Getting Started With VPN

You and Twilio will have to configure our respective IPSec VPN components to encrypt traffic traversing the Internet.

Your components

VPN gateway. A network device (e.g. router, firewall) supporting IPSec protocol suite. The device needs to be assigned an IPv4 address routable on the Internet.
IP routes. One or more of your IP networks that will have access to Twilio. Your border devices (e.g. IP-PBX, SIP-PRI IAD, Session Border Controller, NAT gateway, etc.) will reside in these networks. Your VPN gateway and IP routes behind it form the encryption domain. Note that your IP routes have to be globally unique ("public IPs") - as opposed to RFC 1918 address ranges - to avoid conflicts with other networks that Twilio platform is peered with. In other words, your IP routes have to be outside of the following ranges:

10.0.0.0 - 10.255.255.255

172.16.0.0 - 172.31.255.255

192.168.0.0 - 192.168.255.255

Firewall. The system that monitors and controls your incoming and outgoing network traffic. The firewall will have to allow your border devices to communicate with Twilio network.

Twilio components

VPN gateway. Twilio has a fixed VPN gateway at each Twilio Interconnect location.
IP routes. All Twilio signaling and media traffic will come from fixed IP networks. Each Twilio Interconnect location has its own unique IP routes. Our VPN gateway and IP routes behind it form the encryption domain.
Twilio Interconnect connection. Twilio will provision bandwidth for your connection at Twilio Interconnect location specified by you. See connection bandwidth and location options listed below. For high availability, we strongly recommend connecting to at least two of our geographically redundant Twilio Interconnect locations. For example, you can select a 100-Mbps connection in Ashburn, Virginia and a 100-Mbps connection in San Jose, California to create redundant connections to Twilio on both coasts of the United States.

Bandwidth

- 10-Mbps connection

- 100-Mbps connection

- 500-Mbps connection (available in London & Singapore)

- 1-Gbps connection

Location

- Ashburn, Virginia, United States

- San Jose, California, United States

- London, United Kingdom

- Singapore

IPsec pre-shared key. Twilio will issue a pre-shared key for IKE phase I authentication and send the key to you via a secure communication channel.

What you will need to create a Twilio Interconnect connection

What	Why	How
VPN gateway	to establish an IPSec tunnel between your and Twilio networks	router or firewall supporting IPSec VPN could be procured from network equipment manufacturers such as Cisco and Juniper
IPsec phase I and II specs	to configure your VPN gateway	you will receive Twilio's IPSec VPN specification
Connection bandwidth and location requirements	so that Twilio can provision adequate bandwidth for your needs	to estimate bandwidth, convert your maximum number of concurrent calls to the required throughput in Mbps. Many of our customers found the following ratio helpful: 1 Mbps of bandwidth is roughly equal to 10 concurrent G.711 codec calls. Choose Twilio Interconnect location closest to your VPN gateway.
Pre-shared key	to authenticate your router when creating the IPSec tunnel	you will receive a pre-shared key from Twilio via secure file exchange
Your IP routes	so that Twilio can allow traffic from your network	ask your network administrator for the routes
Twilio’s VPN gateway IP	to establish an IPSec tunnel to Twilio	you will receive our VPN gateway IP with Twilio's IPSec VPN specification
Twilio’s IP routes	to allow traffic from Twilio's network to yours	ask your network administrator to permit traffic from Twilio's routes/ports
Twilio account SID	so that we know which Twilio account is authorized to use your private connection and financially responsible for it	see your Console dashboard

Configuring your private connection to Twilio

Step 1: Let your Twilio onboarding contact know your:

desired connection location and bandwidth
VPN gateway IP
IP routes
Twilio account SID
Email address to send pre-shared key to via secure file exchange

Step 2: Receive IPSec VPN specification and pre-shared key from Twilio

Your on-boarding contact at Twilio will share our IPSec VPN specification and your pre-shared key.

Step 3: Bring the IPSec tunnel up

Configure your VPN gateway using Twilio's IPSec VPN specification. Advertise Twilio IP routes to your internal network (i.e reverse route injection). This will allow your SIP-enabled elements route traffic to Twilio.

Next step

Configure your Trunk using Twilio Interconnect

Configure your Client soft device using Twilio Interconnect region

Need some help?

We all do sometimes; code is hard. Get help now from our support team, or lean on the wisdom of the crowd browsing the Twilio tag on Stack Overflow.

Thanks for rating this page!

Need some help?