IPsec Configuration

IZO™+ Multi Cloud Connect Flex can reach the cloud privately over an internet underlay using IPsec. Your customer premises equipment (CPE) builds an encrypted tunnel to a Tata Communications-managed virtual router (VNF) inside the platform, EBGP runs over that tunnel to exchange routes, and the VNF connects on to your cloud over a private connection. Tata Communications configures and manages the VNF, the IPsec tunnel and the BGP peering; you configure your CPE to the published parameters.

How it works

Your site connects to the Tata Communications network over Tata Internet or any public internet last mile, using a static public IP. A per-customer routing VNF is provisioned for you inside IZO™+ Multi Cloud Connect. An IPsec tunnel is established over the internet underlay between your CPE and that VNF, giving an encrypted path for your traffic. EBGP is then run over the tunnel, so your site’s private routes are learnt into the VNF, and the VNF advertises the cloud-side routes back to you. The VNF is connected on to the cloud of your choice over a private connection (AWS Direct Connect, Azure ExpressRoute, Oracle FastConnect, Google Cloud Interconnect, or another supported cloud) with BGP. Because cloud traffic rides this private path rather than the public internet egress, it reduces the egress charges the cloud providers apply.

Resiliency options

Three levels of resiliency are available, adding link and then device protection:

Option	What it adds	How it is built
Routine	A single path	One VNF, reached over a single internet WAN link, with one IPsec tunnel.
Resilient	Link-level protection	One VNF reached over two internet WAN links, with an IPsec tunnel over each link.
Redundant	Link-level and device-level protection	Two VNFs, each reached over its own WAN link and IPsec tunnel; the VNFs are joined by an internal link group. Each VNF connects to the cloud over its own private connection.

What you configure on your CPE

At parameter level, your side of the tunnel needs:

A tunnel interface using the tunnel IP address allocated by Tata Communications, with MTU 1400 and TCP MSS 1360.
The tunnel source set to your site’s public IP and the tunnel destination set to the VNF public IP supplied by Tata Communications.
An IPsec profile matching the parameters below.
An EBGP session to the far-end tunnel IP, using the remote AS number and the authentication key supplied by Tata Communications, advertising your on-site prefixes.

IPsec parameters

Set your CPE to match the following. These are configured on the Tata Communications VNF for you; your CPE must be capable of the same values.

Phase 1 (IKE)	Value
Encryption	AES-256
Integrity / hash	SHA
Authentication	Pre-shared key (supplied by Tata Communications)
Diffie-Hellman group	15
IKE SA lifetime	2800 seconds

Phase 2 (IPsec)	Value
Protocol	ESP
Encryption	AES-256
Integrity	SHA-HMAC
Mode	Tunnel
IPsec SA lifetime	7200 seconds

Tunnel	Value
MTU	1400
TCP MSS adjust	1360

BGP over the tunnel

EBGP runs between your CPE and the VNF across the IPsec tunnel. You supply your ASN and the prefixes to advertise; Tata Communications supplies the far-end tunnel IP, the remote ASN and the BGP authentication key. The VNF handles all BGP towards the cloud, so you peer only with the VNF, not with the cloud provider directly.

Who configures what

Area	Tata Communications	You (the customer)
Virtual router (VNF)	Provisions, configures and manages the per-customer VNF	-
IPsec and EBGP on the VNF	Configures the IPsec tunnel and EBGP over IPsec on the VNF	-
BGP towards the cloud	Configures all EBGP towards the cloud on the VNF	-
Internet and public IP for the VNF	Provides the VNF’s internet connection and public IP	-
CPE	-	Router or firewall with internet access and a static public IP, and licences to support the IPsec tunnel and EBGP
Cloud side	-	Performs the logical connectivity and configuration towards the workloads in the cloud provider (AWS, Azure, Google Cloud, Oracle and others)

Prerequisites

A CPE router or firewall with internet access and a static public IP, licensed for IPsec and EBGP.
The cloud account and permissions to complete the cloud-side connection (see below).

What’s on the cloud side

The cloud connection at the far end is created in the cloud provider’s console. This page covers how the IPsec path and the managed VNF are delivered on the Tata Communications side; for the cloud-side connection request and routing, see the relevant per-cloud section.