Virtual Private Network (VPN)

Flexible port egress can be enabled using Cloud Manager. The following steps outline how to enable flexible port egress on AEM as a Cloud Service using the Cloud Manager.

1. Log in to the Adobe Experience Manager Cloud Manager as a Cloud Manager Business Owner.

2. Navigate to the desired Program.

3. In the left menu, navigate to Services > Network Infrastructures.

4. Select the Add network infrastructure button.

   

5. In the Add network infrastructure dialog, select the Virtual private network option. Fill out the fields and select Continue. Work with your organization’s network administrator to obtain the correct values.

   

6. Create at least one VPN connection. Give the connection a meaningful name and select the Add connection button.

   

7. Configure the VPN connection. Work with your organization’s network administrator to obtain the correct values. Select Save to confirm the addition of the connection.

   

8. If multiple VPN connections are required, as more connections as needed. When all VPN connections are added, select Continue.

   

9. Select Save to confirm the addition of the VPN and all configured connections.

   

10. Wait for the network infrastructure to be created and marked as Ready. This process can take up to 1 hour.

    

With the VPN created, you can now configure it using the Cloud Manager APIs as described below.

Virtual Private Network can be enabled using Cloud Manager APIs. The following steps outline how to enable VPN on AEM as a Cloud Service using the Cloud Manager API.

1. First, determine the region in which the Advanced Networking is needed by using the Cloud Manager API listRegions operation. The region name is required to make subsequent Cloud Manager API calls. Typically, the region the Production environment resides in is used.

   Find your AEM as a Cloud Service environment’s region in Cloud Manager under the environment’s details. The region name displayed in Cloud Manager can be mapped to the region code used in the Cloud Manager API.

   listRegions HTTP request

   code language-shell
   $ curl -X GET https://cloudmanager.adobe.io/api/program/{programId}/regions \ -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \ -H 'x-api-key: <CLIENT_ID>' \ -H 'Authorization: Bearer <ACCESS_TOKEN>' \ -H 'Content-Type: application/json'

2. Enable Virtual Private Network for a Cloud Manager Program using Cloud Manager APIs createNetworkInfrastructure operation. Use the appropriate region code obtained from the Cloud Manager API listRegions operation.

   createNetworkInfrastructure HTTP request

   code language-shell
   $ curl -X POST https://cloudmanager.adobe.io/api/program/{programId}/networkInfrastructures \ -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \ -H 'x-api-key: <CLIENT_ID>' \ -H 'Authorization: Bearer <ACCESS_TOKEN>' \ -H 'Content-Type: application/json' -d @./vpn-create.json

   Define the JSON parameters in a vpn-create.json and provided to curl via ... -d @./vpn-create.json.

   Download the example vpn-create.json. This file is only an example. Configure your file as required based on the optional/required fields documented at enableEnvironmentAdvancedNetworkingConfiguration.

   code language-json

   { "kind": "vpn", "region": "va7", "addressSpace": [ "10.104.182.64/26" ], "dns": { "resolvers": [ "10.151.201.22", "10.151.202.22", "10.154.155.22" ], "domains": [ "wknd.site", "wknd.com" ] }, "connections": [{ "name": "connection-1", "gateway": { "address": "195.231.212.78", "addressSpace": [ "10.151.0.0/16", "10.152.0.0/16", "10.153.0.0/16", "10.154.0.0/16", "10.142.0.0/16", "10.143.0.0/16", "10.124.128.0/17" ] }, "sharedKey": "<secret_shared_key>", "ipsecPolicy": { "dhGroup": "ECP256", "ikeEncryption": "AES256", "ikeIntegrity": "SHA256", "ipsecEncryption": "AES256", "ipsecIntegrity": "SHA256", "pfsGroup": "ECP256", "saDatasize": 102400000, "saLifetime": 3600 } }] }

   Wait 45-60 minutes for the Cloud Manager Program to provision the network infrastructure.

3. Check that the environment has finished Virtual Private Network configuration using the Cloud Manager API getNetworkInfrastructure operation, using the id returned from the createNetworkInfrastructure HTTP request in the previous step.

   getNetworkInfrastructure HTTP request

   code language-shell
   $ curl -X GET https://cloudmanager.adobe.io/api/program/{programId}/networkInfrastructure/{networkInfrastructureId} \ -H 'x-gw-ims-org-id: <ORGANIZATION_ID>' \ -H 'x-api-key: <CLIENT_ID>' \ -H 'Authorization: <YOUR_BEARER_TOKEN>' \ -H 'Content-Type: application/json'

   Verify that the HTTP response contains a status of ready. If not yet ready, recheck the status every few minutes.

With the VPN created, you can now configure it using the Cloud Manager APIs as described below.