Free cookie consent management tool by TermsFeed

Self Service VPN

Requires Appian Protect Foundation Success Plan or higher
On This Page

This page applies to Appian Cloud only. It may not reflect the differences with Appian Government Cloud.
Customers must be on the Foundation, Professional, or Signature Success Plans to connect to resources in a self-managed network or in a private cloud environment.

Self Service VPN gives you the power to view and manage IPsec VPN connections from your Appian Cloud environment to other resources through Cloud Resources in MyAppian.

VPN tunnel types

Appian Cloud supports two types of VPN tunnels. Both allow you to securely connect your Appian Cloud environment to resources in your private network.

Static VPN allows you to configure IP addresses to determine what traffic can go over your VPN tunnel(s). It implements policy-based VPN. For high-availability and failover scenarios, static VPN can present challenges because IP address changes may be required when rerouting traffic.

Dynamic VPN uses Border Gateway Protocol (BGP) to exchange routing information between Appian Cloud and your network. When a tunnel or node failure is detected, BGP automatically reroutes traffic to a secondary path — no manual intervention required. Dynamic VPN implements route-based VPN.

  Static VPN Dynamic VPN
Routing Policy-based Route-based
Failure handling Manual intervention required if no failover tunnel enabled Automatic rerouting via BGP when a failure is detected
Best for Simple connectivity needs with stable IP address ranges High-availability scenarios where automatic failover is required
BGP required No Yes; your VPN device must support BGP peering

Note:  Static and Dynamic VPN cannot be configured simultaneously for the same Appian Cloud environment. Enabling Dynamic VPN requires that any existing Static VPN tunnels be removed first.

Prerequisites

  • You need to be a support contact. A support contact has access to MyAppian and the ability to create Appian Support cases.

Considerations

The following capabilities are not currently available in Self Service VPN:

  • VPN tunnel status: The connection status of your VPN tunnels is not displayed in Self Service VPN. To check tunnel status, contact Appian Support.
  • Restart individual VPN tunnels: If you have multiple VPN tunnels configured and need to restart a specific tunnel, contact Appian Support.

How to configure a new VPN tunnel

Static VPN tunnel

To configure a static VPN connection:

  1. In MyAppian go to the Health tab and click CLOUD RESOURCES > CONNECTIVITY.
  2. Select your Appian Cloud Environment.
  3. If there are no existing VPN configurations for your server(s), click Configure VPN and select Get started with Static VPN to begin the configuration process.
  4. Fill out the following data:
    • Description: Alphanumeric string to identify the connection and is unique per connection.
    • Your Gateway IP: The public IP of your VPN device to establish the IPSEC connection.
    • Pre-Shared Key: Key to establish the initial security association.
      • Should be an alphanumeric string, between 40 and 64 characters long.

        Note:  IMPORTANT: Keep a backup of the pre-shared key; it will not be accessible after submitting the form.

      • If you wish for Appian to generate the Pre-Shared Key for you, leave the field blank. The Pre-Shared Key will be provided to you in a subsequent form.
    • Appian Network Interface IP: The endpoint IP for your Appian server.
      • The preferred IP address falls within the 172.30.0.0/24 space.
      • The IP address should fall within Appian Cloud Allowed IP address ranges. Review Allowed IP address ranges for more details.
      • The IP address cannot overlap with Your Subnets.
      • The IP address should not overlap with the Appian Network Interface IP of your other Appian Cloud environments.
    • Your Subnets: Specify all the subnets that the Appian server will connect to in your network.
      • The format should follow the CIDR notation (i.e 192.168.1.0/24).
      • To add a single IP, be sure to include a /32 at the end of the IP (i.e 192.168.1.1/32).
      • The subnets should fall within Appian Cloud Allowed IP address ranges. Review Allowed IP address ranges for more details.
  5. If necessary, configure the additional settings.
  6. After setting all required values in the form, click Next.
  7. Confirm to apply your changes and start your tunnel and click Finish.
  8. The form will automatically refresh when your VPN tunnel has successfully been configured. When prompted, click Create Connection.
  9. The next screen will display key information for you to complete the VPN tunnel setup on your side. If you opted for Appian to generate the Pre-Shared Key, the form will display your Pre-Shared Key. The VPN tunnels are configured to accept your connection as soon as you start the connection from your VPN device.
  10. Click Finish and contact Appian Support to schedule a restart of your Appian Cloud environment.

