Extend your cloud and your options - creating a Virtual Private Network VPN connection between Open Telekom Cloud and DSI vCloud

Using the web interface (“service console”) of Open Telekom Cloud and the Web-Portal of DSI vCloud Director for quickly set up a secure Virtual Private Network Connection (VPN) through the Internet between Open Telekom Cloud and DSI vCloud in a self-service manner. Connect both “Cloud Worlds” together which brings a lot of advantages and agility for your IT.

Connecting means that Applications and Server are able to communicate through this “isolated Tunnel” in a secure way. This enables you to establish Disaster Recovery Concepts on Application Level or make use of Central Services e. g. located in DSI vCloud also accessible from Open Telekom Cloud.

Before Starting some info’s must be noticed, because the VPN’s needs info from the opposite environment:

Remote Gateway: <DSI vCloud Edge Gateway Internet IP chosen for VPN>
How to obtain Remote Gateway (External Network IP on Edge Gateway – Flexible Internet IP):
On Edge Gateway Services choose Tab VPN and click on “Configure Public IPs”. Choose an IP of Network vm-vl<xxxx>-dsi-vcd-inet-flex:

After getting the IP click “Cancel”!
Local Network: <private network(s) of vCloud which should be connected to VPN>

PSK/Shared Key:  <value containing an alphanumeric string between 32-128 in length> 
Best Practice: Use 128 for strong encryption.

Click “Virtual Private Cloud” in Section “Network” on Open Telekom Cloud console.
Click “VPNs” in Section “My resources”
Click “+ Create VPN”

VPC:                       <Choose Name of VPC on which VPN should be created>
Name:                    <Name of VPN>
PSK:                         <value containing an alphanumeric string between 32-128 in length>
Local Subnets:        <mark local OTC Subnet(s) which should be connected to VPN>
Remote Gateway: < External Network IP on DSI vCloud Edge Gateway – Flexible Internet IP>
Remote Subnets:    <DSI vCloud local Subnet(s) which should be accessible>

IKE Policy Parameters:
Authentication Algorithm:     sha1
Encryption Algorithm:           aes-256
DH Algorithm:                        group2
Version:                                  v1
Lifecycle (sec):                       86400

IPSec Policy Parameters:
Authentication Algorithm:     sha1
Encryption Algorithm:           aes-256
DH Algorithm:                        group2
Transfer Protocol:                  esp
Lifecycle:                                3600

After Confirmation with “Create Now” the VPN will be created:

After Creation the Status changes to “Not connected”.
Use also the refresh Button on the right side.
In the background all for VPN necessary Ports opened and NAT-Rules for the connection are created automatically.

Note also the Local Gateway of Open Telekom Cloud for use in DSI vCloud VPN Setting! 

Double-click the organization virtual datacenter name to open the organization virtual datacenter.
Click the Edge Gateways tab, right-click the edge gateway name and select Edge Gateway Services.
Click the VPN tab.
Click Add

Name:     <Name of VPN>
Description: <description>
Mark: “Enable this VPN configuration”
Estabilsh VPN to: a remote network

Local Networks: Mark all wanted local networks which should be connected to VPN

Peer Networks: Put in all local networks of Open Telekom Cloud  which should be connected.

Local Endpoint: Choose the “vm-vl<xxxx>-dsi-vcd-inet-flex” network
Local ID: Put in the local gateway IP of DSI vCloud
Peer ID: Put in the local gateway IP of Open Telekom Cloud

Peer IP: Put in the local gateway IP of Open Telekom Cloud

Encryption protocol: Choose “AES-256”
Shared Key: Put in Shared Key / PSK

MTU: 1500

Modify the settings as appropriate and click OK.
On next window click OK and the VPN on the Edge Gateway is configured and started.

After Creation check the VPN status:

After configuring the VPN Gateway of vCloud check the status on the Open Telekom Cloud VPN:

Now you can start to connect your Applications in a secure manner and more between Open Telekom Cloud and DSI vCloud.

Open Telekom Cloud and DSI vCloud offers a Self Service VPN. With an appropriate Setting these VPN endpoints and the networks behind can be connected together.

Creation of FW-Rules on Open Telekom Cloud and DSI vCloud so that only through the defined Ports connections can be established between both Clouds. After this new and already exiting Server and Applications can use the Connection.

Open Telekom Cloud Documentation
VMware vCloud Director 5.6 Dokumentationszentrum
VMware-Tutorial „Creating an IPsec VPN Connection“