--- title: "Setting up site-to-site on AWS Virtual Gateway" slug: "site-to-site-aws-virtual-gateway" description: "The choice between Transit Gateway or a simple Virtual Gateway depends on your AWS architecture.If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead." status: "update" updated: 2026-09-08T13:04:11Z published: 2026-09-08T13:04:11Z canonical: "help.nordlayer.com/site-to-site-aws-virtual-gateway" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Setting up site-to-site on AWS Virtual Gateway **Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead. Please note, the choice between Transit Gateway or a simple Virtual Gateway depends on your AWS architecture. If you are not sure, we encourage you to visit [AWS's official documentation](https://aws.amazon.com/transit-gateway/). ## Configuring the tunnel in the AWS Console 1. Go to the **VPC section** in the **AWS Console** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.38.11(1).png)AWS console services menu showing VPC and networking options with search and category filters 2. Under the left menu **Virtual Private Network (VPN)** section, go to **Customer Gateways** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.39.11(1).png)AWS VPC console menu with Customer gateways option highlighted under Virtual private network 1. Select **Create Customer Gateway** 2. Select **static routing** 3. Fill in the IP Address of your **NordLayer server with a dedicated IP** 4. Select **Create Customer Gateway**. A message should display indicating the gateway was created successfully ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.39.53.png)AWS Create customer gateway form with name tag, BGP ASN, IP address, and certificate fields ## Configuring a virtual private gateway *If you already have a virtual private gateway attached to your VPC, skip this section and continue at **Creating a virtual private network connection**.* 1. Go back to **Services**, scroll down to **Networking & Content Delivery**, and select **VPC** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.38.11(1).png)AWS services menu displaying VPC and networking options with search functionality 1. On the left side, under **Virtual Private Network (VPN)** select **Virtual Private Gateways** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.58.01.png)AWS VPC menu with Virtual private gateways option highlighted under Virtual private network 1. Select **Create Virtual Private Gateway** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.45.57.png) 1. Type the name of the gateway (for example US_HQ) 2. Select **ASN** as **Amazon default ASN** 3. Select **Create Virtual Private Gateway** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.42.51.png)AWS Create virtual private gateway form with name tag, ASN options, and tags configuration *A message should display indicating that the virtual Private Gateway was created successfully.* 1. Select the newly created gateway and select **Actions**; on the context menu select **Attach to VPC** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2011.45.57(1).png)AWS Virtual private gateways dashboard with Actions menu showing Attach to VPC option 1. From the drop-down menu, select the VPC and select **Yes, Attach** ## Creating a virtual private network connection 1. Under **Virtual Private Network (VPN)** in the left menu, go to **Site-to-Site VPN Connections** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2012.24.46.png)AWS VPC menu with Site-to-Site VPN connections option highlighted under Virtual private network 1. Select **Create VPN Connection** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2012.24.46-2.png)AWS VPN connections dashboard with Create VPN connection button highlighted in navigation header 1. Enter the name tag (for example EU_Office) 2. Select the created **Virtual Private Gateway** 3. Under **Customer Gateway**, select **Existing** 4. Select the **Customer Gateway** that you have created 5. Under **Routing Options**, select **Static** 6. Fill in the following Static IP Prefixes: **10.6.0.0/20** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2012.13.17.png)AWS Create VPN connection form with site-to-site details, gateway selections, and configuration options 1. Under **Tunnel Options** leave the default values as-is 2. Select **Create VPN Connection** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2012.13.49.png)AWS VPN routing options with static IP prefix and pre-shared key configuration *In this page you can also select the inside subnets that you would like to connect via the tunnel.* 1. A message should display indicating that a VPN Connection Request was created successfully ## Configuring the routing rules to the default gateway 1. Select the **VPC** section in the **AWS Console** and enter the Route table associated with your **VPC** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2015.29.43.png)AWS VPC dashboard with Your VPCs option highlighted under Virtual private cloud menu 1. For the **Route Tables** menu option, select the routing table that is associated with the VPC you have created for the tunnel ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2015.29.43-2.png)AWS VPC Route tables dashboard with route table ID and Create route table button 1. Select **Edit** and add the new static routes for the subnets below: ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2015.30.59.png)AWS Route tables dashboard displaying main route table ID with search and Actions dropdown *Fill in **10.6.0.0/20** at the destination field and your new **VPN Gateway ID** as the target (it will appear under the subcategory Virtual Private Gateway).* 1. Select **Save** *In case have a customized security group associated with your VPC:* *Allow incoming connections from NordLayer local network within your security groups: Configure your AWS security groups to allow all traffic from NordLayer (**10.6.0.0/20**) or allow only special traffic using the port or services from these sources.* ## Collecting the tunnel configuration from the AWS Console 1. Return to **Site-to-Site VPN Connections** and select **Download Configuration** ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2012.24.46-3.png)AWS VPN connections dashboard showing Site-to-Site VPN with available status and Download configuration button 1. Fill in the following details and click on "**Download**". ![](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/Screenshot%202025-11-12%20at%2012.25.10(1).png)AWS VPN configuration download form with Strongswan vendor, platform, software, and IKEv2 settings ## Obtain IPSEC Tunnel #1 details 1. Open the configuration file which you have just downloaded and scroll until **conn Tunnelid** as shown in the screenshot below: ![AWS Tunnel Configuration](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/AWS%20Tunnel%20Configuration.png)AWS VPN tunnel configuration file showing IPsec parameters with IKEv2 and encryption settings --- 1. Make a note of these details as they will be needed for the VPN server configuration: - **IKE version**: IKEv2 (recommended) - **Remote IP (right)**: Your AWS Remote IP - **Encryption settings** IKE Encryption and DH Group - **Local IP (-ll)**: Local Tunnel IP - **Remote IP (-lr)**: Remote Tunnel IP - **Mark (-m)**: specified in the config - **Pre-shared key (PSK)**: Your Pre-Shared Key / Secret ## Obtain IPSEC Tunnel #2 details 1. Within the same configuration file, scroll down to locate the section labeled **conn Tunnel2**. 2. Take note of the following details as they will be required for configuring Site-to-Site connection: - **IKE version**: IKEv2 (recommended) - **Remote IP (right)**: Your AWS Remote IP - **Encryption settings** IKE Encryption and DH Group - **Local IP (-ll)**: Local Tunnel IP - **Remote IP (-lr)**: Remote Tunnel IP - **Mark (-m)**: specified in the config - **Pre-shared key (PSK)**: Your Pre-Shared Key / Secret ## Ending note: Once you have obtained all necessary details from the AWS config – **IPSEC** **Tunnel #1** and **IPSEC** **Tunnel #2** – please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site). **Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.