orchestrator

latest

false

Getting started
- Introduction
- Robots
  - Robot Statuses
  - Robot Settings
- Auto Updating Client Components
- Time-to-live Periods
- Orchestrator Outbound IP Addresses
- Notifications
Best practices
- Organization Modeling in Orchestrator
- Automation Best Practices
- Optimizing Unattended Infrastructure Using Machine Templates
- Unattended automation
- Organizing Resources With Tags
- Orchestrator Read-only Replica
- Exporting grids in the background
Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Robots
- Folders
- Monitoring
- Access control
- Configuring automation capabilities
- Machines
- Packages
- Audit
- Credential Stores
  - Integrating credential stores
  - Managing credential stores
- Webhooks
  - Types of Events
  - Managing Webhooks
- Licensing
  - Managing Your Licenses
- Settings
Cloud robots
- Automation Cloud™ Robots - VM
- Configuring VPN for cloud robots
- My notifications
Folders Context
- About the Folders Context
- Home
Automations
- About Automations
Processes
- About Processes
- Managing Processes
- Managing Package Requirements
- Recording
Jobs
- About Jobs
- Managing Jobs
- Job States
- Working with long-running workflows
- Running Personal Remote Automations
- Process Data Retention Policy
Apps
- About Apps
- Publishing an App to a Tenant
- Managing Apps
- Running a Deployed App from a Folder
Triggers
- About triggers
- Managing triggers
- Managing Non-Working Days
- Using Cron Expressions
  - Triggering jobs on the last day of the month
Logs
- About Logs
- Managing Logs in Orchestrator
- Logging Levels
Monitoring
- About Monitoring
- Machines
- Processes
- Queues
- Queues SLA
Queues
- About Queues and Transactions
- Bulk uploading Queue Items using a CSV file
- Managing Queues in Orchestrator
- Managing Queues in Studio
- Managing Transactions
  - Editing Transactions
  - Field Descriptions for the Transactions .csv File
- Review Requests
Assets
- About Assets
- Managing Assets in Orchestrator
- Managing Assets in Studio
- Storing Assets in Azure Key Vault (read only)
- Storing Assets in HashiCorp Vault (read only)
- Storing Assets in AWS Secrets Manager (read only)
Storage Buckets
- About Storage Buckets
  - CORS/CSP Configuration
- Managing Storage Buckets
Test Suite - Orchestrator
- Test Automation
- Test Cases
  - Field Descriptions for the Test Cases Page
- Test Sets
  - Field Descriptions for the Test Sets Page
- Test Executions
  - Field Descriptions for the Test Executions Page
- Test Schedules
  - Field Descriptions for the Test Schedules Page
- Test Data Queues
- Testing Data Retention Policy
Resource Catalog Service
- About Resource Catalog Service
Authentication
- About Authentication
Integrations
- About Input and Output Arguments
  - Example of Using Input and Output Arguments
Classic Robots
- Robots
- Environments
  - Managing Environments
- Jobs
- Triggers
- Monitoring
  - Robots
- Resources
Troubleshooting
- About Troubleshooting
- Frequently Encountered Orchestrator Errors

Orchestrator User Guide

DELIVERY:

Automation Cloud Automation Cloud Public Sector Automation Suite Standalone

Last updated Nov 25, 2024

Configuring VPN for cloud robots

You can create a VPN gateway for a tenant so that your VM cloud robots can access your on-premises resources that are behind a firewall.

Prerequisites

To set up the VPN gateway, you must meet the following requirements:

Have the knowledge or assistance from your network administrator or someone who has a good understanding of VPN and networking concepts.
Be an organization administrator in Automation Cloud™.
Have an Orchestrator role that includes the Machines - Edit permission.
Each tenant for which you want to create a VPN gateway must have at least 5000 robot units allocated to it.
Information from your network administrator:
- A list of reserved IP address ranges located in your on-premises network configuration, in CIDR notation. As part of configuration, you need to specify the IP address range prefixes that we will route to your on-premises location.
  
  Important:
  The subnets of your on-premises network must not overlap with the virtual network subnets to which you want to connect.
- Use compatible VPN devices and have the ability and know-how to configure them, as described in About VPN devices for connections - Azure VPN Gateway. For details on the default connection parameters, read the Default policies for Azure.
- Your VPN device must use externally-facing, public IPv4 addresses.
- A pre-shared key (PSK) for each VPN device.
  Note:
  The pre-shared key should consist of a maximum 128 printable ASCII characters.
  
  Do not use space, hyphen -, or tilde ~ characters.
- You must enter a single IP range, in CIDR notation, with a mask of /25.

The VPN gateway workflow schema

This schema shows how the VPN connection is established between your local network and the networks of your cloud robot VMs.

Connecting to a VPN gateway allows your ACR-VMs to access the restricted resources on your local network.

The flow is as follows:

In your local network, set up the IP range (1) for the VPN Gateway. This represents the IP range of your on-prem network.
In your local network, provide the IP ranges of the ACR-VM pools (6, 7) to allow their traffic into the network.
Set up the IP range of the VPN gateway (4), which represent the underlying resources used to host the VPN Gateway in the cloud. The /25 is the mandatory suffix for the gateway. This tells your local network that the VPN gateway may require up to 128 IP addresses to operate.
A public IP is created for the gateway (5), which your local network must target in order to initiate a connection.
Your local network connects to the VPN gateway through a site-to-site tunnel (3), and, at this point, the VPN gateway targets the public IP of your local network (2), and your local network targets the public IP of the gateway (5). Your on-premise resources are available in the VPN Gateway and any connected ACR-VM can access them.
The ACR-VM pools have separate networks. To connect an ACR-VM pool to the VPN gateway, set up an IP range for that pool (6, 7).

