Getting Started With VPN

You and Twilio will have to configure our respective IPSec VPN components to encrypt traffic traversing the Internet.

Your components

• VPN gateway. A network device (e.g. router, firewall) supporting IPSec protocol suite. The device needs to be assigned an IPv4 address routable on the Internet.

• IP routes. One or more of your IP networks that will have access to Twilio. Your border devices (e.g. IP-PBX, SIP-PRI IAD, Session Border Controller, NAT gateway, etc.) will reside in these networks. Your VPN gateway and IP routes behind it form the encryption domain. Note that your IP routes have to be globally unique ("public IPs") - as opposed to RFC 1918 address ranges - to avoid conflicts with other networks that Twilio platform is peered with. In other words, your IP routes have to be outside of the following ranges:

            10.0.0.0 - 10.255.255.255

            172.16.0.0 - 172.31.255.255

            192.168.0.0 - 192.168.255.255

• Firewall. The system that monitors and controls your incoming and outgoing network traffic. The firewall will have to allow your border devices to communicate with Twilio network.

Twilio components

• VPN gateway. Twilio has a fixed VPN gateway at each Twilio Interconnect location.

• IP routes. All Twilio signaling and media traffic will come from fixed IP networks. Each Twilio Interconnect location has its own unique IP routes. Our VPN gateway and IP routes behind it form the encryption domain.

• Twilio Interconnect connection. Twilio will provision bandwidth for your connection at Twilio Interconnect location specified by you. See connection bandwidth and location options listed below. For high availability, we strongly recommend connecting to at least two of our geographically redundant Twilio Interconnect locations. For example, you can select a 100-Mbps connection in Ashburn, Virginia and a 100-Mbps connection in San Jose, California to create redundant connections to Twilio on both coasts of the United States.

      Bandwidth

         - 10-Mbps connection

         - 100-Mbps connection

         - 500-Mbps connection (available in London & Singapore)

         - 1-Gbps connection

      Location

         - Ashburn, Virginia, United States

         - San Jose, California, United States

         - London, United Kingdom

         - Singapore

• IPsec pre-shared key. Twilio will issue a pre-shared key for IKE phase I authentication and send the key to you via a secure communication channel.

What you will need to create a Twilio Interconnect connection

Configuring your private connection to Twilio

Step 1: Let your Twilio onboarding contact know your:

• desired connection location and bandwidth
• VPN gateway IP
• IP routes
• Twilio account SID
• Email address to send pre-shared key to via secure file exchange

Step 2: Receive IPSec VPN specification and pre-shared key from Twilio

Your on-boarding contact at Twilio will share our IPSec VPN specification and your pre-shared key.

Step 3: Bring the IPSec tunnel up

Configure your VPN gateway using Twilio's IPSec VPN specification. Advertise Twilio IP routes to your internal network (i.e reverse route injection). This will allow your SIP-enabled elements route traffic to Twilio.

Next step

Configure your Trunk using Twilio Interconnect

or

Configure your Client soft device using Twilio Interconnect region