        • PSK or certificates match on both sides.

        • IPsec parameters (encryption, DH group, lifetimes) are aligned.

        • Firewall rules allow IPsec traffic.

        • The correct public IP address is configured.

  3. Click Test Connection 2 (if configured).

  4. Check the connection status:

    • Connected — The tunnel is successfully established.

    • Offline — The connection failed or hasn't been established yet.

      Tip

      If the connection status is Offline:

      • Click View Logs to review connection details.

      • Verify the following:

        • PSK or certificates match on both sides.

        • IPsec parameters (encryption, DH group, lifetimes) are aligned.

        • Firewall rules allow IPsec traffic.

        • The correct public IP address is configured.

CloudConnexa attempts to establish a connection to your AWS network.

🔐 Step 5: Complete the Setup (CloudConnexa)

  1. Click Finish to complete the Network configuration.

  2. Confirm that:

    • The Network is created.

    • The Connectors shows a Connected status.

Tutorial: Assign DNS servers using DHCP for AWS VPC

Abstract

This tutorial shows how to configure a DHCP option set on your AWS VPC to set the DNS servers for all the resources in your VPC.

This tutorial shows how to configure a DHCP option set on your AWS VPC to set the DNS servers for all the resources in your VPC. Using the DNS server associated with the Connector's tunnel IP address subnet lets your VPC resources access Applications on the WPC using Application Domain-Based Routing.

  1. Create a DHCP option set and configure the Domain name server as the IP address that is one before the tunnel IP address of the Connector. For example, if the tunnel IP address of the Connector is 100.96.1.18, then the DNS server IP address is 100.96.1.17.

    aws_dhcp_options.png

  2. Assign DHCP option set to your VPC.

Tutorial: Find the AWS IPsec tunnel's outside IP address

Abstract

Follow these steps to find the AWS IPsec tunnel's public IP address (Outside IP Address).

To find the AWS IPsec tunnel's public IP address (Outside IP Address), follow the steps below:

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. Click Site-to-Site VPN connections.

  3. Click the hyperlinked Name of the desired VPN connection.

  4. Click the Tunnel details tab.

    AWS_outside_IP_address_of_IPsec_tunnel.png

  5. The Outside IP address will be listed in the Tunnel state section.

Tutorial: Connect Your AWS VPC to CloudConnexa by Deploying a Connector

Abstract

This tutorial shows you the steps to take to deploy a Connector on your AWS VPC. Once deployed, the Connector attempts to establish an outbound OpenVPN tunnel to the configured CloudConnexa Region. On a successful connection, the AWS VPC can be accessed by your CloudConnexa Users.

Launch Connector on AWS

To configure a Network that represents your AWS Virtual Private Cloud (VPC) and install an AWS instance with a Connector that uses AWS CloudFormation, follow these steps:

  1. Sign in to the CloudConnexa Administration portal at https://cloud.openvpn.com

  2. Navigate to Networks and click Networks.

    Select the Scenario(s) that apply to your use case.

  3. Provide a Network Name and enter an optional Description.

  4. Provide a Connector name, select a Region, and click Next.

  5. Select an AWS Region.

  6. Click Launch ad log into AWS.

  7. On the Quick create stack web page, specify the stack details: Stack name, KeyName, SubnetId, VpcId , and then click Next.

    Note

    Use the existing VPC and IP subnet.

  8. Click the I acknowledge that AWS CloudFormation might create IAM resources checkbox to allow CloudFormation to create RouteManagerRole IAM::Role resources. This role configures routes in the VPC Route table to use the Connector. Click Create stack.

  9. Monitor the stack creation as it goes from CREATE_IN_PROGRESS state to CREATE_COMPLETE.

  10. On completion, open the Resources tab to view the created resources. Check that the RouteManagerRole was created along with an InstancSecurityGroup, InstanceProfile, and the EC2Instance.

  11. Click on the Physical ID of the EC2 instance to check its details.

    Note

    The EC2 instance uses Ubuntu. If you want to connect to it with SSH, use ubuntu as the username.

  12. The Connector EC2 automatically connects to the Region and the Network will show up as Online on the Status page of CloudConnexa Admin portal.

A new EC2 instance Security Group is automatically created after the Network Connector deployment through CloudFormation. This Security Group contains only one Inbound Rule to allow SSH connections (Protocol: TCP; Port: 22; Source: 0.0.0.0/0).

Modify existing Security Groups

If you are using Security Groups to protect any instances that need their traffic to be routed through the Connector instance, you need to add the Security Group of the Connector instance to their inbound rules.

This screenshot shows the inbound rules of sg-0d7ffe09b9076d0dd – launch-wizard-1 Security Group are being edited to add the last rule, which accepts all incoming traffic coming from the Security Group sg-0210e0cbe1ce14ee7 that is associated with the Connector instance.

Modify existing Security Groups

Optional: Check and add routes to the VPC Route Table associated with the subnet

Check that a route exists in the route table for the WPC Subnet IP address range configured in Network Settings of CloudConnexa. The default WPC IPv4 subnet address range for CloudConnexa is 100.96.0.0/11. If a route to destination 100.96.0.0/11 using the Connector instance as a target is absent, add it. If other CloudConnexa Networks need to be reached from the VPC, add a route with those Network subnets as the destination and the Connector instance as the target.

The screenshot below shows how the route table should look with an entry for the CloudConnexa WPC IP address subnet (100.96.0.0/11) and an entry for subnet 192.168.0.0/28 which is another Network (for example, office Network) that is reachable via CloudConnexa. Both entries have target as the instance running the Connector.

Note: If you allow CloudFormation to create RouteManagerRole IAM::Role resources, this role will configure routes in the VPC Route table to use the Connector automatically and update the route table as new Networks are added to the WPC.

Check and add routes to the VPC Route Table associated with the subnet

Tutorial: Connect Your Azure VNet to CloudConnexa by Deploying a Connector

Abstract

This tutorial shows you the steps to take to deploy a Connector on your Azure VNet. Once deployed, the Connector attempts to establish an outbound OpenVPN tunnel to the configured CloudConnexa Region. On a successful connection, the Azure VNet can be accessed by your CloudConnexa Users.

Launch Connector On Azure

You can deploy a Connector in the Microsoft Azure environment during the Network creation process. You can choose to either launch a template directly in Azure, or download a template and launch it manually.

62e9c0624b256.png

Steps: Launch a template directly on Azure

  1. Click Launch On Azure.

    • You are redirected to your Azure environment, where a virtual machine (VM) is created automatically.

  2. Define the parameters on the Azure VM, noting that the fields marked with an asterisk are mandatory.

    62e9c0657037e.png

    Parameter

    Value

    Subscription

    A logical container used to provision resources in Azure. It holds the details of all your resources such as VMs, databases, and more.

    Resource Group

    A container that holds related resources for an Azure solution. The resource group includes those resources that you want to manage as a group.

    Region

    The region value propagates from the resource group.

    Disk Type

    The type of storage to be used for your VM disks.

    Admin Username

    The Administrator username for the VM.

    Authentication Type

    The type of authentication to use on the VM. SSH key is strongly recommended.

    Admin Password Or Key

    The SSH key or password for the VM.

    Dns Label Prefix

    The unique DNS label prefix for the public IP that is used to access the VM.

    Vm Size

    The size of the VM.

    Virtual Network Name

    The name of the existing virtual Network (VNet). You can find the VNet name on the Virtual Networks page.

    Subnet Name

    The name of the existing subnet in the VNet you want to use. You can find the subnet name on the Subnets blade of the VNet. This subnet value must be the same as the subnet of the Network on the CloudConnexa Administration portal.

    Network Security Group Name

    The name of the Network security group.

  3. Click Next: Review + create.

    62e9c0675a14e.png

  4. When validation passes, click Create.

    62e9c0694069d.png

The Connector deployment is complete. You can navigate to your resource group to find your VM.

Steps: Launch Connector manually from template

  1. In the CloudConnexa Administration portal, click Download to save the JSON Azure template to your local computer.

    62e9c06bdd7e0.png

  2. Access your Azure portal and click Create a resource.

    62e9c06d1d6aa.png

  3. Search for Template deployment (deploy using custom templates) and click Create.

  4. Click Build your own template in the editor.

    62e9c06ea7c98.png

  5. Click Load File.

    62e9c07083ab6.png

  6. Load the template file from your local computer and click Save.

    62e9c071c9061.png

  7. Follow the steps 2-4 shown in the Steps: Launch a template directly on Azure section to complete the configuration.

Tutorial: Connect Azure to CloudConnexa with IPsec

Abstract

Learn how to connect your Azure VNet to CloudConnexa with a site-to-site IPsec VPN tunnel, giving CloudConnexa users and networks secure access to Azure.

