Tutorial: Connect AWS to CloudConnexa with IPsec using VPG⁠

This tutorial walks you through connecting your AWS VPC to CloudConnexa using an IPsec tunnel with a Virtual Private Gateway.

You'll complete steps in both the AWS Console and the Cloud Connexa Administration Portal. To make this easier to follow, each step is labeled with an icon:

☁️ AWS Console steps — performed in AWS
🔐 CloudConnexa steps — performed in CloudConnexa

To complete this setup, you'll configure:

A Customer Gateway to represent the CloudConnexa endpoint.
A Virtual Private Gateway attached to your VPC.
A site-to-site VPN connection between AWS and CloudConnexa.
Tunnel configuration using an AWS-generated configuration file.

Once configured, users and networks connected to CloudConnexa can securely access resources in your AWS VPC.

Before you begin⁠

Ensure you have a CloudConnexa account and Cloud ID.
Ensure you have access to your AWS account and VPC.
Ensure your VPC is created and properly configured, including routing and subnets.

🔐 Step 1: Create a Network (CloudConnexa)⁠

Sign in to your WPC's Administration portal by entering your Cloud ID in a web browser (for example, company_name.openvpn.com).
Navigate to Networks → Networks.
Click Add Network.
Select at least one Network Scenario. Refer to these tutorials for details:
Click Continue.
For the Network Configuration, enter a name and description (optional).
Select IPsec as the Connector Tunneling Protocol.
For the Connector, enter a name and description (optional).
Click Next.

🔐 Step 2: Select AWS as the platform (CloudConnexa)⁠

In the Network Configuration Wizard, you'll begin configuring your AWS VPC.

2.1 Select the AWS platform⁠

In Platform to Connect, select AWS. Refer to CloudConnexa Connectors and About Network Connectors.
Instructions will appear on how to configure IPsec connectivity with CloudConnexa.
Review the step-by-step guide.
Click Next.

2.2 Review AWS configuration details⁠

CloudConnexa displays the values required for AWS configuration.

Note the following values from AWS Configuration Details:
- CloudConnexa Public IP Address
  Note
  This is the CloudConnexa data center IP address, preselected for you. You can the selected option from the drop-down if desired. You can't change this after the connector is configured; you'll need to delete it and configure a new connector to use a different data center.
- Target Gateway
- Virtual Private Gateway / Transit Gateway
- Customer Gateway
- Routing Options
- Static IP Prefixes
You will use these values when configuring AWS resources.

☁️ Step 3: Configure AWS resources (AWS Console)⁠

Set up the required AWS components to establish the IPsec tunnel.

3.1 Create a Customer Gateway⁠

Create an AWS customer gateway as the IPsec endpoint for the CloudConnexa Region.

Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
Navigate to Customer gateways.
Click Create customer gateway.
Enter:
- Name tag (optional): This creates a tag with a Name key and the value that you specify.
- BGP ASN: Enter a Border Gateway Protocol Autonomous System Number (ASN) for your customer gateway.
  Note
  The IPsec VPN is going to use static routing. Therefore, the BGP ASN doesn't matter here. You can enter any number here.
- IP address: Use the CloudConnexa Public IP Address displayed for your network connector configuration.
(Optional) For Device, enter a name for the customer gateway device associated with this customer gateway.
Click Create customer gateway.

3.2 Create a Virtual Private Gateway⁠

To establish an IPsec VPN connection between your VPC and CloudConnexa, create an AWS target gateway. This target gateway will be a virtual private gateway.

Navigate to Virtual private gateways.
Click Create virtual private gateway.
(Optional) Enter a name.
Keep the default ASN.
Click Create.
Select the VPC, then click Actions → Attach to VPC.
Select your VPC and confirm.

3.3 (Optional) Enable route propagation⁠

Turn on route propagation on your AWS VPC route table if you want site-to-site connectivity between your VPC and other private networks connected to CloudConnexa.

Navigate to Route tables.
Select your route table associated with the subnet.
On the Route propagation tab, click Edit route propagation.
Select your new virtual private gateway.
Save changes.
Routes from your VPN connection are automatically added to the route table and directed to the virtual private gateway when the connection is active.

3.4 Allow CloudConnexa traffic in your Security Groups⁠

For CloudConnexa users and networks to reach resources in your VPC, the Security Groups attached to those resources (for example, EC2 instances and RDS databases) need an inbound rule that allows traffic from CloudConnexa. Without this rule, the tunnel shows Connected, but the resources don’t respond.

For each Security Group attached to a resource you want to reach over the tunnel:

Open the Amazon EC2 console and navigate to Security Groups.
Select the Security Group, then select the Inbound rules tab.
Select Edit inbound rules.
Select Add rule and configure:
- Type: The protocol and port your resource uses (for example, SSH or HTTPS), or All traffic.
- Source: Custom, then enter your WPC subnet (default: 100.96.0.0/11).
If you use Domain Routing, add a second rule with your Domain Routing subnet (default: 100.80.0.0/12) as the source.
Select Save rules.

