VPN Integration

On This Page

This page applies to Appian Cloud only. It may not reflect the differences with Appian Government Cloud.

Customers must be on the Foundation, Professional, or Signature Success Plans to connect to resources in a self-managed network or in a private cloud environment.

This page describes using VPN tunnels with Appian Cloud.

VPN connections

Internet Protocol Security (IPsec) VPN connections can be configured to allow your Appian Cloud environments to access resources in your private network. Each Appian Cloud environment can have multiple VPN tunnels enabled to securely integrate with resources in different segments of your network. This approach lets you use Appian Smart Services like Query Database or Call Web Service to connect to resources located on your private network. VPN tunnels can also be used to secure connection to business data sources through the Admin Console, as well as integrate with corporate authentication systems (such as Active Directory).

Appian Cloud supports both static and dynamic routing using IPsec VPN tunnels. This page introduces you to reference material that is relevant to either VPN type.

Tip: Alternatives to VPN include AWS PrivateLink. See the connectivity feature comparison to determine which connectivity method matches your business needs.

Note: Static and Dynamic VPN cannot be configured simultaneously for the same Appian Cloud environment. If you require Dynamic VPN routing, your environment cannot also have Static VPN tunnels configured, and vice versa.

Failover and resiliency

Appian Cloud environments can have a pair of VPN tunnels configured as active/passive to failover between 2 customer VPN gateways. Failover to the passive tunnel will be attempted upon failure of a ping test against a single IP address within your private network. This IP address must be reachable and ping must be enabled from both of your VPN gateways. We strongly recommend that you implement failover for your production environments. You can now configure your failover tunnel using Self Service VPN. To simplify failover and reduce setup complexity, we recommend the use of Dynamic VPN Routing.

Previously, Static VPN tunnels were associated with a single Appian Cloud environment. This meant that a typical static VPN integration on a High Availability environment required 3 VPN tunnels. With failover, this would result in 6 VPN tunnels. This configuration is no longer required for a High Availability environment and is now considered a Legacy configuration. A single Static VPN tunnel can now be configured even for a High Availability environment. If you require a more robust setup for your High Availability environments, we recommend the use of Dynamic VPN Routing.

Static VPN failover expects both sides of the connection to be automatic. Make sure your passive tunnel is configured to automatically start if the active tunnel becomes unavailable.

Using the VPN tunnel

To use the VPN tunnel to connect to a resource on a private network, refer to the resource using its Fully Qualified Domain Name (FQDN) in any location where Appian allows the use of a URL for a resource, such as the Call Web Service or the Query Database smart services.

Inbound traffic

By default, Appian Cloud environments receive all web inbound traffic through the public internet. Upon request, Appian can configure your Appian Cloud environment to require web traffic to go through a VPN tunnel. With this configuration, the environment will not be accessible over the internet, and all users must first be on their corporate network before navigating to the Appian Cloud environment. See Configuring Inbound Access over VPN for details.

Alternatively, you can also request your Appian Cloud environments to be configured in dual mode in which the environments receive inbound web traffic over the internet and the VPN tunnel. See Configuring Inbound Dual Access for details on how to set up your environments in dual mode.

Note: Both of these custom configurations require additional network hops for web traffic to enter Appian Cloud. Consider performance and compatibility with mobile devices carefully before enabling either of them.

Outbound traffic

Traffic addressed to a host within your corporate domain and for which the DNS lookup (from the corporate DNS servers if provided, otherwise the internet) returns a private IP address (RFC 1918) is sent over the VPN tunnel. Appian Support can configure traffic to certain public IP addresses to also be sent over the VPN tunnel if requested. All other traffic will be sent over the internet.

Note: This is applicable even if an Appian Cloud environment is configured to require all inbound traffic to go through the VPN tunnel.

Your network VPN considerations

Appian Cloud static VPNs use policy based VPNs, your device should be configured to support that. If the VPN gateway goes down, Appian cannot connect to resources located on your network. We strongly recommend that you take this into account when designing your Appian applications. For example, build the appropriate error handling and recovery mechanisms within your process models.

Appian Cloud is configured as the initiator of the VPN tunnel. This means that Appian Cloud will establish the connection to your VPN gateway, and your device should be configured to accept incoming connections rather than initiate them. We may disconnect the Appian Cloud environment during scheduled maintenance windows, after which Appian Cloud will re-initiate the connection automatically.

High-level examples

IP address based VPN routing

In the example below, you can integrate with the resources in your private network over a VPN tunnel by specifying the IP addresses within your Appian environment. Note that in this case, your private network address space must be in our allowed ranges. Static VPN Diagram Generic

DNS-based VPN routing

DNS-based VPN routing allows you to reference your resources by specifying their FQDNs. We will conduct a DNS lookup on these FQDNs based on your specified DNS servers. You can use the Self Service VPN feature to add, modify, or remove DNS configurations.

Static VPN Diagram DNS

Supported vendors

You can use any vendors that support IPsec VPN tunnels. Cloud providers who offer managed VPN instances can also be utilized as long as they support IPsec VPN tunnels. View the FAQ section for more specific examples of cloud provider integrations.

