diff --git a/cloudstack/resource_cloudstack_vpn_connection.go b/cloudstack/resource_cloudstack_vpn_connection.go
index d1bf4d89..c150fa9e 100644
--- a/cloudstack/resource_cloudstack_vpn_connection.go
+++ b/cloudstack/resource_cloudstack_vpn_connection.go
@@ -49,6 +49,13 @@ func resourceCloudStackVPNConnection() *schema.Resource {
 				Required: true,
 				ForceNew: true,
 			},
+
+			"passive": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  false,
+				ForceNew: true,
+			},
 		},
 	}
 }
@@ -61,6 +68,7 @@ func resourceCloudStackVPNConnectionCreate(d *schema.ResourceData, meta interfac
 		d.Get("customer_gateway_id").(string),
 		d.Get("vpn_gateway_id").(string),
 	)
+	p.SetPassive(d.Get("passive").(bool))
 
 	// Create the new VPN Connection
 	v, err := cs.VPN.CreateVpnConnection(p)
@@ -90,6 +98,7 @@ func resourceCloudStackVPNConnectionRead(d *schema.ResourceData, meta interface{
 
 	d.Set("customer_gateway_id", v.S2scustomergatewayid)
 	d.Set("vpn_gateway_id", v.S2svpngatewayid)
+	d.Set("passive", v.Passive)
 
 	return nil
 }
diff --git a/cloudstack/resource_cloudstack_vpn_connection_test.go b/cloudstack/resource_cloudstack_vpn_connection_test.go
index 1eef989e..d94f9f7b 100644
--- a/cloudstack/resource_cloudstack_vpn_connection_test.go
+++ b/cloudstack/resource_cloudstack_vpn_connection_test.go
@@ -43,6 +43,10 @@ func TestAccCloudStackVPNConnection_basic(t *testing.T) {
 						"cloudstack_vpn_connection.foo-bar", &vpnConnection),
 					testAccCheckCloudStackVPNConnectionExists(
 						"cloudstack_vpn_connection.bar-foo", &vpnConnection),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_connection.foo-bar", "passive", "false"),
+					resource.TestCheckResourceAttr(
+						"cloudstack_vpn_connection.bar-foo", "passive", "true"),
 				),
 			},
 		},
@@ -167,4 +171,5 @@ resource "cloudstack_vpn_connection" "foo-bar" {
 resource "cloudstack_vpn_connection" "bar-foo" {
   customer_gateway_id = cloudstack_vpn_customer_gateway.bar.id
   vpn_gateway_id = cloudstack_vpn_gateway.foo.id
+  passive = true
 }`
diff --git a/website/docs/r/vpn_connection.html.markdown b/website/docs/r/vpn_connection.html.markdown
index 56896acc..f8ef1129 100644
--- a/website/docs/r/vpn_connection.html.markdown
+++ b/website/docs/r/vpn_connection.html.markdown
@@ -31,6 +31,11 @@ The following arguments are supported:
 * `vpn_gateway_id` - (Required) The VPN Gateway ID to connect. Changing
     this forces a new resource to be created.
 
+* `passive` - (Optional) If `true`, the connection waits for the remote side
+    to initiate it instead of connecting itself. When connecting two VPCs to
+    each other, set this on one of the two connections. Defaults to `false`.
+    Changing this forces a new resource to be created.
+
 ## Attributes Reference
 
 The following attributes are exported: