---
title: 'Tutorial: Configure a Generic IPsec Tunnel From Your Private Network to CloudConnexa'
canonical: https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/ipsec/tutorial--configure-a-generic-ipsec-tunnel-from-your-private-network-to-cloudconnexa/
product: CloudConnexa Docs
description: Learn how to configure an IPsec tunnel between your private network and CloudConnexa, including authentication, advanced settings, and connectivity verification.
keywords: Generic IPsec
---

# Tutorial: Configure a Generic IPsec Tunnel From Your Private Network to CloudConnexa

This tutorial walks you through setting up an IPsec tunnel between your private network and CloudConnexa using an IPsec-compatible router or VPN service.

To complete this setup, you'll configure:

- A **Network in CloudConnexa** to represent your private network.
- A **Network Connector** configured for IPsec.
- Tunnel parameters such as:
  - Authentication (pre-shared key)
  - Encryption and IKE settings
  - Routing configuration
- Your **IPsec-compatible router or VPN service** using the provided configuration details.

After setup is complete, users and networks connected to CloudConnexa can securely access resources in your private network.

## Before you begin

- Ensure you have a [CloudConnexa account](https://openvpn.net/cloud-docs/owner/get-started/create-a-cloudconnexa-account.md) and Cloud ID.
- Ensure your network device supports IPsec (IKEv1 or IKEv2).
- Ensure you have access to your network router or VPN gateway configuration.

## Step 1: Create a Network in CloudConnexa

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Networks → Networks**.
3. Click **Add Network**.
4. Select at least one **Network Scenario**. Refer to these tutorials for details:
   - [Add a Network for remote access](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-remote-access-using-the-network-wizard.md)
   - [Add a Network for secure internet access](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access.md)
   - [Add a Network for secure internet access to select internet destinations](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-secure-internet-access-to-select-internet-destinations.md)
   - [Add a Network for site-to-site connectivity](https://openvpn.net/cloud-docs/owner/networks/networks---networks/add-a-network-for-site-to-site-connectivity.md)
5. Click **Continue**.
6. For the **Network Configuration**, enter a name and description (optional).
7. Select **IPsec** as the **Connector Tunneling Protocol**.
8. For the **Connector**, enter a name and description (optional).
9. Click **Next**.

## Step 2: Configure the Network Connector

In the **Configure Network Connector** step, configure the IPsec Network Connector:

1. **Configure the platform:** In **Platform to Connect**, select the device or platform.
   - Our example uses **Public Cloud Providers (IAAS): Other**.
2. In the **Set Up CloudConnexa Tunnel** section, configure the following:
   - For **CloudConnexa Public IP Address**, select a CloudConnexa data center IP address from the drop-down list. The list shows the IP addresses available in the region where the connector is being created, and one is preselected for you.

     > **Important**
     >
     > You can't change the selected public IP address after the connector is configured. To use a different data center, delete the connector and configure a new one.

     > **Tip**
     >
     > For a dual-tunnel configuration, select different CloudConnexa data centers for Tunnel 1 and Tunnel 2 to provide redundancy across data centers.
   - For **Connector Public IP Address**, enter the public IP address of your IPsec endpoint.
   - For **Pre-shared Key**, enter the pre-shared key (PSK), and a hostname and domain for the connector.
3. (**Optional**) **Configure advanced settings:** Expand **Advanced Configuration** to customize IPsec parameters:
   - **IKE Version:** Select the version: IKEv1 or IKEv2.

     > **Tip**
     >
     > If using **IKEv2** and only GCM encryption algorithms (AES-128-GCM-16 and/or AES-256-GCM-16), the integrity algorithm and a DH group are optional in phase 2.
     >
     > For non-GCM encryption algorithms, an integrity algorithm and a DH group are required. The default values are applied automatically.
   - **Phase 1 settings:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Encryption Algorithm** | Select one or more supported encryption algorithms. |
     | **Integrity Algorithm** | Select a supported integrity algorithm. |
     | **Diffie-Hellman Group** | Select a DH group supported by your device. |
     | **Lifetime (sec)** | Enter a value between **901 and 86400**. |
   - **Phase 2 settings:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Encryption Algorithm** | Select one or more supported encryption algorithms. |
     | **Integrity Algorithm** | Select a supported integrity algorithm. |
     | **Diffie-Hellman Group** | Select a DH group supported by your device. |
     | **Lifetime (sec)** | Enter a value between **900 and 28800**. |
   - **IKE rekey settings:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Rekey Margin Time (sec)** | Value between **60 and half of Phase 2 lifetime**. |
     | **Rekey Fuzz (%)** | Value between **0 and 100**. |
     | **Replay Window Size (packets)** | Value between **64 and 2048**. |
   - **Connection behavior:**

     | **Setting** | **Description** |
     | --- | --- |
     | **Startup Action** | Controls which side initiates the IPsec tunnel. Start makes CloudConnexa initiate the connection; Attach waits for the remote peer to connect. |
     | **CloudConnexa Connection Restoration** | Controls whether the tunnel automatically reconnects if interrupted: Defaults to **Yes** when Startup Action = **Start**. Automatically set to **No** when Startup Action = **Attach** and can't be changed. |

## Step 3: Review remote tunnel configuration

CloudConnexa provides configuration details required for your network router.

1. Locate the **Remote Tunnel Configuration** section.
2. Note the values provided for:
   - Firewall configuration.
   - IPsec tunnel parameters.
   - Connection initiation and restoration parameters.
   - Static routes.
   - DNS settings.
3. Keep this information available for configuring your router.

## Step 4: Configure your network router

1. Use the values from the **Remote Tunnel Configuration** section to configure your IPsec device.

## Step 5: Verify connectivity

After configuring both sides of the tunnel, verify that the connection is established.

1. In the **Verify Connectivity** section, click **Test Connection**.

   CloudConnexa attempts to establish a connection to your remote network.
2. Check the connection status:
   - **Connected** — The tunnel is successfully established.
   - **Offline** — The connection failed or hasn't been established yet.

     > **Tip**
     >
     > If the connection status is **Offline**:
     >
     > - Click **View Logs** to review connection details.
     > - Verify the following:
     >   - PSK matches on both sides.
     >   - IPsec parameters (encryption, DH group, lifetimes) are aligned.
     >   - Firewall rules allow IPsec traffic.
     >   - The correct public IP address is configured.

## Step 6: Complete the setup

1. Click **Finish** to complete the Network configuration.
2. Confirm that:
   - The Network is created.
   - The Connector shows a **Connected** status.

---

Prev: [IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/ipsec.md)
Next: [IaaS](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas.md)
Index: https://openvpn.net/cloud-docs/llms.txt