---
title: "Quickstart for configuring IPsec VPN through Transit VPC"
slug: "ipsecvpn-transitvpc-procedure"
updated: 2026-09-17T09:18:20Z
published: 2026-09-17T09:18:20Z
canonical: "guide.ncloud-docs.com/ipsecvpn-transitvpc-procedure"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart for configuring IPsec VPN through Transit VPC

Available in VPC

You can configure communication between an on-premise network and a VPC by setting up an IPsec VPN based on a Transit VPC.

The objectives of this configuration are as follows:

- Centralize IPsec VPN gateway configuration through a Transit VPC
- Enable expansion to multiple Service VPCs without changing VPN settings
- Deliver Service VPC ranges through route propagation

The following is a diagram of the Transit VPC-based IPsec VPN configuration. ![transit-vpc-ipsec-vpn_scenairo-01_ko](https://cdn.document360.io/6998976f-9d95-4df8-b847-d375892b92c2/Images/Documentation/transit-vpc-ipsec-vpn_scenairo-01_en.png?sv=2026-02-06&spr=https&st=2026-11-14T05%3A16%3A29Z&se=2026-11-14T06%3A16%3A29Z&sr=c&sp=r&sig=iZ7D2f4j%2BFzmtjlIVsEB1v0vUFnk38wRO2a1Tv%2F%2Fq2c%3D)

The overall sequence of this quickstart and the description of each step are as follows:

[1. Preparations](/docs/en/ipsecvpn-transitvpc-procedure#1%EC%82%AC%EC%A0%84%EC%A4%80%EB%B9%84) [2. Create VPC](/docs/en/ipsecvpn-transitvpc-procedure#2VPC%EC%83%9D%EC%84%B1) [3. Create subnets](/docs/en/ipsecvpn-transitvpc-procedure#3%EC%84%9C%EB%B8%8C%EB%84%B7%EC%83%9D%EC%84%B1) [4. Create VGW and VGW Group](/docs/en/ipsecvpn-transitvpc-procedure#4VGW%EB%B0%8FVGWGroup%EC%83%9D%EC%84%B1) [5. Create Transit VPC Connect](/docs/en/ipsecvpn-transitvpc-procedure#5TransitVPCConnect%EC%83%9D%EC%84%B1) [6. Create Endpoint Route Table](/docs/en/ipsecvpn-transitvpc-procedure#6EndpointRouteTable%EC%83%9D%EC%84%B1) [7. Configure Service VPC Route Table](/docs/en/ipsecvpn-transitvpc-procedure#7ServiceVPCRouteTable%EC%84%A4%EC%A0%95) [8. Create IPsec VPN gateway](/docs/en/ipsecvpn-transitvpc-procedure#8IPsecVPNGateway%EC%83%9D%EC%84%B1) [9. Create IPsec VPN tunnel](/docs/en/ipsecvpn-transitvpc-procedure#9IPsecVPNTunnel%EC%83%9D%EC%84%B1) [10. Configure customer network and perform communication test](/docs/en/ipsecvpn-transitvpc-procedure#10%EA%B3%A0%EA%B0%9D%EC%82%AC%EB%84%A4%ED%8A%B8%EC%9B%8C%ED%81%AC%EC%84%A4%EC%A0%95%EB%B0%8F%ED%86%B5%EC%8B%A0%ED%85%8C%EC%8A%A4%ED%8A%B8) [11. Operational precautions and inspection guide](/docs/en/ipsecvpn-transitvpc-procedure#11%EC%9A%B4%EC%98%81%EC%8B%9C%EC%A3%BC%EC%9D%98%EC%82%AC%ED%95%AD%EB%B0%8F%EC%A0%90%EA%B2%80%EA%B0%80%EC%9D%B4%EB%93%9C)

## 1. Preparations

The prerequisites required to perform this example are as follows:

- Permissions to create and configure VPC, Subnet, Route Table, IPsec VPN, and Virtual Private Gateway
- Review of IPsec VPN configuration policies

## 2. Create VPC

In the NAVER Cloud Platform console, create Transit-type and Normal-type VPCs according to the intended purpose. As an example in this quickstart, the values can be set as follows:

| VPC name | IPv4 CIDR | VPC type |
| --- | --- | --- |
| transit-vpc | 10.0.0.0/16 | TRANSIT |
| svc-vpc | 172.16.1.0/24 | NORMAL |

For detailed instructions, see:

- [Guide to creating VPC](/docs/en/vpc-manage-vpc)

              Caution

              

The VPC CIDR and On-premise CIDR must not overlap.

## 3. Create subnets

Create subnets within the created Transit VPC and Service VPC. As an example in this quickstart, the values can be set as follows:

| Subnet name | IPv4 CIDR |
| --- | --- |
| transit-subnet | 10.0.1.0/24 |
| svc-subnet | 172.16.1.0/24 |

For detailed instructions, see:

- [Guide to creating subnets](/docs/en/vpc-subnetmanage-vpc#subnet-%EC%83%9D%EC%84%B1)

## 4. Create VGW and VGW Group

Create Virtual Private Gateway (VGW) and VGW Group in the created Transit VPC for external connectivity.

