Site-to-Site VPN tunnel connection

Updated: July 8, 2026

Create secure site-to-site VPN tunnels using Multicloud Defense to connect networks across locations. Connect to AWS, Azure, GCP, ASA, or FTD devices. Configure and manage encrypted connections for optimal VPN protection.

A site-to-site VPN tunnel connects networks in different geographic locations. You can create site-to-site IPsec connections between two different Multicloud Defense Gateways or between a Multicloud Defense Gateway and a cloud service provider that complies with all relevant standards.

After the VPN connection is established, the hosts behind the local gateway can connect to the hosts behind the remote gateway through the secure VPN tunnel.

Typically, the dynamic peer must initiate the connection, as the other peer does not know the IP address of the dynamic peer. When the remote peer attempts to establish the connection, the other peer validates the connection using the preshared key, IKE settings, and IPsec configurations.

Because the VPN connection is established only after the remote peer initiates the connection, any outbound traffic that matches access control rules allowing traffic in the VPN tunnel drops until the connection establishes. This ensures that data will not leave your network without the appropriate encryption and VPN protection in place.

At this time, Multicloud Defense supports site-to-site VPN tunnel connections with these platforms or products:

AWS
Azure
GCP
ASA device
FTD device
Extranet or a third-party firewall

Prerequisites and limitations for Site-to-Site VPN tunnels

Review supported endpoints, prerequisites, and limitations before creating site-to-site VPN tunnel connections with Cisco Multicloud Defense gateways.

Enable VPN within the gateway

Enable VPN support on a Cisco Multicloud Defense gateway and assign a BGP profile before creating a site-to-site tunnel connection.

Create a Site-to-Site VPN connection

Create a site-to-site VPN tunnel between a Cisco Multicloud Defense gateway and a supported cloud platform, Cisco device, or third-party firewall.

Edit a Site-to-Site VPN tunnel

Edit the endpoints, virtual interface addresses, authentication values, or IPSec profiles for an existing Cisco Multicloud Defense site-to-site VPN tunnel.

Clone a Site-2-Site VPN tunnel connection

Clone an existing site-to-site VPN tunnel connection in Cisco Multicloud Defense and update its endpoints, IP addresses, profile, or authentication value.

Delete a VPN tunnel connection

Delete a site-to-site VPN tunnel connection from Cisco Multicloud Defense and remove associated BGP profiles when they are no longer needed.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.