---
title: "How to Set Up an IPsec Tunnel with NSX"
description: "Learn how to configure an IPsec tunnel with NSX."
url: https://docs.us.ovhcloud.com/en/hosted-private-cloud/vmware/set-up-ipsec-tunnel-nsx
lang: en
---
> For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt.

# How to Set Up an IPsec Tunnel with NSX

**Learn how to configure an IPsec tunnel with NSX.**

## Requirements

- Being the administrative contact for the [Hosted Private Cloud powered by VMware](https://us.ovhcloud.com/hosted-private-cloud/vmware/), and having received the connection credentials.
- An active user account with specific rights for NSX (created in the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/)).
- Having **NSX** deployed with two configured segments in your NSX configuration. Refer to our guide on [NSX segment management](https://docs.us.ovhcloud.com/en/hosted-private-cloud/vmware/nsx-segment-management.md) for more information.

## Instructions

Here is the tunnel we want to establish between two infrastructures:

From the NSX interface:

1. Go to the `Networking` tab.
2. Select `VPN` in the **Network Services** section.
3. Under the **VPN Services** tab, click on `ADD SERVICE`.
4. Select `IPSec`.

To set up your IPsec service:

1. Enter a name under **Name**.
2. Enter `ovh-T0-gw | Tier-0 Gateway` under **Tier-0/Tier-1 Gateway**.
3. Click `SAVE`.

Next, you need to specify the parameter type for the different IPSec stages. To do this, you will need to provide the IKE, IPSec, and DPD profiles (default profiles may already be provided).

From the NSX interface:

1. Go to the `Networking` tab.
2. Select `VPN` in the **Network Services** section.
3. Select the `Profiles` tab at the top of the page.
4. Click on `ADD IKE PROFILE`.

Provide the following information with your parameters:

- **Name**: Enter a name.
- **IKE Version**: Enter the IKE version.
- **Encryption Algorithm**: Choose the algorithm.
- **Digest Algorithm**: Choose the algorithm.
- **Diffie-Hellman**: Choose the group.

Then, click `SAVE`.

Next, while under the **Profiles** tab:

1. Choose `IPSec PROFILES`.
2. Click `ADD IPSEC PROFILE`.
3. Complete the IPSec information with the same parameters as the IKE Profile you just created.
4. Click `SAVE`.

Finally, while still under the **Profiles** tab:

1. Choose `DPD PROFILES`.
2. Click `ADD DPD PROFILE`.
3. Complete the DPD information with your parameters.
4. Click `SAVE`.

Next, you need to create a Local Endpoint.

From the NSX interface:

1. Go to the `Networking` tab.
2. Under **Network Services**, select `VPN`.
3. Then click the `Local Endpoint` tab.
4. Click `ADD LOCAL ENDPOINT`.

Complete the following information with your parameters:

- **Name**: Enter a name.
- **IPSec Service**: Select the previously created VPN service.
- **IP Address**: Select an available IP from your range of public IPs associated with the PCC.
- **Local ID**: Enter the local ID of the IPSec tunnel.

Finally, you need to complete the IPSec session configuration.

From the NSX interface:

1. Go to the `Networking` tab.
2. Under **Network Services**, select `VPN`.
3. Click the `IPSec Sessions` section.
4. Click `ADD IPSEC SESSION`.
5. Select `Policy Based`.

Complete the following information with your parameters:

- **Name**: Enter a name.
- **VPN Service**: Select the previously created VPN Service.
- **Local Endpoint**: Select the previously created Local Endpoint.
- **Remote IP**: Select the IP of the remote IPSec tunnel.
- **Authentication Mode**: Choose the authentication mode (e.g. PSK).
- **Pre-shared Key**: Enter the shared key for the IPSec tunnel.
- **Local Networks**: Enter the local networks to advertise.
- **Remote Networks**: Enter the remote networks to know.
- **Remote ID**: Enter the remote ID of the tunnel.

Select `Advanced Properties`.

Complete the following information with your parameters:

- **IKE Profiles**: The previously created IKE profile or default profiles.
- **IPSec Profiles**: The previously created IPSec profile or default profiles.
- **DPD Profiles**: The previously created DPD profile or default profiles.

Click `SAVE`.

If everything is properly configured on the other side, you should see a green "Success" status.

 

## Go further

Browse all the [VMware on OVHcloud guides](https://docs.us.ovhcloud.com/en/hosted-private-cloud/vmware/landing-page-vmware.md).

Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services.

Learn more about [VMware on OVHcloud](https://us.ovhcloud.com/hosted-private-cloud/vmware/) on the OVHcloud US website.

For more information and tutorials, please see [Getting Started with NSX](https://docs.us.ovhcloud.com/en/hosted-private-cloud/vmware/nsx-first-steps.md), [Segment Management in NSX](https://docs.us.ovhcloud.com/en/hosted-private-cloud/vmware/nsx-segment-management.md),  [VMware Documentation on NAT in NSX](https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-7AD2C384-4303-4D6C-A44A-DEF45AA18A92.html) or our other NSX support guides.