Dynamic VPN tunnel

To configure a dynamic VPN connection:

  1. In MyAppian, go to the Health tab and click CLOUD RESOURCES > CONNECTIVITY.
  2. Select your Appian Cloud Environment.
  3. If there are no existing VPN configurations for your server(s), click Configure VPN and select Get started with Dynamic VPN to begin the configuration process.
  4. Fill out the following data for both VPN instances in an Active-Passive setup:
    • Description: Alphanumeric string to identify the connection and is unique per connection.
    • Your Gateway IP: The public IP of your VPN device to establish the IPSEC connection.
    • Appian Network Interface IP: The endpoint IP for the Appian Gateway.
      • The preferred IP address falls within the 172.30.0.0/24 space.
      • The IP address should fall within Appian Cloud Allowed IP address ranges. Review Allowed IP address ranges for more details.
      • The IP address cannot overlap with Your Subnets.
      • The IP address should not overlap with the Appian Network Interface IP of your other Appian Cloud environments.
    • Appian ASN: Appian's Autonomous System Number for BGP peering. Must be a valid private ASN (64512–65534).

    • Virtual Tunnel Interface IP: The IP address space used for BGP communication inside the tunnel. Must be a valid APIPA address with a /30 CIDR (169.254.x.x/30) and unique per tunnel.

      A /30 CIDR block contains 4 IP addresses: the first and last are reserved, leaving 2 usable host addresses. The IP you enter must be one of those usable addresses. Appian will use that IP address as the Appian BGP Neighbor IP, and the remaining usable address becomes the Customer BGP Neighbor IP.

      For example, if you enter 169.254.100.101/30:

      • Appian BGP Neighbor IP: 169.254.100.101
      • Customer BGP Neighbor IP: 169.254.100.102

      Note:  The IP address in the CIDR you enter must be a usable host address in the /30 range, not the network or broadcast address. For the above example, entering 169.254.100.100/30 or 169.254.100.103/30 would be invalid.

    • Your ASN: Your Autonomous System Number for BGP peering. Must be a valid ASN (1–4294967295) and unique per tunnel.
    • Your Subnets: Specify all the subnets that the Appian server will connect to in your network.
      • The format should follow the CIDR notation (for example, 192.168.1.0/24).
      • To add a single IP, be sure to include a /32 at the end of the IP (for example, 192.168.1.1/32).
      • The subnets should fall within Appian Cloud Allowed IP address ranges. Review Allowed IP address ranges for more details.
  5. If necessary, configure the additional settings.
  6. After setting all required values in the form, click Next.
  7. Make note of the key information you'll need to complete the VPN tunnel setup on your side, including the Appian Gateway IPs and your Pre-Shared Keys.
  8. Click Finish.
  9. Contact Appian Support to schedule a restart of your Appian Cloud environment.

DNS-based VPN Routing

If you want to reference your resources by specifying their fully-qualified domain name (FQDN), configure DNS-based VPN Routing. See Appian Cloud VPN Integration for more details.

  1. In the DNS Over VPN section, click Modify. Click Add FQDN.
  2. Enter an FQDN using only alphanumeric characters and the '-' or '.' character.
  3. In the Your DNS Server IPs configuration that displays, add the IPs of your DNS servers, separated by semicolons. These IPs should be part of Your Subnets configured earlier. These IPs should fall within Appian Cloud Allowed IP address ranges. Review Allowed IP address ranges for more details.
  4. (Optional) In the Excluded Subdomains column, add one or more subdomains that should be excluded from getting routed via VPN. These should also be fully qualified and fall within the FQDN entered earlier in the Your FQDNs column.
  5. Click Create.
  6. Contact Appian Support to schedule a restart of your Appian Cloud environment.

Additional settings

If you want to customize the specifics of your VPN connection, there is an additional settings section that can be expanded. The following fields and their default values will be used if no changes are made.

  • IKE Version: IKEv2 is the only supported IKE version.
  • Perfect Forward Secrecy: Determines whether or not new keying material will be generated for each IPsec SA. (Default: PFS enabled).
  • Phase 1 Encryption Algorithm: The encryption algorithm to use for the VPN tunnel for phase 1.
    • Default AES256-CBC. For supported values see VPN encryption configurations.
    • If an AEAD algorithm is selected (AES128-GCM or AES256-GCM), hashing is already included, and as a result, a hashing algorithm cannot be chosen.
  • Phase 1 Hashing Algorithm: The hashing algorithm to use for the VPN tunnel for phase 1.
  • Phase 1 Diffie-Hellman Group: The Diffie-Hellman group to use for key exchange for phase 1.
  • Phase 1 Lifetime: How long the keying of a connection (IKE) should last before being renegotiated. (Default 28800 seconds)
  • Phase 2 Encryption Algorithm: The encryption algorithm to use for the VPN tunnel for phase 2.
    • Default AES256-CBC. For supported values see VPN encryption configurations.
    • If an AEAD algorithm is selected (AES128-GCM or AES256-GCM), hashing is already included, and as a result, a hashing algorithm cannot be chosen.
  • Phase 2 Hashing Algorithm: The hashing algorithm to use for the VPN tunnel for phase 2.
  • Phase 2 Diffie-Hellman Group: The Diffie-Hellman group to use for key exchange for phase 2.
  • Phase 2 Lifetime: How long an instance of a connection should last, from successful negotiation to expiry. (Default 3600 seconds)
  • DPD Action: Dead peer detection (DPD) action. Defines what action to take when a DPD peer is declared dead. Supported values:
    • restart (default): Restart the IKE session when DPD timeout occurs.
    • hold: The IKE session will stay in hold status.
    • clear: End the IKE session when DPD after timeout.
  • DPD Delay: Length of time between dead peer detection keepalives that are sent for this connection. (Default 30 seconds)
  • DPD Timeout: Length of time that the connection idles without hearing back from the other peer. (Default 120 seconds)

