You must configure at least one external IP address on NSX Edge to provide IPSec VPN service.


  1. Log in to the vSphere Web Client.
  2. Click Networking & Security and then click NSX Edges.
  3. Double-click an NSX Edge.
  4. Click the Manage tab and then click the VPN tab.
  5. Click IPSec VPN.
  6. Click the Add (add icon) icon.
  7. Type a name for the IPSec VPN.
  8. Type the IP address of the NSX Edge instance in Local Id. This will be the peer Id on the remote site.
  9. Type the IP address of the local endpoint.

    If you are adding an IP to IP tunnel using a pre-shared key, the local Id and local endpoint IP can be the same.

  10. Type the subnets to share between the sites in CIDR format. Use a comma separator to type multiple subnets.
  11. Type the Peer Id to uniquely identify the peer site. For peers using certificate authentication, this ID must be the common name in the peer's certificate. For PSK peers, this ID can be any string. VMware recommends that you use the public IP address of the VPN or a FQDN for the VPN service as the peer ID
  12. Type the IP address of the peer site in Peer Endpoint. If you leave this blank, NSX Edge waits for the peer device to request a connection.
  13. Type the internal IP address of the peer subnet in CIDR format. Use a comma separator to type multiple subnets.
  14. Select the Encryption Algorithm.
  15. In Authentication Method, select one of the following:



    PSK (Pre Shared Key)

    Indicates that the secret key shared between NSX Edge and the peer site is to be used for authentication. The secret key can be a string with a maximum length of 128 bytes.


    Indicates that the certificate defined at the global level is to be used for authentication.

  16. Type the shared key in if anonymous sites are to connect to the VPN service.
  17. Click Display Shared Key to display the key on the peer site.
  18. In Diffie-Hellman (DH) Group, select the cryptography scheme that will allow the peer site and the NSX Edge to establish a shared secret over an insecure communications channel.
  19. Change the MTU threshold if required.
  20. Select whether to enable or disable the Perfect Forward Secrecy (PFS) threshold. In IPsec negotiations, Perfect Forward Secrecy (PFS) ensures that each new cryptographic key is unrelated to any previous key.
  21. Click OK.

    NSX Edge creates a tunnel from the local subnet to the peer subnet.

What to do next

Enable the IPSec VPN service.