3.5 Create the VPN connection⁠

Navigate to Site-to-Site VPN connections.
Click Create VPN connection.
Configure:
- Target gateway type: Select Virtual private gateway, and select the new virtual private gateway.
- Customer gateway: Select the newly created customer gateway.
- Routing options: Select Static.
For Static IP Prefixes, copy and paste the Static IP Prefixes displayed on the CloudConnexa Administration Portal's Connector Configuration page, as shown in AWS Configuration Details.
Note
The Static IP Prefixes include the Routes of all CloudConnexa Networks configured so far. If you add new Networks or Routes and want site-to-site networking with your VPC, you must update the Static IP Prefixes.
Click Create VPN connection.

3.6 Download the AWS configuration file⁠

Navigate to Site-to-Site VPN connections.
Select your new VPN connection.
Click Download configuration.
Select Generic for the customer gateway device.
Download the file.
Important
To properly load the download configuration screen from the AWS Management Console, ensure that your IAM role or user has permission for the following Amazon EC2 APIs: GetVpnConnectionDeviceTypes and GetVpnConnectionDeviceSampleConfiguration.

🔐 Step 4: Configure the Network Connector (CloudConnexa)⁠

In this step, configure the IPsec tunnels on the CloudConnexa side using the AWS configuration.

CloudConnexa supports two tunnels for high availability. You can configure them manually or upload the AWS configuration file.

4.1 Configure CloudConnexa tunnel⁠

Return to the CloudConnexa network wizard configuration to set up the CloudConnexa tunnel. Choose to upload a file or a manual configuration:

If you prefer, you can configure each tunnel manually using the values provided by AWS.

Expand Tunnel 1.
Enter the following:
- Connector Public IP Address: Enter the AWS tunnel endpoint IP address (from AWS configuration, Tunnel 1).
- Pre-shared Key (PSK): Enter the pre-shared key provided by AWS.
  Important
  You must specify a pre-shared key for each tunnel configuration.

(Optional) Configure advanced settings: Expand Advanced Configuration to customize IPsec parameters:

IKE Version: Select the version: IKEv1 or IKEv2.
Tip
If using IKEv2 and only GCM encryption algorithms (AES-128-GCM-16 and/or AES-256-GCM-16), the integrity algorithm and a DH group are optional in phase 2.
For non-GCM encryption algorithms, an integrity algorithm and a DH group are required. The default values are applied automatically.

Phase 1 settings:

Setting	Description
Encryption Algorithm	Select one or more supported encryption algorithms.
Integrity Algorithm	Select a supported integrity algorithm.
Diffie-Hellman Group	Select a DH group supported by your device.
Lifetime (sec)	Enter a value between 901 and 86400.

Phase 2 settings:

Setting	Description
Encryption Algorithm	Select one or more supported encryption algorithms.
Integrity Algorithm	Select a supported integrity algorithm.
Diffie-Hellman Group	Select a DH group supported by your device.
Lifetime (sec)	Enter a value between 900 and 28800.

IKE rekey settings:
Setting
Description
Rekey Margin Time (sec)
Value between 60 and half of Phase 2 lifetime.
Rekey Fuzz (%)
Value between 0 and 100.
Replay Window Size (packets)
Value between 64 and 2048.

Setting	Description
Rekey Margin Time (sec)	Value between 60 and half of Phase 2 lifetime.
Rekey Fuzz (%)	Value between 0 and 100.
Replay Window Size (packets)	Value between 64 and 2048.

Connection behavior:

Setting	Description
Startup Action	Controls which side initiates the IPsec tunnel. Start makes CloudConnexa initiate the connection; Attach waits for the remote peer to connect.
CloudConnexa Connection Restoration	Controls whether the tunnel automatically reconnects if interrupted: Defaults to Yes when Startup Action = Start. Automatically set to No when Startup Action = Attach and can't be changed.

Setting

Description

Startup Action

Controls which side initiates the IPsec tunnel. Start makes CloudConnexa initiate the connection; Attach waits for the remote peer to connect.

CloudConnexa Connection Restoration

Controls whether the tunnel automatically reconnects if interrupted:

Defaults to Yes when Startup Action = Start.
Automatically set to No when Startup Action = Attach and can't be changed.

(Optional but recommended) Expand Tunnel 2 and repeat the same configuration steps using AWS Tunnel 2 values.
Tip
Using both tunnels provides high availability and failover. Ensure you select different CloudConnexa data centers for the CloudConnexa Public IP Address to provide redundancy across data centers.

4.2 Verify connectivity⁠

Click Test Connection 1.
CloudConnexa attempts to establish a connection to your AWS network.
Check the connection status:
- Connected — The tunnel is successfully established.
- Offline — The connection failed or hasn't been established yet.
  Tip
  If the connection status is Offline:
  Click View Logs to review connection details.
  Verify the following:
  PSK matches on both sides.
  IPsec parameters (encryption, DH group, lifetimes) are aligned.
  Firewall rules allow IPsec traffic.
  The correct public IP address is configured.
Click Test Connection 2 (if configured).
Check the connection status:
- Connected — The tunnel is successfully established.
- Offline — The connection failed or hasn't been established yet.
  Tip
  If the connection status is Offline:
  Click View Logs to review connection details.
  Verify the following:
  PSK matches on both sides.
  IPsec parameters (encryption, DH group, lifetimes) are aligned.
  Firewall rules allow IPsec traffic.
  The correct public IP address is configured.

CloudConnexa attempts to establish a connection to your AWS network.

🔐 Step 5: Complete the Setup (CloudConnexa)⁠

Click Finish to complete the Network configuration.
Confirm that:
- The Network is created.
- The Connectors shows a Connected status.