Managing VPN tunnels

Go to your VK Cloud personal account.

Select the project you need.

Go to Virtual networks → VPN.

A list of VPN tunnels will appear.

Click the name of a VPN tunnel.

A page with detailed information about it will open. Navigate between the page tabs to view information about IKE and IPsec settings, endpoint groups, and the tunnel. You can also edit the VPN tunnel settings on this page.

Go to your VK Cloud personal account.

Select the project you need.

Go to Virtual networks → VPN.

Click the Add VPN or Add button. The New VPN Tunnel Wizard opens.

Select the SDN in which the VPN will be created:

• SDN Neutron: VPN can only be connected to a standard router of Sprut or Neutron.
• SDN Sprut: VPN can only be connected to an advanced router.

Set up IKE:

1. IKE Policy — select an IKE policy from the dropdown list. If the desired policy does not exist, create a new one:

   1. Select New IKE Policy from the drop-down list.

   2. Set the policy settings:

      • Policy name.
      • Key lifetime (in seconds).
      • Authorization Algorithm — sha256 is recommended.
      • Encryption algorithm — aes256 is recommended.
      • IKE version — v2 is recommended.
      • Diffie-Hellman group — group14 is recommended.

2. Press the Next Step button.

Configure IPsec:

1. IPsec policy — select an IPsec policy from the drop-down list. If the desired policy does not exist, create a new one:

   1. Select New IPsec Policy from the drop-down list.

   2. Set the policy settings:

      • Policy name.
      • Key lifetime (in seconds).
      • Authorization Algorithm — it is recommended to select sha256.
      • Encryption algorithm — aes256 is recommended.
      • Diffie-Hellman group — it is recommended to select the group14 group.

2. Press the Next Step button.

Set up endpoint groups:

1. Router — select the router whose subnets should be accessible through the VPN tunnel. The available options depend on the selected SDN, and only include routers that are connected to an external network and have an assigned external IP address.

Select New endpoint group from the drop-down list.

1. Set the group settings:

   Neutron

   Sprut

   • Name — the name of a local endpoint group.
   • Subnets — select one or more subnets connected to the previously selected router. These subnets will be accessible through the VPN tunnel.

2. Remote Endpoint — select a remote endpoint group from the dropdown list. If the required group does not exist, create a new one:

   1. Select New endpoint group from the drop-down list.

   2. Set the group settings:

      • Group name.

      • Subnet address — address of the remote subnet that will be accessible through the VPN tunnel.

        If you need to add more subnets, click the Add subnet link.

3. Press the Next Step button.

Set up a VPN tunnel:

1. Specify basic settings:

   • Tunnel name.

   • Public IPv4 address of the peer (Peer IP).

   • Shared Key (PSK).

     If necessary, generate a key by clicking the corresponding button.

2. (Optional) Specify advanced settings:

   • Peer Router ID for Authentication (Peer ID) — by default matches the peer address.

   • (For VPN in Sprut SDN only) Селектор потоков траффика:

     • Объединить — do not split traffic selectors, that is, wrap all address prefixes in one data transmission tunnel.
     • Разделить — split traffic selectors, that is, create a separate data transmission tunnel for each pair of address prefixes.

   • Initiator State — behavior when establishing an IPsec connection:

     • bi-directional (default) — the VK Cloud platform will attempt to establish a connection with a remote peer.
     • response-only — the platform expects a VPN connection to be initiated by a remote peer and does not attempt to establish one on its own.

   • Settings for detecting the unavailability of a remote peer (Dead Peer Detection, DPD):

     • When a peer is unavailable — determines the behavior of the VK Cloud platform if a remote peer is unavailable:

       • hold (default) — When an unreachable IPsec connection is detected, the connection is terminated. The connection can only be re-established by a remote peer.
       • clear — When an unreachable IPsec connection is detected, the connection is terminated. The connection will not be re-established even if the remote peer attempts to do so.
       • restart — When an unreachable IPsec connection is detected, the connection is terminated. The VK Cloud platform will try to re-establish a connection with the remote peer.

     • Peer Downtime Detection Interval — at what interval (in seconds) to send test DPD messages.

     • Time to detect peer unavailable — if after this timeout (in seconds) no DPD check messages were received from a remote peer, then it is considered unavailable (dead).

       The default value for this setting is four times the Peer Downtime Detection Interval.

Click the Create VPN Tunnel button.

Go to your VK Cloud personal account.

Select the project you need.

Go to Virtual networks → VPN.

Expand the menu of the desired VPN tunnel and select Edit VPN.

If necessary, edit the local or remote endpoint group:

1. Local Endpoint — select a local endpoint group from the drop-down list. If the required group does not exist, create a new one:

   1. Select New endpoint group from the drop-down list.
   2. Set the group settings:
   Neutron

   Sprut

   • Name — the name of a local endpoint group.
   • Subnets — select one or more subnets connected to the previously selected router. These subnets will be accessible through the VPN tunnel.

2. Remote Endpoint — select a remote endpoint group from the dropdown list. If the required group does not exist, create a new one:

   1. Select New endpoint group from the drop-down list.

   2. Set the group settings:

      • Group name.

      • Subnet address — address of the remote subnet that will be accessible through the VPN tunnel.

        If you need to add more subnets, click the Add subnet link.

Press the Next Step button.

Edit the VPN tunnel settings:

1. Basic settings:

   • Tunnel name.

   • Public IPv4 address of the peer (Peer IP).

   • Shared Key (PSK).

     If necessary, generate a key by clicking the corresponding button.

2. (Optional) Аdvanced settings:

   • Peer Router ID for Authentication (Peer ID) — by default matches the peer address.

   • (For VPN in Sprut SDN only) Селектор потоков траффика:

     • Объединить — do not split traffic selectors, that is, wrap all address prefixes in one data transmission tunnel.
     • Разделить — split traffic selectors, that is, create a separate data transmission tunnel for each pair of address prefixes.

   • Initiator State — behavior when establishing an IPsec connection:

     • bi-directional (default) — the VK Cloud platform will attempt to establish a connection with a remote peer.
     • response-only — the platform expects a VPN connection to be initiated by a remote peer and does not attempt to establish one on its own.

   • Settings for detecting the unavailability of a remote peer (Dead Peer Detection, DPD):

     • When a peer is unavailable — determines the behavior of the VK Cloud platform if a remote peer is unavailable:

       • hold (default) — when an unreachable IPsec connection is detected, the connection is terminated. The connection can only be re-established by a remote peer.
       • clear — when an unreachable IPsec connection is detected, the connection is terminated. The connection will not be re-established even if the remote peer attempts to do so.
       • restart — when an unreachable IPsec connection is detected, the connection is terminated. The VK Cloud platform will try to re-establish the connection with the remote peer.

     • Peer Downtime Detection Interval — the interval (in seconds) at which to send DPD test messages.

     • Time to detect peer unavailable — if during this interval (in seconds) no DPD test messages were received from a remote peer, then it is considered unavailable (dead).

       The default value for this setting is four times the Peer Downtime Detection Interval.

Click the Save button.

Go to your VK Cloud personal account.

Select the project you need.

Go to Virtual networks → VPN.

Expand the menu of the desired VPN tunnel and select Remove VPN.

Review the list of objects to be deleted.

When deleting a VPN tunnel, the objects associated with it will also be deleted (if they are not used by other VPN tunnels):

• VPN service serving the tunnel;
• IKE policy and IPsec policy;
• local and remote endpoint groups.

Click the Confirm button.