Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

How to setup a VPN connection between CGW and MGW (56149)

Last Updated: 6/13/2018Categories: Total Views: 3241Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

After deploying the VMware cloud on AWS SDDC we want to have a connectivity between our Management components and Workload VMs. To achieve this we will have to setup a VPN connection between compute gateway and management gateway.

Solution

This is a two way process like any other ipsec VPN connection.

1) We need to setup an IPsec VPN from Management to Compute by supplying the CGW public IP as remote
gateway.
2) In the second step we will create an IPsec VPN  from Compute to Management by supplying MGW public IP as
remote gateway.

Steps to perform these actions.

IPsec VPN from Management to Compute

1) Login to vmc.vmware.com
2) from SDDC section open the desired SDDC on which you want to setup the VPN
3) Click on the network tab
4) From the network diagram note down the Public IP mentioned for Compute Gateway
5) Expand IPsec VPNs section in Management Gateway
6) Click on ADD VPN
7) Fill in the details

VPN Name - Any name of your choice

Status - It will Auto populate once we save the settings

Remote Gateway Public IP - Enter the CGW public IP we recorded in step 4

Remote Gateway Private IP - For this setup we should leave it blank

Remote Networks : Enter the CIDR of the workload VMs which will be contacting the management workload (CIDR of Logical Network, you can enter multiple CIDR by separating them with comma)

Local Gateway IP - This should auto-populate the public IP of MGW

Local Network - It will auto-populate the CIDR of Management network once you save

Encryption -  Usually AES 256  (you can choose others as well)

Perfect Forward Secrecy - Enabled

Diffie Hellman - Choose any one of your preference

IKE Version - Choose any one of your preference

SHA Version - Choose any one of your preference

Pre-Shared Key -  Enter a Pre-Shared key of your choice

After these details are entered we can click on save to save these settings in Management Gateway section

8) Now go back to the network diagram and record the Public IP mentioned for Management Gateway & CIDR of appliance subnet.
9) scroll down till Compute Gateway section
10) Expand IPsec VPNs section
11) Click on ADD VPN
12) Fill in the Details

VPN Name - Any name of your choice

Status - It will Auto populate once we save the settings

Remote Gateway Public IP - Enter the MGW public IP we recorded in step 8

Remote Gateway Private IP - For this setup we should leave it blank

Remote Networks : Enter the CIDR of appliance Subnet recorded in step 8

Local Gateway IP - This should auto-populate the public IP of CGW

Local Network - Choose the network that should have access to the management components (and it should be same network what we specified in "Remote Network" section while creating Management gateway IPsec VPN.

Encryption -  It Should be Same as MGW IPsec VPN

Perfect Forward Secrecy - Enabled

Diffie Hellman - It Should be Same as MGW IPsec VPN

IKE Version - It Should be Same as MGW IPsec VPN

SHA Version - It Should be Same as MGW IPsec VPN

Pre-Shared Key - It Should be Same as MGW IPsec VPN

13) Click on Save and wait for the configuration gets saved.
14) If you see the IPsec VPN status as disconnected click on refresh button next to the status for both the IPsec VPN (MGW and CGW)

Note : If after refreshing you see that the VPN status is showing as partially connected please verify all the settings and specially match those which should be same in both CGW and MGW IPsec VPN.

Even after setting these IPsec VPNs you may not be able to ping vCenter private IP or access the vCenter URL because you will have to open the firewall ports for these 2 connections.

You can check following links on how to open firewall rules.

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.getting-started/GUID-0420393D-34CD-48B5-BC61-04100D04852A.html

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.getting-started/GUID-0E66C9C8-C260-4056-8511-44818431110C.html

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Cloud on AWS

Related Versions:

Take Our Survey

Support Assistant