How to modify an existing VPN tunnel

To view or modify a VPN connection:

  1. In MyAppian, go to the Health tab and click CLOUD RESOURCES > CONNECTIVITY.
  2. Select your Appian Cloud environment.
  3. If your connection is supported for modification, click Edit inside of a connection’s details.
  4. You should always be able to modify the following:
    • For both static and dynamic VPN:
    • Description
    • Your Gateway IP
    • Pre-Shared Key
    • Appian Network Interface IP
    • Your Subnets
    • For dynamic VPN only:
      • BGP Settings, including Inside Tunnel Address Space, Appian ASN, and Your ASN
  5. (Optional) You can add, modify, or remove DNS configurations in the DNS Over VPN section.
  6. If your connection is fully supported for modification, you’ll also be able to modify the following settings:
    • IKE Version
    • Perfect Forward Secrecy
    • Phase 1 Encryption Algorithms
    • Phase 1 Hashing Algorithms
    • Phase 1 Diffie-Hellman Groups
    • Phase 1 Lifetime
    • Phase 2 Encryption Algorithms
    • Phase 2 Hashing Algorithms
    • Phase 2 Diffie-Hellman Groups
    • Phase 2 Lifetime
    • DPD Action
    • DPD Delay
    • DPD Timeout
  7. After setting all required values in the form, click Save.
  8. Confirm to apply your changes and click Save.

You will be taken back to the VPN Configurations page, and you will see one of the following:

  • If your connection is being configured in your server, you will see a banner at the top of the page indicating so, and modification of the connection will be temporarily disabled.
    • Use the refresh button to verify the status of the configuration change. It should not take longer than a few minutes.
  • If your connection had problems being configured, you will see a banner in your connection’s details indicating so. No further modifications will be allowed, contact Appian Support if you run into this scenario.

How to configure a Failover tunnel (Static VPN only)

To configure a failover tunnel for a Static VPN connection:

  1. In MyAppian go to the Health tab and click CLOUD RESOURCES > CONNECTIVITY.
  2. Select your Appian Cloud environment.
  3. If your connection is supported for enabling a Failover VPN tunnel, inside of a connection’s details you will be able to click Add Failover VPN to begin the process.
  4. Fill out the following data:
    • Description: Alphanumeric string to identify the connection and is unique per connection.
    • Your Gateway IP: The public IP of your secondary VPN device to establish the IPSEC connection.
    • Pre-Shared Key: Key to establish the initial security association.
      • Should be an alphanumeric string, between 40 and 64 characters long.

        Note:  IMPORTANT: Keep a backup of the pre-shared key; it will not be accessible after submitting the form.

      • If you wish for Appian to generate the Pre-Shared Key for you, leave the field blank. The Pre-Shared Key will be provided to you in a subsequent form.
    • Failover IP to Ping The IP address that will be pinged to confirm the health of the VPN tunnel. This endpoint needs to allow ping traffic from the Appian side of the tunnel. The IP address must fall within one of Your Subnets.
  5. If necessary, configure the additional settings.
  6. Click Add.

How to delete a VPN tunnel

To delete a connection:

  1. In MyAppian go to the Health tab and click CLOUD RESOURCES > CONNECTIVITY.
  2. Select your Appian Cloud Environment.
  3. Click Delete a Connection.
  4. Select the connection(s) you want to delete in the dropdown.
    • If you want to delete a primary tunnel with a corresponding failover tunnel, you must select the failover tunnel and the primary tunnel.
  5. Click Delete.
  6. Confirm that you want to delete your tunnel(s), and click Finish.

    Caution:  Self Service VPN blocks you from deleting all VPN tunnels; one tunnel must remain. If you wish to delete all VPN tunnels, contact Appian Support.

FAQ

How do I configure VPN tunnels for High Availability environments?

You can follow the steps mentioned in the Static VPN tunnel or Dynamic VPN tunnel sections depending on your VPN type.

I need to modify a VPN tunnel, and I am unable to do so through Self Service VPN. What should I do?

Open a case with Appian Support, and our support team will help you to modify a tunnel.

Who can view, add or modify VPN configurations?

Self Service VPN functionalities are only available to authorized technical support contacts for the account the environment belongs to. This applies to both static and dynamic VPN configurations.

Why can't I see the option to delete my VPN?

You have VPN configurations that are preventing you from deleting VPN connections. Contact Appian Support to delete your VPN connections.

Feedback