> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using IPsec with Megaport

> This help topic describes how to use IPsec encryption with Megaport services.

export const Video = ({url, text, duration, description}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Video -';
  if (typeof url !== 'string') {
    url = String(url);
  }
  if (typeof text !== 'string') {
    text = String(text);
  }
  if (!url || url === 'undefined') {
    console.error(`${errorPrefix} the \`url\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (!text || text === 'undefined') {
    console.error(`${errorPrefix} the \`text\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const youtubeIconMask = "url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 576 512'%3E%3Cpath d='M549.7 124.1c-6.3-23.7-24.8-42.3-48.3-48.6C458.8 64 288 64 288 64S117.2 64 74.6 75.5c-23.5 6.3-42 24.9-48.3 48.6-11.4 42.9-11.4 132.3-11.4 132.3s0 89.4 11.4 132.3c6.3 23.7 24.8 41.5 48.3 47.8C117.2 448 288 448 288 448s170.8 0 213.4-11.5c23.5-6.3 42-24.2 48.3-47.8 11.4-42.9 11.4-132.3 11.4-132.3s0-89.4-11.4-132.3zM232 336V176l142.7 80z'/%3E%3C/svg%3E\")";
  return <div className="video-callout">
      <div className="callout my-4 flex gap-3 overflow-hidden rounded-2xl border px-5 py-4">
        <div className="mt-0.5 w-4 shrink-0" data-component-part="callout-icon">
          <svg aria-hidden="true" className="size-4 shrink-0" style={{
    WebkitMaskImage: youtubeIconMask,
    maskImage: youtubeIconMask,
    WebkitMaskRepeat: 'no-repeat',
    maskRepeat: 'no-repeat',
    WebkitMaskPosition: 'center',
    maskPosition: 'center',
    backgroundColor: '#0284c7'
  }} />
        </div>
        <div className="min-w-0 w-full text-sm" data-component-part="callout-content">
          <strong>
            Video:{' '}
            <a href={url} target="_blank" rel="noopener noreferrer">
              {text}
              <span className="sr-only"> (opens in a new tab)</span>
            </a>
          </strong>
          {}
          {duration && <> ({duration})</>}
          {}
          {description && <p className="mt-1 mb-0 text-xs text-gray-500 dark:text-gray-400">
              {description}
            </p>}
        </div>
      </div>
    </div>;
};

export const Gloss = ({term, anchor, langDir = 'en'}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Gloss -';
  if (typeof term !== 'string') {
    term = String(term);
  }
  if (typeof anchor !== 'string') {
    anchor = String(anchor);
  }
  if (!term || term === 'undefined') {
    console.error(`${errorPrefix} the \`term\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (!anchor || anchor === 'undefined') {
    console.error(`${errorPrefix} the \`anchor\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const lang = langDir === 'en' ? '/' : '/' + langDir + '/';
  const glossaryPage = lang + 'glossary/#' + anchor;
  return <a href={glossaryPage}>{term}</a>;
};

export const Image = ({src, alt = '', caption, width, height, shadow}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Image -';
  if (typeof src !== 'string') {
    src = String(src);
  }
  if (!src || src === 'undefined') {
    console.error(`${errorPrefix} \`src\` is required — rendering an empty string instead`);
    return <></>;
  }
  const img = <img className={['mega-image-style', shadow ? 'shadow' : ''].join(' ')} src={src} alt={alt} width={width} height={height} style={{
    display: 'block'
  }} />;
  return caption ? <figure>
      {img}
      <figcaption style={{
    textAlign: 'center',
    width
  }}>{caption}</figcaption>
    </figure> : img;
};

If you need to encrypt traffic between endpoints in an IP network, <Gloss term="IPsec" anchor="ipsec" /> is the most common solution. IPsec encrypted traffic can be transparently carried over any Megaport VXC.

## Creating an encrypted IPsec link using Megaport

You can create an IPsec encrypted customer-to-customer, customer-to-cloud, or cloud-to-cloud connection. See your cloud or equipment vendor's documentation for more information about creating IPsec connections.
On Megaport Cloud Routers (MCR), you can enable IPsec in the Megaport Portal during creation, or edit the MCR to enable IPsec after it has gone live. For more information, see [Using IPsec with MCR](/mcr/ipsec-mcr).

## Supported ciphers

The MCR will offer the following ciphers to IPsec peers. At this time, the options are not configurable.

**Encryption**

* AES128-GCM-128

* AES256-GCM-128

**Integrity**

* HMAC SHA-1

* HMAC SHA-256

* HMAC SHA-384

* HMAC SHA-512

**Key Exchange (Diffie-Hellman group)**

* MODP

  * Diffie-Hellman Group 2 (1024-bit)

  * Diffie-Hellman Group 14 (2048-bit)

* ECP

  * Diffie-Hellman Group 19 (256-bit random)

  * Diffie-Hellman Group 20 (384-bit random)

  * Diffie-Hellman Group 21 (521-bit random)

## IP MTU settings

IPsec packets include overhead due to encryption and encapsulation. We recommend that you configure your <Gloss term="IP Maximum Transmission Unit (MTU)" anchor="ipmtu" /> carefully to suit your network. The maximum value depends on the negotiated ciphers.
If you do not configure the IP MTU setting, the MCR will use the following default values:

* 96 bytes less than the parent interface IP MTU for IPv4
* 116 bytes less than the parent interface IP MTU for IPv6

These values allow for ciphers that have the largest overhead.

## Creating a customer-to-customer link using Megaport and IPsec

You can use an IPsec connection between two of your own devices using Megaport services.

