IBM Cloud Docs
Getting started with IBM Cloud Virtual Private Networking

Getting started with IBM Cloud Virtual Private Networking

The IPsec version of VPN is deprecated. As of 3 November 2024, you can't create new instances of IPsec VPN. Existing IPsec VPN instances are supported until 27 June 2025. Any instances that still exist on that date will be deleted.

On 2024 March 13, specific SSL VPN endpoints were removed from service as part of our ongoing efforts to optimize our network infrastructure and improve service quality. If you are currently using any of the deprecated URLs listed in Important announcement: SSL VPN endpoints, transition to the provided alternatives to avoid any disruptions in your workflow. A full, updated list of available SSL VPN endpoints is located at Available VPN endpoints.

Virtual Private Networking (VPN) access enables users to manage all servers remotely and securely over the IBM Cloud® private network. A VPN connection from your location to the private network allows out-of-band management and server rescue through an encrypted VPN tunnel. VPN tunnels can be initiated to any IBM Cloud data center or PoP allowing you geographic redundancy.

With VPN access, you can:

  • Establish a VPN connection to the private network via SSL, or IPsec.
  • Access your server through its primary private IP address by SSH or RDP.
  • Connect to your server’s IPMI IP address for low-level server management or rescue needs.

A number of services require access through the private network, and VPN is one method that allows private network access. A VPN is good to use when you need to log in to the private network, do your work, and then log out. For example, this access often is needed to reach the KVM of the server.

Each user on an account can be given VPN access and can be limited regarding the subnets to which it needs access. The account user must have VPN access enabled and a VPN password specified before attempting to log in to VPN services.

SSL VPN is a shared VPN service, which is free of charge. It is not recommended for production use.

Use case scenarios

Table 1: Recommended VPN options
If you plan to: Recommended VPN option:
Access your server on classic through its private IP address (10.x.x.x) by SSH or RDP for a short duration
Perform low-level server management with the KVM console of your classic server
Apply critical security updates to your server with public interface shut down
Establish a single person, short-lived, private network connection for occasional server and application management		 SSL VPN
Manage multiple servers for development or test workloads on classic through an encrypted VPN tunnel
Transfer large files regularly among different servers
Establish a long-lived network path for managing servers and the customer-deployed applications they host		 IPsec VPN
Establish a site-to-site SSL or IPsec VPN connection between IBM Cloud and on-premises for unlimited SSL VPN users and production workload
Establish a site-to-site SSL or IPsec VPN connection between two on-premise enterprise data centers for unlimited SSL VPN users		 VPN gateway appliances on classic (for example, Juniper vSRX or AT&T vRouter)

Enabling SSL VPN access

To get started, you'll need to enable VPN access on each account that needs VPN access. To enable SSL VPN access, follow these steps:

  1. Log in to the IBM Cloud console.

  2. Click Manage > Access (IAM), and select Users.

    To add a user, click Add VPN-only user or Invite users. For more information, see Inviting users to an account.

  3. Select the name of the user that you want to assign SSL VPN access.

  4. From the Manage User page, select the Classic Infrastructure tab and then click VPN subnets.

  5. Select the Enable SSL VPN Access checkbox and click Save.

Setting the VPN password

Your next step is to update the classic infrastructure VPN password. You can update your own VPN password, or in the case where a user forgets their password, another user with correct access can update that user's VPN password.

If you have the following access, you can update the VPN password for another user:

  • An IAM policy with the Editor or higher role on the User management service.
  • You are an ancestor in the classic infrastructure hierarchy for the user and you have the Manage users classic infrastructure permission assigned.

To update the VPN password:

  1. From the IBM Cloud menu bar, click Manage > Access (IAM), and select Users.
  2. Select a user from the list.
  3. From the User details view, go to the VPN password section.
  4. Click the Edit icon to enter a new VPN password.
  5. Click Apply to save your changes.

Logging in to the VPN

Now that the VPN access is configured, you can log in using your browser.

  1. Open your web browser and click on any one of the available VPN endpoints.

    Supported operating systems and browser pairs are as follows:

    • Vista/Win7/Win8/Win10/Win2003/Win2008: Chrome, 360SE, MSIE, Firefox
    • Linux: Chrome, Firefox
    • MacOS: Safari, Chrome

  2. When prompted, enter the VPN login credentials that you configured in Setting the VPN password.

    • If you have a stand-alone MotionPro client installed, your client is launched automatically.
    • If you do not have a client installed, the compatible version of the MotionPro client is available for you to download.

  3. With the MotionPro client, dependent on your operating system, you can follow different steps to create a connection. For more information about connecting using a MotionPro client, see Stand-alone clients.