Important:
It is important that the IP range of the pools you want to configure (6, 7) do not overlap with any other IP ranges in your entire network space (including your local network (1) and any resources used by the UiPath® VPN Gateway (4)).

Step 1. Create the VPN gateway

To create a VPN gateway for a tenant:

In Automation Cloud, go to Admin.

If not already enabled, enable the new Admin experience using the toggle from the header.
In the Tenants panel on the left, click the tenant for which you want to create a VPN gateway.

The settings page for the selected tenant opens.
Click the VPN Gateway tile.
Click Create gateway for Tenant.

The Create gateway panel opens at the right of the page.
In the Name field, type a name for the gateway, as you want it to be displayed in the tenant's VPN Gateway page.
In the Address space for VPN gateway vnet field, add the IP addresses you obtained from your network administrator. Use CIDR notation, with a mask of /25. For example, 10.

This should be an IP address range that your network administrator reserved for this virtual network. Also, it must not overlap with the IP ranges representing the on-premises network or the IP ranges for the VM pool (defined later).

Important:
Vnet ranges for the gateway or for the VM pool cannot be modified once created.
(Optional) If you want to use a DNS for this connection, click Add DNS Address and then:
1. In the DNS Address field, add a DNS address.
2. To add additional DNS addresses, click Add more to add another field and then add the address to that field.
  
  Note: You can add DNS addresses later, after the VPN gateway is created, but that requires that you restart all VMs that are connected to the gateway.
Click Create at the bottom of the panel to create the VPN gateway connection.

Note: If the current tenant does not have at least 5000 robot units allocated to it, you cannot create the gateway.

The panel closes and the VPN gateway status is Provisioning. Deploying the gateway can take up to 45 minutes to complete.

When complete, the status Deployed is displayed on the card of the gateway.

Note: If the status is Failed, delete the gateway and re-create it by following the above instructions.

Step 2. Create cloud robot templates

Note: The VPN gateway must show the Deployed status before you can perform this step.

The Vnet for a cloud robot template is created when each template is created.

Cloud robots - VM: In Orchestrator, create one or more Cloud robot - VM pools, following the instructions in Creating the cloud robot pool . During setup, make sure to select the Connect VPN Gateway option.

For each pool, you can monitor the VPN status from the Machines > Manage Cloud Robot - VM page.

Note:

Existing Cloud robot - VM pools cannot connect to the VPN gateway. You must create new ones.

Additionally, for pools that were set up to connect to the tenant's VPN gateway, you have the option to edit the pool and switch off the Enable VPN Integration toggle to disconnect the pool. Once disconnected, you cannot reconnect the pool to the VPN gateway.

Step 3. Creating the site-to-site connection

To configure the VPN gateway to connect to a VPN device:

In Automation Cloud, go to Admin > Tenant > VPN Gateway.
On the tile for the gateway, click Add connection.

The Create connection panel opens at the right of the page.
Fill in the fields with the details for the VPN device.

The IP ranges represent the on-premises network.
Click Create at the bottom of the panel to add the connection.

The panel closes and the new connection is displayed on the Connections page.

The connection is ready to use when the Connection status column displays Connected.

Note: If the connection status is Connection failed, you must delete the connection ( docs image

> Delete) and create it again.

To add more connections, on the Connections page, click Create connection above the table, on the right.

Note: You can add up to 25 connections.

Step 4. Setting up VPN devices

Your network administrator can now:

Set up your VPN device from your on-premise network.

The PSK must match the one specified for the connection created in step 3.
Add the address spaces used to configure the VPN gateway and Vnets for cloud robot templates to the allow list of your network.

For a list of supported VPN devices and for RouteBased configuration instructions, see About VPN devices for connections - Azure VPN Gateway in the Microsoft documentation.

Frequently asked questions

Data residency

The VPN gateway for a tenant is automatically created in the same region as the region of the tenant and you cannot change the region.

Switching to a different region

If a VPN gateway already exists and you chose to move your tenant to a different region, you can either:

continue to use the gateway in the old region or
delete the existing VPN gateway and create a new one, which is created in the current region of the tenant.

Data retention

If you disable a tenant that has a VPN gateway, you have a 60-day grace period before you lose access to your VPN device. After 60 days, your VPN gateway is permanently deleted from your tenants.

If you re-enable the tenant within 60 days, your VPN gateway is not deleted and available for use.

License expiration

If you no longer have the required robot units, you have a 60-day grace period before you lose access to your VPN device. After 60 days, your VPN gateway is permanently deleted from your tenants.

On this page

Prerequisites
The VPN gateway workflow schema
Step 1. Create the VPN gateway
Step 2. Create cloud robot templates
Step 3. Creating the site-to-site connection
Step 4. Setting up VPN devices
Frequently asked questions
Data residency
Data retention
License expiration

Was this page helpful?

PREVIOUSFrequently Asked Questions

NEXTMy notifications

Support and Services

Get The Help You Need

UiPath Academy

Learning RPA - Automation Courses

UiPath Forum

UiPath Community Forum

Trust and Security

Cookies Policy