---
title: "Setting up site-to-site on IBM Cloud"
slug: "site-to-site-ibm"
description: "Using the IBM Cloud Console, you can configure a VPN gateway at the NordLayer Control Panel.If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead."
status: "update"
updated: 2026-09-08T13:03:06Z
published: 2026-09-08T13:03:06Z
canonical: "help.nordlayer.com/site-to-site-ibm"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nordlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up site-to-site on IBM Cloud

**Note**: If your device/service supports SHA256 and DH group 14, it is recommended to use these settings instead.

## Configuring a VPN gateway at the IBM Cloud Console

1. Open to the VPC section in the IBM Cloud Console. Go to VPNs (under the Network tab)

![Google Cloud Network menu showing VPNs option highlighted with VPCs, subnets, and security options](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/01%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

1. Open the IKE Policies tab, then select New IKE Policy

![Google Cloud VPN for VPC page showing IKE policies tab with New IKE policy button](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/02%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

1. Choose a Name, the Region in which the appropriate VPC lies, define the Resource group, then select Create IKE policy

![Google Cloud new IKE policy form with Frankfurt region selected and Create IKE policy button](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/03%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

1. Once the policy has been created, select the three-dotted menu (...) and select Edit
2. Fill in the following information:

- **IKE Version**: 1
- **DH Group**: 2
- **Authentication**: sha256
- **Key Lifetime**: 28800
- **Encryption**: aes256

1. Select Save IKE policy
2. Open the IPSec Policies tab, then select New IPSec Policy
3. Choose a Name, the Region in which the appropriate VPC lies and define the Resource group, then select Create IPSec policy

![Google Cloud new IPsec policy form with NL-Phase2 name and Frankfurt region selected](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/04%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

1. Once the policy has been created, select the three-dotted menu (...) and select Edit
2. Fill in the following information:

- **Check**: PFS
- **DH Group**: 2
- **Authentication**: sha256
- **Key Lifetime**: 3600
- **Encryption**: aes256

1. Select Save IPSec policy

![Google Cloud IPsec policy update form showing sha256, aes256, PFS enabled, and 3600 second key lifetime](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/05%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

1. Open the VPN gateways tab, then select New VPN gateway
2. Fill in the following information:

- **Name**: Choose the name of your choice
- **Virtual private cloud**: Choose the desired cloud
- **Resource group**: Choose the resource group
- **Subnet**: Choose the appropriate subnet

![Google Cloud new VPN gateway form with ipsec-tst name, VPC, and subnet configuration fields](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/06%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

1. Check New VPN Connection for VPC
2. Fill in the following information:

- **Connection name**: Set a name
- **Peer gateway address**: the IP of your NordLayer server with a dedicated IP
- **Preshared key**: Insert an 8 character (at least) string containing upper-case letters, upper-case letters, and numbers (we will also need this value on our end)
- **Local subnet**: Specify one or more subnets in the VPC you want to connect
- **Peer subnet**: 10.6.0.0/20

![Google Cloud new VPN connection form with NL-test name, peer gateway, and preshared key fields](https://cdn.document360.io/fc1049cd-8f71-4b89-b9b8-dbca9fdcdd16/Images/Documentation/07%20Setting%20up%20site-to-site%20on%20IBM%20Cloud(1).png)

- **Dead peer detection action**: Restart
- **Interval**: 10 seconds
- **Timeout**: 30 seconds
- **IKE policy**: Choose the policy that was earlier
- **IPSec policy**: Choose the policy that was earlier

## Ending note:

In order to finalize the site-to-site tunnel, please create a setup in [Sites tab of the NordLayer Control Panel](/v1/docs/site-to-site).

- Pre-shared key - you can generate it or we can provide it
- Encryption  details (AES, SHA and DH group) - AES256, SHA256 and DH group 14 are recommended (also must support IKEv2)
- Remote gateway/router public IP (must be reachable while connected to the server with a dedicated IP)
- Remote subnet and mask (the subnet is used in your local network)

---

**Note**: In case you have any questions or issues, press '**Chat with support**' at the bottom of the page.