Cisco Multicloud Defense User Guide

PDF

Cisco Multicloud Defense User Guide

Create a Site-to-Site VPN connection

Updated: July 8, 2026

Want to summarize with AI?

Log in

Create a site-to-site VPN tunnel between a Cisco Multicloud Defense gateway and a supported cloud platform, Cisco device, or third-party firewall.

This procedure guides you through creating a site-to-site VPN tunnel connection between your gateway and an ASA device, Azure, AWS, and GCP cloud service providers or even a third party firewall of your choice.

Note

When entering the virtual interface IP address, use an IP from the range 169.254.xx/16, excluding the threat defense reserved range 169.254.1.x/24. For the net mask, use /30; this arrangement allows the use of only two IP addresses for the endpoints of the virtual tunnel interface. For example, 169.254.100.1/30.

Follow this procedure to create an site-to-site VPN tunnel using the Multicloud Defense Controller dashboard:

Before you begin

You must have at least one IPSec profile already created prior to creating a VPN connection tunnel.

It is strongly recommended to create a BGP profile and link it to your Multicloud Defense Gateway before you create a VPN tunnel connection. For more information, refer to BGP Profile.

Procedure

  1. Navigate to Infrastructure > Network > VPN Connections.

  2. Click Create VPN Connection.

  3. Enter a Name for the connection.

  4. Expand the Device 1 drop-down menu to select a Multicloud Defense Gateway or manually enter a public IP address of a remote endpoint.

  5. Enter the Device 1 Virtual Interface IP address. For guidance on how to optimize this field, refer to the Note.

  6. Expand the Device 2 drop-down menu to select your Multicloud Defense Gateway or manually enter a public IP address of a remote endpoint. Use different devices or gateways for Device 1 and Device 2.

  7. Enter the Device 2 Virtual Interface IP address. Refer to the Note for guidance on how to optimize this field.

  8. Enter the Authentication Value for the tunnel. Use PreShared Key as the preferred authentication method.

  9. Expand the IPSec Profile drop-down menu to select a profile that has already been created.

  10. Click Save.

View and verify the connection status by assessing the byte statistics for both connection ends.

What to do next

To associate a BGP profile with your VPN tunnel connection, create a gateway or edit an existing one and add the desired BGP profile. Note that the IPSec profile of the VPN connection remains the primary profile used and the BGP profile is executed on top of the IPsec tunnel with the remote peer.