---
name: vpc-vpn-onprem
title: Connecting to your on-premises network
description: You can use IBM Cloud VPN for VPC to securely connect your VPC to an on-premises network through a VPN tunnel. This topic provides guidance about how to configure your VPN gateway to connect to your on-premises network.
last-updated: 2026-07-16
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Connecting to your on-premises network
{: #vpn-onprem-example}

You can use IBM Cloud [VPN for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpn&format=markdown) to securely connect your VPC to an on-premises network through a VPN tunnel. This topic provides guidance about how to configure your VPN gateway to connect to your on-premises network.
{: shortdesc}

[Create a VPN gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-create-gateway&interface=ui&format=markdown) in your VPC and [create a VPN connection](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-adding-connections&format=markdown) between the VPC and the peer gateway of the on-prem network by specifying the following information.

* **Connection name** - Enter a name for the connection, such as `onprem-connection`.
* **Peer gateway address** - Specify the IP address of the VPN gateway for the on-prem network.
* **Preshared key** - Specify the authentication key of the VPN gateway for the on-prem network.
* **Local subnets (Policy-based VPN only)** - Specify one or more subnets in the VPC that you want to connect through the VPN tunnel.
* **Peer subnets (Policy-based VPN only)** - Specify one or more subnets in the on-premises network that you want to connect through the VPN tunnel.
* **Peer ASN (Dynamic route-based VPN connection only)** - Specify the peer ASN, which identifies the remote peer network with which the VPN exchanges routes.
* **Tunnel interface IP (Dynamic route-based VPN connection only)** - Specify the IP address that is assigned to the VPN gateway side of the VPN tunnel.
* **Peer interface IP (Dynamic route-based VPN connection only)** - Specify the IP address that is assigned to the remote network side of the VPN tunnel. This address is your on-premises device or peer VPN gateway.

For the Internet Key Exchange (IKE) and IPsec security parameters, select **Auto** so that the cloud gateway uses auto-negotiation to automatically establish the connection with the on-premises gateway.

The gateway status appears as **Pending** while the VPN gateway is being created, and the status changes to **Available** after it is created.
{: note}

## Configuring the on-premises VPN gateway
{: #configuring-onprem-gateway}

The next step is configuring your on-premises VPN gateway peer to connect to your IBM Cloud VPN for VPC. The configuration depends on the type of VPN gateway. See the following topics for details:

* [Connecting to an AWS peer](https://cloud.ibm.com/docs/vpc?topic=vpc-aws-config&format=markdown)
* [Connecting to a Check Point Security Gateway peer](https://cloud.ibm.com/docs/vpc?topic=vpc-check-point-config&format=markdown)
* [Connecting to a Cisco ASAv peer](https://cloud.ibm.com/docs/vpc?topic=vpc-cisco-asav-config&format=markdown)
* [Connecting to a FortiGate peer](https://cloud.ibm.com/docs/vpc?topic=vpc-fortigate-config&format=markdown)
* [Connecting to a Juniper vSRX peer](https://cloud.ibm.com/docs/vpc?topic=vpc-juniper-vsrx-config&format=markdown)
* [Connecting to a strongSwan peer](https://cloud.ibm.com/docs/vpc?topic=vpc-strongswan-config&format=markdown)
* [Connecting to a Vyatta peer](https://cloud.ibm.com/docs/vpc?topic=vpc-vyatta-config&format=markdown)

These configurations are fully tested and supported by IBM. If you plan to use an on-premises VPN gateway peer other than those listed, IBM Support can help troubleshoot your configuration, but can't guarantee a resolution.
{: note}

## Checking the status of the secure connection
{: #check-connection-status}

You can check the status of your connection in the IBM Cloud console. On the VPN for VPC page, select your VPN gateway and click **Connections** from the navigation pane on the left of the page.

You can also test the connection by doing a ping from a virtual server instance in your VPC to a server in the on-premises network.

## Related links
{: #related-link-vpn-gateways}

* [Planning considerations for VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-considerations-vpn&interface=ui&format=markdown)
* [Known issues for VPN gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpn-limitations&format=markdown)