Setup

To set up a static VPN connection between your Appian Cloud environment(s) and your private network, use Self Service VPN in MyAppian. Self Service VPN allows you to configure and manage your VPN connection without opening a support case.

If your configuration is not supported by Self Service VPN, download the Appian Cloud VPN worksheet, complete the sections marked in yellow, and open a case to submit it to Appian Support.

Allowed IP address ranges

Allowed Private Network Address spaces may vary based on the region of your Appian Cloud environment(s). Typically, network spaces in the 192.* range are unrestricted, while certain subnets within the 172.16.0.0/12 and 10.0.0.0/8 ranges are restricted. The Automatic Private IP Addressing (APIPA) address range, 169.254.0.0/16, is restricted as well. Contact Appian Support to verify the restricted spaces for your specific Appian Cloud environment(s) if you would like to use subnets in these ranges. When configuring your private network space participating in the VPN tunnel, we recommend to narrow down your subnets as much as possible (see IP address range restrictions).

The allow list of IP address ranges that are generally available for your use can be found below:

10.0.0.0/16
10.2.0.0/15
10.4.0.0/14
10.8.0.0/13
10.17.0.0/16
10.19.0.0/16
10.21.0.0/16
10.23.0.0/16
10.25.0.0/16
10.27.0.0/16
10.29.0.0/16
10.31.0.0/16
10.96.0.0/14
10.101.0.0/16
10.102.0.0/15
10.104.0.0/13
10.112.0.0/12
10.128.0.0/14
10.132.0.0/16
10.136.0.0/13
10.144.0.0/12
10.160.0.0/11
10.192.0.0/10
172.16.0.0/16
172.31.2.0/23
172.31.4.0/22
172.31.8.0/21
172.31.16.0/20
172.31.32.0/19
172.31.64.0/18
172.31.128.0/17
192.168.0.0/16

Note: The 172.30.0.0/24 and 172.31.0.0/24 subnets are reserved for VPN configurations to prevent IP address conflicts with Appian internal resources. Contact Appian Support if there are any concerns or conflicts associated with those subnets.

Alternative VPN configurations

If you are using IP-based VPN routing and have configurations that include private IP addresses that fall outside Appian Cloud's allowed IP ranges, then you must implement one of the following alternatives:

Switch to use DNS configurations.
Implement a Network Address Translation (NAT) on your network to expose your private subnets in a different range.
Assign new IP addresses (public or private) to your systems so that the new IP addresses don't conflict.
Opt for AWS PrivateLink integration instead of VPN.

IP address range restrictions

When configuring what traffic should go over your VPN tunnels, use specific IP addresses with a /32 CIDR notation in your VPN configurations as much as possible. Note that specifying IP address or Classless Inter-Domain Routing (CIDR) ranges larger than a /24 is not supported. You can specify multiple /24 ranges if necessary.

VPN encryption configurations

The following combinations of encryption configurations are supported for your VPN tunnels:

Encryption algorithm	Authentication algorithm	DH Group
AES128-CBC	SHA2-256 or SHA2-384 or SHA2-512	DH15 or DH16 or DH17 or DH18 or DH19 or DH20 or DH21
AES256-CBC	SHA2-256 or SHA2-384 or SHA2-512	DH20 or DH21
AES128-GCM	N/A	DH15 or DH16 or DH17 or DH18 or DH19 or DH20 or DH21
AES256-GCM	N/A	DH20 or DH21

The supported encryption configurations are set to ensure the security of your VPN tunnels. Other encryption configurations are deprecated.

Internet Key Exchange

Internet Key Exchange (IKE) version 1 is a deprecated IKE protocol for use with Appian Cloud VPN. This deprecation is in line with the Internet Engineering Task Force's (IETF) published deprecation announcement, and the US National Institute for Standards and Technology (NIST) recommendation against the use of IKEv1.

Support for IKEv1 protocol will eventually be removed. If your Appian Cloud VPN tunnel is currently using IKEv1, update your configurations to use IKEv2.

FAQ

Can I utilize VPN connections to connect to my Amazon Web Services (AWS) VPC?

Yes, AWS provides connection options that are compatible with Appian Cloud VPN integration. Specifically, reference the AWS documentation on Site-to-site VPN Routing.

Can Appian VPN be utilized with AWS Transit Gateway?

Yes, you can create a VPN attachment to your Transit Gateway hosted on your AWS account. You can then use the resulting Site-to-Site VPN connection resource to establish a tunnel to your Appian Cloud environment. Reference the AWS public documentation on VPN attachments to Transit Gateway for more details.

Does Appian Cloud use AWS Site-to-Site VPN?

No, Appian Cloud uses a third-party software VPN appliance (LibreSwan) to establish a VPN connection to your remote network.

What is the MTU for Appian Cloud VPN connections?

Appian Cloud VPN connections use a Maximum Transmission Unit (MTU) of 1500 bytes. This value is not configurable through Self Service VPN. If your network requires a different MTU—for example, to account for IPsec encapsulation overhead and avoid packet fragmentation—contact Appian Support to request a change.

Feedback

Was this page helpful?