AI

Welcome to Cohesity Documentation.

Ask me anything. From setup and configuration to troubleshooting, architecture, features, and release updates, I'm here to help.

AI may make mistakes. Always verify critical information.

Powered by CoVA

Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. Flex Appliances
  5. NetBackup Flex Appliance Getting Started and Administration Guide
  7. Appliance security
  9. Configuring IPsec for application instances

Configuring IPsec for application instances

Flex Appliance can encrypt the network traffic between an application instance and an external host by establishing a host-to-host IPsec tunnel between them. Use an IPsec tunnel to protect traffic between an application instance (for example, a NetBackup media server instance) and an agentless backup target, such as a NetApp NDMP array or a SAN Array used in DNAS workload, when the third-party interface that the target uses (such as NFS or NDMP) does not provide its own encryption.

You can configure and manage IPsec tunnels entirely from the Flex Appliance Console. The application instance itself requires no configuration changes.

Considerations:

  • Only host-to-host (transport mode) IPsec tunnels are supported. Site-to-site (network-to-network) tunnels are not supported.

  • At the peer site, only a Libreswan-compatible IPsec implementation that supports pre-shared key (PSK) authentication, IKEv2, and host-to-host (transport mode) IPsec is supported. For example, a peer's native VMware ESXi IPsec implementation is not supported for IPsec tunnel creation with the appliance.

  • An IPsec tunnel protects only the application-instance traffic that the tunnel is configured for. It does not protect appliance management traffic or any other host network.

  • The appliance does not automatically rotate or distribute the pre-shared key (PSK). To change the PSK for a tunnel, edit the tunnel on both the appliance and the peer.

  • If the peer device is not a Flex-managed application instance, the peer administrator must configure their endpoint using their own tools. The appliance does not provide a configuration interface for a non-Flex peer. If the peer is another Flex-managed application instance, configure a matching IPsec tunnel on that appliance's own Flex Appliance Console.

  • IPsec configuration, add, edit, and delete operations require the application instance to be offline. You cannot add, edit, or delete an IPsec tunnel while the instance is online.

  • A maximum of 25 IPsec tunnels can be configured per application instance.

Feedback

Was this page helpful?
Previous
Restricting API token access to specific IP addresses
Next
Before you begin

Feedback

Was this page helpful?