VMware NSX Edge Gateway – Timus Networks

This guide outlines the steps required to establish a secure IPSec connection between Timus and VMware NSX Edge Gateway in Timus and VMware Cloud Director.

Timus Configuration

Phase 1 – Parameters

Local Peer Identifier: Timus Gateway Public IP
Remote Peer Identifier: VMware Gateway Public IP
Key Exchange Type: IKEv1
Preshared Key: Your Preshared Key
Authentication Algorithm: SHA1
Encryption Algorithm: AES256
DH Group: modp2048 (Group 14)
Mode: Main
Create Firewall Rules Automatically: Enabled

Phase 1 – Miscellaneous

Responder Only: False
Margin Time: 60 seconds
Lifetime: 28800 seconds
Dead Peer Detection (DPD): Enabled
- DPD Delay: 10 seconds
- DPD Max Failure: 5
NAT Traversal: Enabled

Phase 2

Authentication Algorithm: SHA256
Encryption Algorithm: AES256
Protocol: ESP
Perfect Forward Secrecy (PFS): Disabled
- PFS Group: modp1024 (Group 2)
Lifetime: 3600 seconds
Tunnel Protocol: ALL
Create Firewall Rules Automatically: Enabled

VMware NSX Edge Gateway Configuration

1. Locate the Edge Gateway

Navigate to Networking → Edge Gateways
Select your gateway (e.g., Your GW Name)

2. Create the IPSec Tunnel

Click on IPSec VPN then New

General Settings:

Name: Timus
Type: Policy Based
Security Profile: Default
Status: Active
Logging: Inactive (optional)

Peer Authentication:

Mode: Pre-Shared Key
Key: Must match Timus

Endpoint Configuration:

Local IP: VMware Public IP (e.g., 1.2.3.4)
Local Networks: Your LAN Subnet
Remote IP: Timus GW Public IP
Remote Networks: 192.168.249.0/24

3. Customize the Security Profile

Click the three dots next to the tunnel and select Security Profile Customization.

Phase 1 (IKE Profile):

Version: IKEv1
Encryption: AES 256
Digest: SHA1
DH Group: Group 14
Lifetime: 28800 seconds

Phase 2 (Tunnel):

Encryption: AES 256
Digest: SHA256
DH Group: Group 2
PFS: Disabled
Lifetime: 3600 seconds
DPD Interval: 5 seconds

4. Create IP Sets

Go to Networking → IP Sets
Click New
Add subnets like 192.168.249.0/24 (Timus) and your internal LAN

5. Configure Firewall Rules

Navigate to Firewall → Rules → New
Add two-way traffic rules between VMware LAN and Timus subnet

Example Rules:

Source: Your LAN Subnet → Destination: Timus subnet → Action: Allow
Source: Timus subnet → Destination:Your LAN Subnet → Action: Allow

Final Checks

Ensure tunnel state is Active
Firewall rules must match real subnets
Encryption and DH groups must align on both sides