Specify Global IPsec VPN Settings on an NSX Edge Gateway in the VMware Cloud Director Tenant Portal

Use the Global Configuration screen to configure IPsec VPN authentication settings at an edge gateway level. On this screen, you can set a global pre-shared key and enable certification authentication.

A global pre-shared key is used for those sites whose peer endpoint is set to any.

Prerequisites

• If you intend to enable certificate authentication, verify that you have at least one service certificate and corresponding CA-signed certificates in the Certificates screen. Self-signed certificates cannot be used for IPsec VPNs. See Add a Service Certificate to the Edge Gateway Using Your VMware Cloud Director Tenant Portal.
• Navigate to the IPsec VPN Screen on an NSX Data Center for vSphere Edge Gateway in the VMware Cloud Director Tenant Portal.

Procedure

1. Open Edge Gateway Services.
   1. In the top navigation bar, click Networking and click Edge Gateways.
   2. Select the edge gateway that you want to edit and click Services.
2. On the IPsec VPN tab, click Global Configuration.
3. (Optional) Set a global pre-shared key:
   1. Enable the Change Shared Key option.
   2. Enter a pre-shared key.
      The global pre-shared key (PSK) is shared by all the sites whose peer endpoint is set to any. If a global PSK is already set, changing the PSK to an empty value and saving it has no effect on the existing setting.
   3. (Optional) Optionally enable Display Shared Key to make the pre-shared key visible.
   4. Click Save changes.
4. Configure certification authentication:
   1. Turn on Enable Certificate Authentication.
   2. Select the appropriate service certificates, CA certificates, and CRLs.
   3. Click Save changes.

What to do next

You can optionally enable logging for the IPsec VPN service of the edge gateway. See Statistics and Logs for an NSX Data Center for vSphere Edge Gateway in the VMware Cloud Director Tenant Portal.