Overview

This tutorial shows how to connect your Microsoft Azure virtual network (VNet) to CloudConnexa using an IPsec site-to-site tunnel—without deploying a Connector virtual machine in your Azure environment.

Unlike a Connector-based deployment, IPsec uses Azure VPN Gateway to establish the connection. This means there is no Connector virtual machine to manage, but you need to configure the VPN on both the Azure side and in your CloudConnexa Administration portal.

Once configured, the site-to-site IPsec tunnels connect your Azure VNet to the selected CloudConnexa Region. Your CloudConnexa users—and any other networks connected through CloudConnexa—can then access resources in the VNet privately, without exposing them to the public internet.

Before you begin

Before configuring the IPsec connection, ensure you have the following:

  • A CloudConnexa account and Cloud ID.

  • Administrator access to your CloudConnexa Administration portal.

  • An Azure subscription.

  • An existing Azure VNet to connect to CloudConnexa.

  • Permissions to create subnets, local network gateways, virtual network gateways, public IP addresses, and VPN connections in Azure.

  • Available address space in the VNet for a subnet named GatewaySubnet.

Note

Creating an Azure virtual network gateway can take 45 minutes or longer, depending on the selected gateway SKU.

Tip

For Azure-specific prerequisites and current portal instructions, refer to the Microsoft documentation for creating a site-to-site VPN connection.

Step 1: Configure the Network Connector in CloudConnexa

  2. Navigate to Networks.

  3. Select Add Network.

  4. Select the appropriate Network Scenario.

  5. Configure the network details.

  6. When prompted, select IPsec for your tunneling protocol.

  7. On the Configure Network Connector page, select Azure from Platform to Connect.

    • CloudConnexa displays the values you need to configure the Azure gateways, tunnels, and VPN connection.

  8. Under Create Azure Gateways, review and copy the following values:

    • CloudConnexa Public IP Address: Select the available CloudConnexa public IP address from the list. You'll enter this value as the Azure local network gateway.

    • Address Spaces: These are the CloudConnexa-side networks that Azure routes through the IPsec tunnel.

    • BGP: Configure BGP as displayed. The current configuration requires BCP to be disabled.

  9. Also review the displayed virtual network gateway requirements:

    • Type: VPN

    • SKU: Any

    • Generation: Any

    • Public IP Address: New

    • Active-Active Mode: Enabled

    • BGP: Disabled

      Tip

      Keep the CloudConnexa page open while configuring Azure so you can copy the displayed values into the corresponding Azure fields.

  10. Under Set Up CloudConnexa Tunnel, review the fields, but don't enter the Azure gateway IP addresses yet. Azure assigns those addresses after creating the virtual network gateway.

  11. Leave Advanced Configuration unchanged unless the Azure VPN configuration requires different IPsec parameters.

  12. Open a new browser tab and sign in to the Azure portal.

Step 2: Create the Azure gateway subnet

Azure requires a dedicated subnet named GatewaySubnet for the virtual network gateway resources.

  1. In the Azure portal, navigate to the VNet you're connecting to CloudConnexa.

  2. Select Subnets.

  3. Select + Gateway subnet.

  4. Specify the subnet address range.

    Tip

    Microsoft recommends using a /27 or larger subnet, such as /26 or /25, to support the required gateway configuration.

  5. Select Save or Add, depending on the Azure portal interface.

    Important

    The subnet must be named GatewaySubnet. Do not deploy application resources or other virtual machines to this subnet.

Step 3: Create the Azure local network gateway

The local network gateway represents the CloudConnexa Region and the networks reachable through it.

  1. In the Azure portal, navigate to Local network gateways.

  2. Select + Create.

  3. On the Basics tab, configure the following settings:

    • Subscription: Select the appropriate Azure subscription.

    • Resource Group: Select the resource group for the VPN resources.

