Quickstart for configuring IPsec VPN through Transit VPC

Available in VPC

You can configure communication between an on-premise network and a VPC by setting up an IPsec VPN based on a Transit VPC.

The objectives of this configuration are as follows:

• Centralize IPsec VPN gateway configuration through a Transit VPC
• Enable expansion to multiple Service VPCs without changing VPN settings
• Deliver Service VPC ranges through route propagation

The following is a diagram of the Transit VPC-based IPsec VPN configuration.

The overall sequence of this quickstart and the description of each step are as follows:

1. Preparations
2. Create VPC
3. Create subnets
4. Create VGW and VGW Group
5. Create Transit VPC Connect
6. Create Endpoint Route Table
7. Configure Service VPC Route Table
8. Create IPsec VPN gateway
9. Create IPsec VPN tunnel
10. Configure customer network and perform communication test
11. Operational precautions and inspection guide

1. Preparations

The prerequisites required to perform this example are as follows:

• Permissions to create and configure VPC, Subnet, Route Table, IPsec VPN, and Virtual Private Gateway
• Review of IPsec VPN configuration policies

2. Create VPC

In the NAVER Cloud Platform console, create Transit-type and Normal-type VPCs according to the intended purpose.
As an example in this quickstart, the values can be set as follows:

For detailed instructions, see:

• Guide to creating VPC

3. Create subnets

Create subnets within the created Transit VPC and Service VPC.
As an example in this quickstart, the values can be set as follows:

For detailed instructions, see:

• Guide to creating subnets

4. Create VGW and VGW Group

Create Virtual Private Gateway (VGW) and VGW Group in the created Transit VPC for external connectivity.

• Create VGW
  • When creating, set the target VPC to the Transit VPC created above.
• Create VGW Group
  • When creating, set the target VGW to the VGW of the Transit VPC created above.
  • Only one VGW Group exists in a Transit VPC.

For detailed instructions, see:

• Guide to creating VGW and VGW Group

5. Create Transit VPC Connect

Connect Normal-type Service VPCs to the Transit VPC through Transit VPC Connect.
As an example in this quickstart, the values can be set as follows:

• Connect Service VPC and Transit VPC

For detailed instructions, see:

• Guide to creating Transit VPC Connect

6. Create Endpoint Route Table

Create an Endpoint Route Table to control routing for ingress traffic entering the Transit VPC.

After creating the route table and enabling propagation, the Service VPC CIDR is propagated to the Transit VPC, and the Service VPC range can then be included in the Local CIDR of the IPsec VPN Tunnel.

As an example in this quickstart, the values can be set as follows:

For detailed instructions, see:

• Guide to creating Endpoint Route Table

7. Configure Service VPC Route Table

Create a Service VPC Route Table so that traffic from the Service VPC to the On-premise network passes through the Transit VPC. As an example in this quickstart, the values can be set as follows:

For detailed instructions, see:

• Guide to creating Route Table

8. Create IPsec VPN gateway

Create an IPsec VPN gateway based on the VGW Group of the Transit VPC.
When creating, select the VGW Group of the Transit VPC created earlier as the connection target of the IPsec VPN gateway.

For detailed instructions, see:

• Guide to creating IPsec VPN gateway

9. Create IPsec VPN tunnel

Create an IPsec VPN tunnel to connect with the customer’s on-premise IPsec VPN device and define the communication ranges.
As an example in this quickstart, the values can be set as follows during creation:

For detailed instructions, see:

• Guide to creating IPsec VPN tunnel

10. Configure customer network and perform communication test

Complete the configuration of the customer’s on-premise device and test whether actual communication is established.

• On-premise routing configuration
  • On the customer VPN device, set the route for the Service VPC range to the IPsec VPN tunnel.
• Communication test
  • Service VPC → On-premise: Attempt a ping from a server in the Service VPC to an on-premise server (e.g., 172.16.30.x).
  • On-premise → Service VPC: Attempt a ping from an on-premise server to a Service VPC server (e.g., 172.16.1.x).

11. Operational precautions and inspection guide

For stable service operation, regularly inspect the configuration and refer to the guide below in case of failures.