Configure IPSec VPN on VMware NSX

VMwareNSX

NSX edge supports site to site IPSec VPN to remote sites. You can configure multiple internal networks to connect to through the VPN tunnel. Subnets and internal networks behind the NSX edge must not have overlapping addresses. The size of the edge device determines the number of tunnels that are supported. The number of tunnels needed can be found out by using a simple equation of : “local subnets x peer subnets = number of tunnels needed”. Below is a chart taken from the NSX Administrator’s Guide outlining the number of IPSec tunnels that a edge device can handle depending on the size and also the supported algorithms.

 vpn01

To configure the IPSec VPN, first navigate to Networking & Security > NSX Edges > Double click your NSX edge > Manage > VPN > IPSec VPN. Click Change beside Global configuration status.

*Note* Mine already says Configured because I entered the PSK ahead of time

vpn02

Enter in the Pre-Shared Key. Optionally, you can select a certificate to be used for VPN authentication. Click OK.

vpn03

Click the green + to add a new IPSec VPN. Enter in the VPN information. Click OK.

vpn04

Click Start on the IPSec VPN Service. And Publish your changes. Next, move on to the remote site and repeat the process.

vpn05

Enter in the VPN info for the remote site. Click OK.

vpn06

Start the IPSec VPN service. Enter in the PSK and select the proper certificate under the Global configuration status. Publish your changes.
vpn07

Now if you click Show IPSec Statistics, you will see that the VPN tunnel is up.

vpn08

To test connectivity, I went to the console of one of my VMs that is at SiteA and did a ping and trace route to the VM at SiteB.

vpn09.png

*Note* Since I don’t have a true SiteA and SiteB, I mimicked this by having two ESGs connected to a DLR and letting the DLR simulate being a internet router.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s