How you can use VPN with a VPC hub-and-spoke structure

Share This Post

Website-to-site Virtual Private Network (VPN) has been used to attach distributed networks for many years. This submit describes easy methods to use a VPC VPN Gateway to attach an on-premises (enterprise) community to the IBM Cloud VPC in a transit hub-and-spoke structure:

VPN Gateway connectivity to a VPC transit hub and spoke.

Every spoke might be operated by a unique enterprise unit or staff. The staff can permit enterprise entry to VPC sources like Digital Service Cases operating functions or VPC RedHat OpenShift IBM Cloud clusters. Personal enterprise entry to VPE-enabled services, like databases, can also be doable by way of the VPN gateway. With this methodology, you possibly can benefit from the ease of use and elasticity of cloud sources and pay for simply what you want by accessing the sources securely over VPN.

The Centralize communication through a VPC Transit Hub and Spoke architecture tutorial was printed just a few months in the past. The companion GitHub repository was modified to optionally help a policy-mode VPC VPN gateway to interchange the IBM Direct Link simulation.

Multi-zone area (MZR) design

The transit hub design integrates with IBM multi-zone areas (MZRs), and the VPN Gateways are zone-specific. After some cautious research, the zonal structure proven beneath was applied. It exhibits solely two zones however might be expanded to 3:

VPN Gateway zonal connectivity.


  1. A VPN Gateway is related to every zone. Enterprise CIDR blocks are related to a selected cloud zone VPN Gateway. Discover the enterprise CIDR block is slender: The cloud CIDR block is broad, protecting your entire cloud (all VPCs and all zones):
  2. A VPC Tackle Prefix representing the enterprise zone is added to the transit VPC. See how phantom address prefix permit the spokes to route site visitors to the enterprise within the tutorial.
  3. A VPC ingress route desk is added to the transit VPC as described on this example. It can mechanically route all ingress site visitors from the spokes heading to the enterprise by way of the VPN gateway home equipment.

Observe the steps within the companion GitHub repository within the TLDR part. When modifying the config_tf/terraform.tfvars file, be sure the next variables are configured:


enterprise_phantom_address_prefixes_in_transit = true
vpn = true
firewall = false

Additionally think about setting make_redis = true to permit provisioning Redis cases for the transit and spoke with related Virtual Private Endpoint Gateway connections. If configured, even the personal Redis occasion within the spoke might be accessed from the enterprise. The small print of personal DNS configuration and forwarding are lined in this section of part 2 of the tutorial.

When the entire layers have been utilized, run the exams (see particular notes within the GitHub repository on configuring Python if wanted). All of the exams ought to cross:

python set up -r necessities.txt

A word on enterprise-to-transit cross-zone routing

The preliminary design labored properly for enterprise <> spokes. The enterprise <> transit throughout the identical zone additionally labored. However further configuration is required to resolve enterprise <> transit cross-zone routing failures:

VPN Gateway cross-zone routing.

With out the extra cross-zone VPN Gateway Connections, there have been no return VPC route desk entries within the default route desk within the transit VPC to the cross-zone enterprise (see the pink line). The VPN Gateway Connections mechanically add routes to the default route desk within the transit VPC however solely within the zones containing the VPN Gateway. Within the diagram above, the employee had no path to return to

The additional cross-zone connections for the transit VPC zones resolved this subject, as proven by the blue line.


Website-to-site VPN could be simply the know-how it’s good to join your enterprise to the IBM Cloud VPC in a multi-zone area. Utilizing the steps described on this submit, you possibly can decrease the variety of VPN Gateways required to completely join the enterprise to the cloud. Benefit from the personal connectivity to VPC sources like Digital Server Cases and sources from the catalog that may be accessed by way of a Digital Personal Endpoint Gateway.

Learn more about IBM Cloud VPC



Related Posts

- Advertisement -spot_img