**Prerequisites**

Before creating an IPsec encrypted link from customer-to-customer, you need:

* An IPsec capable router at each of your locations.
* Megaport Ports in locations where you can connect physically from your IPsec capable routers to the Port for each end of your connection.

**To create a customer-to-customer encrypted connection**

1. From each IPsec capable router, create a physical link to a Megaport Port.
2. Use a VXC to connect your Ports.
3. Create an IPsec connection over the interfaces connected to Megaport.

<Image src="/images/encryption/ipsec-customer-customer.png" alt="IPsec customer to customer connection diagram. This image shows the structure of a IPsec encryption connection from a customer's IPsec capable router, connected to a Port, which is connected to another Port using a VXC. The second Port is connected to another of the customer's IPsec capable router." shadow={true} width={950} />

## Creating a customer-to-cloud link using Megaport and IPsec

**Prerequisites**

Before creating an IPsec encrypted link from customer-to-cloud, you need:

* An IPsec capable router.
* A Megaport Port in a location where you can connect physically from your IPsec capable router to the Port.
* A connection to your CSP.

**To create a customer-to-cloud encrypted connection**

This example shows an IPsec connection from a  customer to AWS Direct Connect.

1. From your IPsec capable router, create a physical link to a Megaport Port.
2. Use VXC to connect the Port to the CSP, AWS Direct Connect in this case.
3. Create an IPsec tunnel between your device and the CSP's VPN services.

The connection will be IPsec encrypted from the IPsec capable router  through to the AWS Transit Gateway.

<Image src="/images/encryption/ipsec-customer-cloud.png" alt="IPsec customer router to AWS Transit Gateway diagram. This image shows the structure of a IPsec encryption connection from the customer's IPsec capable router, through a physical connection to a Megaport Port. This is connected to a AWS Direct Connect hosted connection using a Virtual Cross Connect (VXC). The Direct Connect Hosted connection is connected to a Transit Gateway via a Direct Connect Gateway." shadow={true} width={950} />

## Creating a cloud-to-cloud link using Megaport and IPsec

**Prerequisites**

Before creating an IPsec encrypted link from cloud to cloud, you need:

* A Megaport Cloud Router (MCR) with IPsec enabled.
* Connections to your CSPs VXCs

**To create a cloud-to-cloud encrypted connection**

This example describes an IPsec connection from AWS Direct Connect to Azure ExpressRoute.

1. Create a VXC to connect your Direct Connect connection to the MCR.
2. Use a VXC to connect the MCR to the ExpressRoute connection.
3. Create an IPsec tunnel between the AWS and Azure VPN services.\
   For more information, see [Using IPsec with MCR](/mcr/ipsec-mcr).

The connection will be IPsec encrypted from the AWS Transit Gateway to the Azure Virtual Network Gateway.

<Image src="/images/encryption/ipsec-cloud-cloud.png" alt="IPsec AWS Direct Connect to ExpressRoute Virtual Network Gateway diagram. This image shows the structure of a IPsec encryption connection from an AWS Direct Connect, connected to a Megaport MCR using a VXC. This is connected  using a VXC to ExpressRoute and a Virtual Network Gateway." shadow={true} width={950} />

## Creating a cloud-to-cloud link using Megaport and IPsec tunnels

**Prerequisites**

Before creating a cloud to cloud link with IPsec tunnels, you need:

* A Megaport Cloud Router (MCR) with IPsec enabled.
* Connections established through VXCs to your Cloud Service Providers.

**To create a cloud-to-cloud encrypted connection**

This example describes an IPsec connection from AWS Direct Connect to Azure ExpressRoute.

1. Create a VXC to connect your Direct Connect connection to the MCR.
2. Create a VXC to connect the MCR to the ExpressRoute connection.
3. Create an IPsec tunnel on the VXC between the MCR and the Direct Connect connection.
   For more information, see [Using IPsec with MCR](/mcr/ipsec-mcr).
4. Create an IPsec tunnel on the VXC between the MCR and the ExpressRoute connection.
   For more information, see [Using IPsec with MCR](/mcr/ipsec-mcr).

The connection will be IPsec-encrypted from the AWS Transit Gateway to the Azure Virtual Network Gateway.

<Image src="/images/encryption/ipsec-cloud-new.png" alt="IPsec AWS Direct Connect to ExpressRoute Virtual Network Gateway diagram. This image shows the structure of a IPsec encryption connection from an AWS Direct Connect, connected to a Megaport MCR using a VXC. This is connected  using a VXC to ExpressRoute and a Virtual Network Gateway." shadow={true} width={800} />

## Helpful references

<Video url="https://www.youtube.com/watch?v=rdUE4X976mE" text="AWS Azure Private IP VPN with Megaport" duration="19:35" description="This is a recording of a Megaport Live Tech Drop-in session on setting up a private IP VPN between AWS and Azure using Megaport." />

* [Comparing Encryption in Transit Options](https://www.megaport.com/blog/comparing-encryption-in-transit-options/)

* [Creating a Port](/connections/creating-port)

* [Creating a VXC](/connections/overview#creating-a-vxc)

* [Creating an MCR](/mcr/creating-mcr)

* [IPsec Overhead Calculator](https://ipsec-overhead-calculator.netsec.us/)

* [Using Encryption in Transit with Megaport Services](/encryption)

* [Using IPsec with MCR](/mcr/ipsec-mcr)

* [What is IPsec?](https://www.megaport.com/blog/what-is-ipsec/)