Automation Cloud admin guide

Last updated Feb 19, 2026

Configuration steps

Step 1. Create the VPN gateway

To create a VPN gateway for a tenant:

In Automation Cloud^TM, go to Admin.

If not already enabled, enable the new Admin experience using the toggle from the header.
From the Tenants panel on the left side, select the tenant for which you want to create a VPN gateway.

The settings page for the selected tenant opens.
Select the VPN Gateway tile.
Select Create gateway for Tenant. The Create gateway panel opens
In the Name field, type a name for the gateway, as you want it to be displayed in the tenant's VPN Gateway page.
In the Address space for VPN gateway vnet field, add the IP addresses you obtained from your network administrator.
- Use CIDR notation
- Minimum supported: /27
- Recommended: /25 or larger (private endpoints require /25 or larger)
- Cannot be modified after creation
Important:
- Vnet ranges for the gateway or for the VM pool cannot be modified once created.
- Even if you assign a CIDR block to the VPN gateway network (for example, /25), traffic from machine pools or serverless machine templates with VPN enabled will not originate from this CIDR.
  
  The actual source IP addresses used for outgoing traffic are those of the CIDRs assigned to the individual machine pool or serverless template.
  
  Make sure to allow traffic from the CIDRs of your machine pools or serverless templates, not from the VPN gateway network's CIDR.
(Optional) If you want to use a DNS for this connection, select Add DNS Address and then:
1. In the DNS Address field, add a DNS address.
2. To add additional DNS addresses, select Add more to add another field and then add the address to that field.
  
  Note: You can add DNS addresses later, after the VPN gateway is created, but that requires that you restart all VMs that are connected to the gateway.
Select Create at the bottom of the panel to create the VPN gateway connection.

The panel closes and the VPN gateway status is Provisioning.

When complete, the status Deployed is displayed on the card of the gateway.

Note: If the status is Failed, delete the gateway and re-create it by following the previous instructions.

Step 2. Create cloud robot templates

Note: The VPN gateway must show the Deployed status before you can perform this step.

The Vnet for a cloud robot template is created when each template is created.

Cloud robots - VM

In Orchestrator, create one or more Cloud robot - VM pools, following the instructions in Creating the cloud robot pool . During setup, make sure to select the Connect VPN Gateway option.

For each pool, you can monitor the VPN status from the Machines > Manage Cloud Robot - VM page.

Note:

Existing Cloud robot - VM pools cannot connect to the VPN gateway. You must create new ones.

Additionally, for pools that were set up to connect to the tenant's VPN gateway, you have the option to edit the pool and switch off the Enable VPN Integration toggle to disconnect the pool. Once disconnected, you cannot reconnect the pool to the VPN gateway.

Cloud robots - serverless

In Orchestrator, edit or create Cloud robot - Serverless templates, following the instructions in Automation Cloud™ robots - Serverless . During setup, make sure to configure options on the Network Configuration page.

Step 3. Creating the site-to-site connection

With the VPN gateway deployed, you can now connect your on-premises networks to it.

The gateway card displays the public IP address, which is an essential information for the tunnel connection.

To configure the VPN gateway to connect to a VPN device:

In Automation Cloud^TM, go to Admin > Tenant > VPN Gateway.
On the tile for the gateway, select Add connection.

The Create connection panel opens at the right of the page.

Provide values for the following fields:

Option	Description
Connection name *	Provide a name for your connection.
Shared key (PSK) *	Write a secret phrase or string. You need to remember this exact key and provide it when you configure the connection on your on-premises device.
Public IP for the VPN device *	Provide the public IP address of your on-premises VPN device. Important: Do not provide the public IP address of the VPN gateway shown on the card. That address needs to be configured on your on-premises device.
Address space for the on-premises device *	Specify all private IP address ranges on your on-premises network that need to communicate through this connection. Because the gateway does not support Border Gateway Protocol (BGP), manual configuration is required. If you have specified a DNS server IP address for the gateway, ensure that address falls within one of the private IP address ranges you define here.

Optionally, you can define custom configurations for the IPSec/IKE policy. Use this section to ensure compatibility with the specific security settings required by your on-premises VPN device, or to implement advanced security policies tailored to your organization needs. To do this, turn on the Custom IPSec/IKE policy toggle.
1. For IKE Phase 1, provide values for the following fields:
  
  Encryption *
  
  Provide the matching encryption method for the initial secure key exchange (IKE Phase 1). This must be identical to the UiPath Gateway setting (for example, AES-256, GCMAES).
  
  Possible values: GCMAES256, GCMAES128, AES256, AES192, AES128
  
  Integrity *
  
  Provide the matching data integrity check for the initial IKE Phase 1 communication (for example, SHA-256, SHA-512). This must match the UiPath Gateway.
  
  Possible values: SHA384, SHA256, SHA1, MD5
  
  DH Group *
  
  Provide the matching Diffie-Hellman (DH) group for the secure key exchange in IKE Phase 1 (for example, Group 14, Group 19). This must match the UiPath Gateway.
  
  Possible values: DHGroup24, ECP384, ECP256, DHGroup14, DHGroup2048, DHGroup2, DHGroup1, None
2. For IKE Phase 2 (IPSec), provide values for the following fields:
  
  IPsec Encryption *
  
  Provide the matching encryption method for data traffic within the VPN tunnel (IPSec Phase 2) (for example, AES-256, 3DES). This must match the UiPath Gateway.
  
  Possible values: GCMAES256, GCMAES192, GCMAES128, AES256, AES192, AES128, DES3, DES, None
  
  IPsec Integrity *
  
  Provide the matching data integrity check for traffic within the VPN tunnel (IPSec Phase 2) (for example, SHA-256, SHA-512). This must match the UiPath Gateway.
  
  Possible values: GCMAES256, GCMAES192, GCMAES128, SHA256, SHA1, MD5
  
  PFS Group *
  
  Provide the matching Perfect Forward Secrecy (PFS) group for IPSec Phase 2, if enabled on the UiPath Gateway (for example, Group 14, Group 19). If one side uses PFS, the other should match or disable it.
  
  Possible values: PFS24, ECP384, ECP256, PFS2048, PFS2, PFS1, None
  
  IPSec SA lifetime in Kilobytes *
  
  Provide the duration for active secure connections (IKE and IPSec). These are local settings; matching is not strictly required, but similar values are recommended for consistency.
  
  Possible values: minimum 1,024, default 10,2400,000
  
  IPsec SA lifetime in seconds *
  
  Provide the duration for active secure connections (IKE and IPSec). These are local settings; matching is not strictly required, but similar values are recommended for consistency.
  
  Possible values: minimum 300, default 27,000
Select Add connection. Once the configuration is complete, it may take some time for the connection status to update to Connected.

The panel closes and the new connection is displayed on the Connections page. The connection is ready to use when the Connection status column displays Connected.

A Connected status means the Pre-Shared Key (PSK), peer Public Internet Protocol (IP) address, and IPSec/IKE Policy parameters are configured correctly, and an encrypted tunnel exists.

Serverless and Cloud Robots inherently do not accept incoming network connections. An exception exists for Cloud Robots, which allow Remote Desktop Protocol (RDP) connections only when explicitly enabled.

Note: If the connection status is Connection failed, you must delete the connection and create it again.

To add more connections, on the Connections page, select Create connection.

Note: You can add up to 25 connections.

On this page