- Create VGW
  - When creating, set the target VPC to the Transit VPC created above.
- Create VGW Group
  - When creating, set the target VGW to the VGW of the Transit VPC created above.
  - Only one VGW Group exists in a Transit VPC.

              Note

              

VPC establishes external connections (VPN, Cloud Connect) through a VGW Group.

For detailed instructions, see:

- [Guide to creating VGW and VGW Group](/docs/en/virtual-private-gateway-new#virtual-private-gateway-%EC%83%9D%EC%84%B1)

## 5. Create Transit VPC Connect

Connect Normal-type Service VPCs to the Transit VPC through Transit VPC Connect. As an example in this quickstart, the values can be set as follows:

- Connect Service VPC and Transit VPC

| Transit VPC Connect name | Normal VPC | Transit VPC |
| --- | --- | --- |
| transit-vpc-conn | svc-vpc | transit-vpc |

For detailed instructions, see:

- [Guide to creating Transit VPC Connect](/docs/en/vpc-transitvpcconnect-vpc#transit-vpc-connect-%EC%83%9D%EC%84%B1)

## 6. Create Endpoint Route Table

Create an Endpoint Route Table to control routing for ingress traffic entering the Transit VPC.

After creating the route table and enabling propagation, the Service VPC CIDR is propagated to the Transit VPC, and the Service VPC range can then be included in the Local CIDR of the IPsec VPN Tunnel.

As an example in this quickstart, the values can be set as follows:

| Endpoint Route Table name | Target VPC | Endpoint type | Destination | Target | Note |
| --- | --- | --- | --- | --- | --- |
| vgw-rt | transit-vpc | Virtual Private Gateway | 172.16.1.0/24 | Transit VPC Connect |  |
| transit-vpc-to-svc | transit-vpc | Transit VPC Connect | 172.16.30.0/24 | Virtual Private Gateway | Enable route propagation |

For detailed instructions, see:

- [Guide to creating Endpoint Route Table](/docs/en/vpc-endpointroutetable-vpc)

## 7. Configure Service VPC Route Table

Create a Service VPC Route Table so that traffic from the Service VPC to the On-premise network passes through the Transit VPC. As an example in this quickstart, the values can be set as follows:

| Target VPC | Route Table name | Destination | Target address | Associated subnet |
| --- | --- | --- | --- | --- |
| svc-vpc | svc-rt | Transit VPC Connect | 172.16.30.0/24 | svc-subnet |

For detailed instructions, see:

- [Guide to creating Route Table](/docs/en/networking-vpc-vpcdetailedroutetable)

## 8. Create IPsec VPN gateway

Create an IPsec VPN gateway based on the VGW Group of the Transit VPC. When creating, select the VGW Group of the Transit VPC created earlier as the connection target of the IPsec VPN gateway.

For detailed instructions, see:

- [Guide to creating IPsec VPN gateway](/docs/en/ipsecvpn-gateway-vpc)

## 9. Create IPsec VPN tunnel

Create an IPsec VPN tunnel to connect with the customer’s on-premise IPsec VPN device and define the communication ranges. As an example in this quickstart, the values can be set as follows during creation:

| Configuration item | Value | Note |
| --- | --- | --- |
| Target gateway | IPsec-gw | Created IPsec VPN gateway |
| Peer IP | Customer public IP | Public IP of the on-premise VPN device |
| Local CIDR | 10.0.0.0/16, 172.16.1.0/24 | Service VPC range |
| Remote CIDR | 172.16.30.0/24 | On-premise network range |

For detailed instructions, see:

- [Guide to creating IPsec VPN tunnel](/docs/en/ipsecvpn-tunnel-vpc)

## 10. Configure customer network and perform communication test

Complete the configuration of the customer’s on-premise device and test whether actual communication is established.

- On-premise routing configuration
  - On the customer VPN device, set the route for the Service VPC range to the IPsec VPN tunnel.
- Communication test
  - Service VPC → On-premise: Attempt a ping from a server in the Service VPC to an on-premise server (e.g., 172.16.30.x).
  - On-premise → Service VPC: Attempt a ping from an on-premise server to a Service VPC server (e.g., 172.16.1.x).

## 11. Operational precautions and inspection guide

For stable service operation, regularly inspect the configuration and refer to the guide below in case of failures.

| Issue | Check item |
| --- | --- |
| Tunnel DOWN, configuration error | Reachability of peer IP between VPN devices |
|  | Consistency of IPsec configuration policies |
|  | Review on-premise firewall/NAT policies |
|  | Enable route propagation in Endpoint Route Table |
| Tunnel UP, communication failure | CIDR overlap status |
|  | Apply Service VPC Route Table |
|  | Apply Endpoint Route Table |
|  | On-premise routing configuration |
|  | ACG / NACL policies |