    • Region: Select the Azure region for the gateway resources.

    • Name: Enter a descriptive name, such as CloudConnexa.

    • Endpoint: Select IP address when prompted.

    • IP Address: Enter the CloudConnexa Public IP Address displayed in CloudConnexa.

    • Address Space: Add each IP range displayed under Address Spaces in CloudConnexa.

  4. Continue to the advanced configuration.

  5. Ensure Configure BGP settings is set to No or disabled.

  6. Select Review + create.

  7. After validation succeeds, select Create.

    Important

    Add every address space displayed in CloudConnexa. Missing ranges may prevent Azure from routing traffic to some CloudConnexa users or connected networks.

Step 4: Create the Azure virtual network gateway

The virtual network gateway provides the Azure-side VPN endpoints for the IPsec tunnels.

  1. In the Azure portal, search for and select Virtual network gateways.

  2. Select + Create.

  3. Configure the gateway:

    • Subscription: Select the appropriate subscription.

    • Name: Enter a name for the gateway.

    • Region: Select the region associated with the VNet.

    • Gateway Type: Select VPN.

    • SKU: Select an appropriate VPN gateway SKU.

    • Generation: Select a supported generation.

    • Virtual Network: Select the VNet containing the GatewaySubnet.

  4. Under the public IP address settings:

    • Create or select the first public IP address.

    • Enable Active-active mode.

    • Create or select the second public IP address.

  5. Ensure Configure BGP is disabled.

  6. Select Review + create.

  7. After validation succeeds, select Create.

    • Azure begins deploying the virtual network gateway.

      Note

      Gateway deployment can take 45 minutes or longer. You can monitor the deployment status from the gateway's Overview page.

  8. After deployment completes, locate the two public IP addresses assigned to the active-active virtual network gateway. You need these values to configure the CloudConnexa tunnels.

Step 5: Set up the CloudConnexa tunnels

  1. Return to the CloudConnexa Network Configuration Wizard.

  2. In Set Up CloudConnexa Tunnel, enter:

    • Connector Public IP Address: Enter the first public IP address assigned to the Azure virtual network gateway.

    • Pre-shared Key (PSK): Enter a strong pre-shared key.

  3. Configure tunnel 2 in the same manner.

  4. Record the pre-shared keys. You must enter the corresponding key when creating each Azure VPN connection.

  5. Leave the Advanced Configuration settings at their default values unless your environment requires different IPsec parameters.

Step 6: Create the first Azure VPN connection

Create a VPN connection between the Azure virtual network gateway and the CloudConnexa local network gateway.

  1. In the Azure portal, navigate to Connections.

  2. Select + Create.

  3. On the Basics tab, configure:

    • Subscription: Select the subscription containing the gateway resources.

    • Resource Group: Select the appropriate resource group.

    • Connection Type: Select Site-to-site (IPsec).

    • Name: Enter a name for the first connection.

    • Region: Select the same region as the gateway resources.

  4. Continue to the connection settings.

  5. Configure:

    • Virtual Network Gateway: Select the virtual network gateway created earlier.

    • Local Network Gateway: Select the Azure local network gateway created earlier.

    • Authentication type: Select Shared key.

    • Shared Key: Enter the pre-shared key configured for Tunnel 1 in CloudConnexa.

    • IKE Protocol: Select IKEv2.

    • Use Azure Private IP Address: Leave disabled.

    • Enable BGP: Leave disabled.

    • IPsec/IKE Policy: Select Custom.

    • Use Policy Based Traffic Selector: Select Enable.

  6. Configure the custom IPsec/IKE policy to match the values displayed under Advanced Configuration in CloudConnexa.

  7. Select Review + create.

  8. After validation succeeds, select Create.

    • Wait for Azure to finish deploying the connection.

Step 7: Create the second Azure VPN connection (optional

Because the Azure virtual network gateway uses active-active mode, create a second connection for the second Azure gateway instance.

Repeat the procedure from Step 6 with the following changes:

  • Enter a unique connection name.

  • Associate the connection with the second Azure gateway instance or public IP configuration, as required by the Azure portal.

  • Enter the pre-shared key configured for Tunnel 2 in CloudConnexa.

  • Use the same local network gateway and custom IPsec/IKE policy settings.

After validation succeeds, create the connection and wait for deployment to finish.

Note

The exact Azure interface for creating the second active-active connection may vary. Ensure that each CloudConnexa tunnel corresponds to a different public IP address on the Azure virtual network gateway.

Step 8: Verify connectivity

After configuring the tunnels on both sides:

  1. Return to the CloudConnexa Network Configuration Wizard.

  2. Select Test Connection.

  3. Review the connection result.

    • CloudConnexa attempts to establish connectivity to the Azure VNet through the configured tunnels.

  4. You can also select View Logs to review tunnel activity and troubleshoot unsuccessful connection attempts.

If the test fails, verify that:

  • The Azure gateway public IP addresses match the Connector Public IP Address values entered in CloudConnexa.

  • The pre-shared key for each tunnel matches the corresponding Azure connection.

  • The Azure local network gateway contains every CloudConnexa address space displayed in the wizard.

  • The Azure VPN connections use the custom IPsec/IKE values displayed by CloudConnexa.

  • BGP is disabled.

  • Use policy based traffic selector is enabled.

  • The Azure virtual network gateway uses active-active mode.

After the connection test succeeds, select Next and continue through the Network Configuration Wizard.

Tutorial: Connect Your GCP VPC to CloudConnexa by Deploying a Connector

Abstract

Deploy an OpenVPN Network Connector on a GCP Compute Engine VM to connect your Google Cloud VPC to CloudConnexa — giving your remote users and other connected networks private access to GCP resources without exposing them to the public internet.

Overview

This tutorial walks you through deploying a Network Connector to a Google Cloud VPC directly from the CloudConnexa Administration portal.

CloudConnexa automatically deploys a Compute Engine VM and network to your selected GCP project, installs the Connector software, and enables the required networking configuration. This provides secure private network access between your Google Cloud VPC and users or other networks connected through CloudConnexa.

Many administrators use this deployment as a site-to-site connection between their Google Cloud environment and CloudConnexa.

Before you begin

Before starting this tutorial, ensure you have:

  • A CloudConnexa account and Cloud ID.

  • A Google Cloud Platform account.

  • Permission to create Compute Engine VM instances in your Google Cloud project.

  • A Google Cloud VPC where you want to deploy the Connector.

Step 1: Create a Network

To create a Network, follow the steps below:

  2. Navigate to Networks.

  3. Select Add Network and select your desired network scenario.

  4. Complete the Define Network page.

  5. Select Next.

The Deploy Network Connector page displays.

Step 2: Sign in to Google Cloud

To authorize CloudConnexa to deploy the Connector, follow the steps below:

  1. On the Deploy Network Connector page, select Google Cloud Platform (GCP) from the drop-down.

  2. Select Sign in to GCP.

  3. In the authentication dialog, sign in using your Google account.

  4. Review and grant the requested permissions.

After authentication, your GCP account is available for deployment.

Step 3: Configure the Connector deployment

To configure the Connector deployment, follow the steps below:

  1. Select the GCP Project where you want CloudConnexa to deploy the Connector.

  2. Select a network.

  3. Enter a VM Name.

  4. Select the Region and Zone for the Compute Engine VM.

  5. Select Deploy.

CloudConnexa creates the Compute Engine VM, installs the Connector software, and enables IP forwarding. Deployment typically takes several minutes.

Note

Google Cloud requires IP forwarding to be enabled on the Connector VM so it can route traffic between your VPC and CloudConnexa. This differs from AWS, which uses source/destination checks to control routing behavior.

Verify the Connector

Note

Deployment typically takes several minutes.

After deployment completes:

  1. If deployment succeeds, the Connector status displays as Connected.

  2. If deployment fails, CloudConnexa displays an error message so you can review and correct the deployment configuration.

Select Finish to complete the deployment.

Tutorial: Connect Your GCP VPC to CloudConnexa using IPsec

Abstract

Connect your Google Cloud VPC to CloudConnexa using GCP's built-in Classic VPN gateway and an IPsec site-to-site tunnel — no VM deployment required. Covers GCP VPN gateway setup, CloudConnexa tunnel configuration, and connectivity verification.

Overview

This tutorial shows how to connect your Google Cloud VPC to CloudConnexa using an IPsec site-to-site tunnel — without deploying a virtual machine in your GCP environment.

Unlike the connectors-based approach, IPsec uses GCP's built-in Classic VPN gateway to establish the tunnel. This means no virtual machine (VM) to manage, but it does require configuring the VPN on both the GCP side and in your CloudConnexa Administration portal. Once configured, a site-to-site IPsec tunnel connects your GCP VPC to the nearest CloudConnexa Region. Your CloudConnexa users — and any other networks connected to CloudConnexa — can then access resources in your VPC privately, without exposing them to the public internet.

Before you begin

Before configuring the IPsec connection, ensure you have the following:

  • A CloudConnexa account and Cloud ID.

  • Administrator access to your CloudConnexa Administration portal.

  • A Google Cloud project with billing enabled.

  • A Google Cloud VPC to connect to CloudConnexa.

  • Permissions to create Classic VPN gateways and related networking resources in your Google Cloud project.

Tip

For detailed Google Cloud prerequisites and permission requirements, see Google Cloud: Create a Classic VPN gateway.

Step 1: Configure the Network Connector in CloudConnexa

  2. Navigate to Networks.

  3. Select Add Network.

  4. Select the appropriate Network Scenario.

  5. Configure the network details.

  6. When prompted, select IPsec for your tunneling protocol.

  7. On the Configure Network Connector page, select GCP from Platform to Connect.

    • CloudConnexa displays the configuration values you need to create the corresponding VPN gateway and tunnel in Google Cloud.

  8. Review and copy the following values:

    • CloudConnexa Public IP Address: Select the available CloudConnexa public IP address from the list. You'll enter this value as the remote peer IP address when creating the Google Cloud VPN tunnel.

    • Remote Network IP Ranges: Copy the displayed IP ranges. These are the CloudConnexa-side networks that Google Cloud routes through the IPsec tunnel.

    • Local IP Ranges: Copy the displayed local ranges when present. These should correspond to the Google Cloud VPC subnet ranges that you configured for this Network.

    Tip

    Keep the CloudConnexa page open while you configure the Google Cloud side so you can copy these values into the corresponding Google Cloud fields.

  9. Review Set Up CloudConnexa Tunnel. Don't enter any values yet. You obtain them while configuring the Google Cloud VPN.

  10. Leave Advanced Configuration unchanged unless the Google Cloud VPN configuration requires different IPsec parameters.

  11. Open a new browser tab and sign in to the Google Cloud Console.

Step 2: Configure the Google Cloud VPN

  1. Sign in to the Google Cloud Console.

  2. Navigate to VPN.

  3. Select Create VPN connection.

  4. Select the VPN setup wizard.

  5. Select the Classic VPN option.

  6. Configure the VPN gateway:

    • Name: Enter the VPN gateway name.

      Important

      This can't be changed later.

    • Network: Select the VPC to connect.

    • Region: Select a Google Cloud region close to the CloudConnexa region.

    • IP address: Create or select a static external IP address.

  7. Configure the VPN tunnel:

    • Name: Enter a name.

    • Remote peer IP address: Copy the CloudConnexa Public IP Address from the Create GCP VPN section.

    • IKE Version: IKEv2.

    • IKE pre-shared key: Enter a strong pre-shared key. You'll enter the same key later in CloudConnexa.

      Tip

      You can refer to Google Cloud's documentation on generating a strong, 32-character pre-shared key: Generate a strong pre-shared key.

    • Routing options: Policy-based.

    • Remote network IP ranges: Copy the Remote Network IP Ranges from CloudConnexa.

    • Local IP ranges: Enter the subnet ranges for your Google Cloud VPC.

    • Select Done, then Create.

Step 3: Set up the CloudConnexa tunnel

  1. Return to the CloudConnexa Network Configuration Wizard.

  2. In Set Up CloudConnexa Tunnel, enter:

    • Google Engine VPN Gateway IP: The static external IP address assigned to your Google Cloud VPN gateway.

    • Pre-shared Key (PSK): The same key you configured in Google Cloud.

  3. Leave the Advanced Configuration settings at their default values unless your environment requires different IPsec parameters.

  4. Select Test Connection to test connectivity.

  5. Continue with the network wizard instructions.

In this section:
See also: