---
title: 'Tutorial: Connect AWS VPC to CloudConnexa with IPsec using Transit Gateway'
canonical: https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-vpc-to-cloudconnexa-with-ipsec-using-transit-gateway/
product: CloudConnexa Docs
description: Configure an AWS Transit Gateway VPN between your VPC and CloudConnexa to enable scalable connectivity across multiple VPCs, including routing setup and tunnel configuration.
keywords: IPsec
---

# Tutorial: Connect AWS VPC to CloudConnexa with IPsec using Transit Gateway

This tutorial walks you through setting up an IPsec tunnel between your AWS environment and CloudConnexa using a Transit Gateway.

You'll complete steps in both the **AWS Console** and the **CloudConnexa Administration Portal**. To make this easier to follow, each step is labeled with an icon:

- ☁️ **AWS Console steps** — performed in AWS
- 🔐 **CloudConnexa steps** — performed in CloudConnexa

Use this configuration when you need connectivity across multiple VPCs, shared services, or internet-bound traffic through CloudConnexa.

To complete this setup, you'll configure:

- A **Transit Gateway** to act as a central routing hub.
- A **Transit Gateway attachment** to connect your VPC.
- A [site-to-site VPN connection between AWS](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html) and CloudConnexa.
- **Routing tables** for:
  - Your VPC subnets.
  - The Transit Gateway.
- (Optional) A **NAT Gateway** for internet-bound traffic from private subnets.
- Tunnel configuration using an AWS-generated configuration file.

Once configured, users and networks connected to CloudConnexa can securely access resources in your AWS environment.

## Overview

In this setup, AWS Transit Gateway acts as a central routing hub that connects:

- One or more VPCs.
- The [site-to-site VPN connection](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html).
- Additional network resources.

Compared to a virtual private gateway, a Transit Gateway supports broader and more flexible connectivity.

> **Tip**
>
> **When to use this setup**
>
> Use this configuration when you need connectivity across multiple VPCs or more advanced routing scenarios. If you only need a connection to a single VPC, refer to [Tutorial: Connect AWS to CloudConnexa with IPsec using VPG](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-to-cloudconnexa-with-ipsec-using-vpg.md).

## Before you begin

- Ensure you have a [CloudConnexa account](https://openvpn.net/cloud-docs/owner/get-started/create-a-cloudconnexa-account.md) and Cloud ID.
- Ensure your AWS VPC and subnets are configured.
- Ensure you have permissions to create AWS networking resources.

## 🔐 Step 1: Create a Network (CloudConnexa)

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Networks → Networks**.
3. Click **Add Network**.
4. Select at least one **Network Scenario**. Refer to these tutorials for details:
   - [Add a Network for remote access](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-remote-access-using-the-network-wizard.md)
   - [Add a Network for secure internet access](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access.md)
   - [Add a Network for secure internet access to select internet destinations](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access-to-select-internet-destinations.md)
   - [Add a Network for site-to-site connectivity](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity.md)
5. Click **Continue**.
6. For the **Network Configuration**, enter a name and description (optional).
7. Select **IPsec** as the **Connector Tunneling Protocol**.
8. For the **Connector**, enter a name and description (optional).
9. Click **Next**.

## 🔐 Step 2: Select AWS as the platform (CloudConnexa)

In the Network Configuration Wizard, you'll begin configuring your AWS VPC.

### 2.1 Select the AWS platform

1. In **Platform to Connect**, select **AWS**. Refer to [CloudConnexa Connectors](https://openvpn.net/cloud-docs/owner/get-started/about-cloudconnexa/cloudconnexa-connectors.md) and [About Network Connectors](https://openvpn.net/cloud-docs/owner/networks/networks---connectors/about-network-connectors.md).

   Instructions will appear on how to configure IPsec connectivity with CloudConnexa.
2. Review the step-by-step guide.
3. Click **Next**.

### 2.2 Review AWS configuration details

CloudConnexa displays the values required for AWS configuration.

1. Note the following values from **AWS Configuration Details**:
   - CloudConnexa Public IP Address

     > **Note**
     >
     > This is the CloudConnexa data center IP address, preselected for you. You can the selected option from the drop-down if desired. You can't change this after the connector is configured; you'll need to delete it and configure a new connector to use a different data center.
   - Target Gateway
   - Virtual Private Gateway / Transit Gateway
   - Customer Gateway
   - Routing Options
   - Static IP Prefixes
2. You will use these values when configuring AWS resources.

## ☁️ Step 3: Configure AWS resources (AWS Console)

Set up the AWS components required for Transit Gateway-based VPN connectivity.

### 3.1 Create a Transit Gateway

1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/).
2. Navigate to **Transit Gateways**.
3. Click **Create transit gateway**.
4. Configure settings as needed.
5. Click **Create transit gateway**.

### 3.2 Create a site-to-site VPN connection

1. Navigate to **Site-to-Site VPN connections**.
2. Click **Create VPN connection**.
3. Configure:
   - **Target gateway type:** Select **Transit gateway**, and select the new transit gateway.
   - **Customer gateway:** Select **New**, and enter CloudConnexa values.
   - **Routing options:** Select **Static**.
4. For **Static IP Prefixes**, copy and paste the Static IP Prefixes displayed on the CloudConnexa Administration Portal's Connector Configuration page, as shown in **AWS Configuration Details**.

   > **Note**
   >
   > The Static IP Prefixes include the Routes of all CloudConnexa Networks configured so far. If you add new Networks or Routes and want site-to-site networking with your VPC, you must update the Static IP Prefixes.
5. Click **Create VPN connection**.

### 3.3 Attach your VPC to the Transit Gateway

1. Navigate to **Transit Gateway attachments**.
2. Click **Create transit gateway attachment**.
3. Select the new transit gateway for the **Transit gateway ID**.
4. Configure your transit gateway attachment as needed for your VPC and subnets.
5. Click **Create transit gateway attachment**.

### 3.4 Create a NAT Gateway (for internet-bound traffic)

1. Navigate to **NAT gateways**.
2. Click **Create NAT gateway**.
3. Configure the NAT gateway for your VPC and associate it with an Elastic IP.
4. Click **Create NAT gateway**.

### 3.5 Configure VPC route tables

**Configure the private subnet route table**

This route table is used by resources that don't have direct internet access.

1. Navigate to **Route tables**.
2. Select the route table associated with your **private subnet**.
3. Click **Edit routes**.
4. Add the following routes:
   - **Destination:**`0.0.0.0/0` → **Target:** NAT Gateway
   - **Destination:** `100.96.0.0/11` → WPC Subnet **Target:** Transit Gateway

     > **Note**
     >
     > This is the default [WPC Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-tunnel-ip-addresses.md) value. You can configure this under **Settings → WPC** in the CloudConnexa admin portal.
   - **Destination:** `100.80.0.0/12` → Domain Routing Subnet **Target:** Transit Gateway

     > **Note**
     >
     > This is the default [Domain Routing Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-domain-routing-ip-addresses.md) value. You can configure this under **Settings → WPC** in the CloudConnexa admin portal.
5. Click **Save changes**.

**Configure the public subnet route table**

This route table is used by resources that can access the internet directly.

1. Navigate to **Route tables**.
2. Select the route table associated with your **public subnet**.
3. Click **Edit routes**.
4. Ensure the following routes are present:
   - **Destination:** `100.96.0.0/11` → WPC Subnet **Target:** Transit Gateway

     > **Note**
     >
     > This is the default [WPC Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-tunnel-ip-addresses.md) value. You can configure this under **Settings → WPC** in the CloudConnexa admin portal.
   - **Destination:** `100.80.0.0/12` → Domain Routing Subnet **Target:** Transit Gateway

     > **Note**
     >
     > This is the default [Domain Routing Subnet](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-domain-routing-ip-addresses.md) value. You can configure this under **Settings → WPC** in the CloudConnexa admin portal.
5. Click **Save changes**.

> **Tip**
>
> The public subnet typically has a route to an Internet Gateway for internet access. You don't need to modify this configuration for CloudConnexa connectivity.

### 3.6 Configure Transit Gateway route table

1. Navigate to **Transit gateway route tables**.
2. Click on the route table for your new transit gateway.
3. Click the **Routes** tab.
4. Create the following static routes:
   - `0.0.0.0/0` (default route, points to the VPC resource)
   - `100.96.0.0/11` (WPC subnet, points to the VPN resource)
   - `100.80.0.0/12` (Domain routing subnet, points to the VPN resource)

### 3.7 Allow CloudConnexa traffic in your Security Groups

For CloudConnexa users and networks to reach resources in your VPC, the Security Groups attached to those resources (for example, EC2 instances and RDS databases) need an inbound rule that allows traffic from CloudConnexa. Without this rule, the tunnel shows Connected, but the resources don’t respond.

For each Security Group attached to a resource you want to reach over the tunnel:

1. Open the Amazon EC2 console and navigate to **Security Groups**.
2. Select the Security Group, then select the **Inbound rules** tab.
3. Select **Edit inbound rules**.
4. Select **Add rule** and configure:
   - **Type:** The protocol and port your resource uses (for example, SSH or HTTPS), or **All traffic**.
   - **Source:** **Custom**, then enter your WPC subnet (default: `100.96.0.0/11`).
5. If you use Domain Routing, add a second rule with your Domain Routing subnet (default: `100.80.0.0/12`) as the source.
6. Select **Save rules**.

> **Note**
>
> These are the default subnet values. If you changed them, use the values shown under **Settings → WPC** in the CloudConnexa Administration portal.

> **Tip**
>
> For tighter security, allow only the protocols and ports your resources need instead of **All traffic**.

### 3.8 Download the AWS configuration file

1. Navigate to **Site-to-Site VPN connections**.
2. Select your new VPN connection.
3. Click **Download configuration**.
4. Select **Generic** for the customer gateway device.
5. Download the file.

   > **Important**
   >
   > To properly load the download configuration screen from the AWS Management Console, ensure that your IAM role or user has permission for the following Amazon EC2 APIs: `GetVpnConnectionDeviceTypes` and `GetVpnConnectionDeviceSampleConfiguration`.

## 🔐 Step 4: Configure the Network Connector (CloudConnexa)

In this step, configure the IPsec tunnels on the CloudConnexa side using the AWS configuration.

CloudConnexa supports two tunnels for high availability. You can configure them manually or upload the AWS configuration file.

### 4.1 Configure CloudConnexa tunnel

Return to the **CloudConnexa** network wizard configuration to set up the CloudConnexa tunnel. Choose to upload a file or a manual configuration:

#### Option 1: Upload AWS configuration file (recommended)

1. Click **Upload Generic Configuration File**.
2. Select the configuration file downloaded from AWS.

   CloudConnexa automatically populates the tunnel settings.

> **Note**
>
> AWS creates two tunnels by default. CloudConnexa creates two corresponding Connectors.

#### Option 2: Configure tunnels manually

If you prefer, you can configure each tunnel manually using the values provided by AWS.

1. Expand **Tunnel 1**.
2. Enter the following:
   - **Connector Public IP Address:** Enter the AWS tunnel endpoint IP address (from AWS configuration, Tunnel 1).
   - **Pre-shared Key (PSK):** Enter the pre-shared key provided by AWS.

     > **Important**
     >
     > You must specify a pre-shared key for each tunnel configuration.
3. (**Optional**) **Configure advanced settings:** Expand **Advanced Configuration** to customize IPsec parameters:
   - **IKE Version:** Select the version: IKEv1 or IKEv2.

     > **Tip**
     >
     > If using **IKEv2** and only GCM encryption algorithms (AES-128-GCM-16 and/or AES-256-GCM-16), the integrity algorithm and a DH group are optional in phase 2.
     >
     > For non-GCM encryption algorithms, an integrity algorithm and a DH group are required. The default values are applied automatically.
   - **Phase 1 settings:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Encryption Algorithm** | Select one or more supported encryption algorithms. |
     | **Integrity Algorithm** | Select a supported integrity algorithm. |
     | **Diffie-Hellman Group** | Select a DH group supported by your device. |
     | **Lifetime (sec)** | Enter a value between **901 and 86400**. |
   - **Phase 2 settings:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Encryption Algorithm** | Select one or more supported encryption algorithms. |
     | **Integrity Algorithm** | Select a supported integrity algorithm. |
     | **Diffie-Hellman Group** | Select a DH group supported by your device. |
     | **Lifetime (sec)** | Enter a value between **900 and 28800**. |
   - **IKE rekey settings:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Rekey Margin Time (sec)** | Value between **60 and half of Phase 2 lifetime**. |
     | **Rekey Fuzz (%)** | Value between **0 and 100**. |
     | **Replay Window Size (packets)** | Value between **64 and 2048**. |
   - **Connection behavior:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Startup Action** | Controls which side initiates the IPsec tunnel. Start makes CloudConnexa initiate the connection; Attach waits for the remote peer to connect. |
     | **CloudConnexa Connection Restoration** | Controls whether the tunnel automatically reconnects if interrupted: Defaults to **Yes** when Startup Action = **Start**. Automatically set to **No** when Startup Action = **Attach** and can't be changed. |
4. (**Optional but recommended**) Expand **Tunnel 2** and repeat the same configuration steps using AWS Tunnel 2 values.

   > **Tip**
   >
   > Using both tunnels provides high availability and failover. Ensure you select different CloudConnexa data centers for the CloudConnexa Public IP Address to provide redundancy across data centers.

### 4.2 Verify connectivity

1. Click **Test Connection 1**.

   CloudConnexa attempts to establish a connection to your AWS network.
2. Check the connection status:
   - **Connected** — The tunnel is successfully established.
   - **Offline** — The connection failed or hasn't been established yet.

     > **Tip**
     >
     > If the connection status is **Offline**:
     >
     > - Click **View Logs** to review connection details.
     > - Verify the following:
     >   - PSK matches on both sides.
     >   - IPsec parameters (encryption, DH group, lifetimes) are aligned.
     >   - Firewall rules allow IPsec traffic.
     >   - The correct public IP address is configured.
3. Click **Test Connection 2** (if configured).
4. Check the connection status:
   - **Connected** — The tunnel is successfully established.
   - **Offline** — The connection failed or hasn't been established yet.

     > **Tip**
     >
     > If the connection status is **Offline**:
     >
     > - Click **View Logs** to review connection details.
     > - Verify the following:
     >   - PSK matches on both sides.
     >   - IPsec parameters (encryption, DH group, lifetimes) are aligned.
     >   - Firewall rules allow IPsec traffic.
     >   - The correct public IP address is configured.

CloudConnexa attempts to establish a connection to your AWS network.

> **Tip**
>
> If both tunnels show **Connected** but you still can't reach resources in your VPC, the Security Groups on those resources are most likely missing the inbound rule for your WPC subnet. Refer to the previous step to allow CloudConnexa traffic in your Security Groups.

## 🔐 Step 5: Complete the Setup (CloudConnexa)

1. Click **Finish** to complete the Network configuration.
2. Confirm that:
   - The Network is created.
   - The Connectors shows a **Connected** status.

## Related Resources

- [Configure a Generic IPsec Tunnel From Your Private Network to CloudConnexa](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/ipsec/tutorial--configure-a-generic-ipsec-tunnel-from-your-private-network-to-cloudconnexa.md)
- [Connect Your Cisco Router to CloudConnexa with IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/routers/tutorial--connect-your-cisco-router-to-cloudconnexa-with-ipsec.md)
- [Connect AWS VPC to CloudConnexa with IPsec using Transit Gateway](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-vpc-to-cloudconnexa-with-ipsec-using-transit-gateway.md)
- [Connect AWS to CloudConnexa with IPsec using VPG](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-to-cloudconnexa-with-ipsec-using-vpg.md)
- [Connect Azure to CloudConnexa with IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-azure-to-cloudconnexa-with-ipsec.md)
- [Connect Your GCP VPC to CloudConnexa using IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-your-gcp-vpc-to-cloudconnexa-using-ipsec.md)
- [Video: Configure an IPsec connection to your AWS VPC](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-aws-vpc.md)
- [Video: Configure an IPsec connection to your AWS VPC using Transit Gateway](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-aws-vpc-using-transit-gateway.md)
- [Video: Configure an IPsec connection to your Azure VNet](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-azure-vnet.md)
- [Video: Configure an IPsec connection to your GCP VPC](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-gcp-vpc.md)

---

Prev: [Tutorial: Connect AWS to CloudConnexa with IPsec using VPG](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-to-cloudconnexa-with-ipsec-using-vpg.md)
Next: [Tutorial: Assign DNS servers using DHCP for AWS VPC](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--assign-dns-servers-using-dhcp-for-aws-vpc.md)
Index: https://openvpn.net/cloud-docs/llms.txt