DocsICP FilingConsole
官方文档
首页

Standard VPN Gateway quick start

更新时间：
复制 MD 格式
产品详情
我的收藏

Connect your on-premises Internet Data Center (IDC) to an Alibaba Cloud Virtual Private Cloud (VPC) using a Traditional VPN Gateway and open-source strongSwan software.

Scenario

A company has created a VPC in the China (Hangzhou) region. The company wants to use a Traditional VPN Gateway with strongSwan to enable network connectivity between the cloud VPC and the on-premises IDC.

In this scenario, the IDC has only one public egress IP and establishes a dual-tunnel IPsec connection with the Alibaba Cloud VPN Gateway:

image

Resource plan

  • Cloud: VPC with CIDR block 10.0.0.0/16 in the China (Hangzhou) region

    • vSwitch 1: Availability Zone I, CIDR block 10.0.0.0/24

    • vSwitch 2: Availability Zone J, CIDR block 10.0.1.0/24

    • ECS instance: located in vSwitch 1, IP address 10.0.0.1

    • VPN Gateway: after creation, the system automatically assigns two public IP addresses:

      • IPsec Address 1 (active tunnel): [[0]]

      • IPsec Address 2 (standby tunnel): [[0]]

  • On-premises: On-premises IDC CIDR block 172.16.0.0/16

    • strongSwan device: private IP 172.16.0.1

    • Public egress IP: XX.XX.3.3

  • Encryption configuration: Both cloud-side and on-premises must be consistent.

    • IKE version: v2

    • Negotiation mode: main

    • Encryption algorithm: AES128 / SHA1 / DH Group 2.

    • SA lifetime: 86400 seconds.

  • Routing: Use destination-based routing. Destination-based routing specifies "which traffic flows through the VPN tunnel" — you only need to define the CIDR blocks on both ends, and traffic matching those blocks is treated as "interesting traffic". The system automatically routes it through the tunnel and generates the corresponding route.

Important

This tutorial covers only the single-public-egress-IP scenario with static routing. For dual-public-egress-IP or BGP dynamic routing scenarios, see Configure strongSwan.

Prerequisites

  • The VPC CIDR block and the on-premises IDC CIDR block must not overlap.

  • Create a VPC as described in the resource plan, with one vSwitch in each of two different availability zones. Deploy at least one ECS instance in the VPC to verify connectivity.

  • Deploy a Linux server in the on-premises IDC (this tutorial uses CentOS Stream 9) with one public egress IP. You will install strongSwan on this server as the on-premises gateway.

Step 1: Create a Traditional VPN Gateway

  1. Go to the VPN Gateway page console page and click Create VPN Gateway to configure the following key parameters:

    • Instance Name: Enter a meaningful instance name, such as vpn-gw-docdev.

    • Region and Availability Zone: Select the region where the VPC is located. This tutorial uses China (Hangzhou).

    • Gateway Type: Select Standard.

    • Network Type: Select Public.

    • VPC: Select the VPC that you want to connect.

    • vSwitch 1: Select a vSwitch in Availability Zone I.

    • vSwitch 2: Select a vSwitch in Availability Zone J. It must be in a different availability zone from vSwitch 1 to ensure cross-zone high availability. If no vSwitch is available, create one first.

    • Bandwidth specification: Select the bandwidth based on your business requirements. This tutorial uses the default value.

    • IPsec-VPN: Enable.

    • SSL-VPN: Close.

    • Billing cycle: Use the default value.

    • Create Service-Linked Role: Make sure a service-linked role is created. The VPN Gateway uses this role to access resources in other cloud products.

  2. Click Buy Now and complete the payment. It takes about 1 to 5 minutes to initialize the VPN Gateway instance. The system assigns two public IP addresses to the VPN Gateway for the active and standby tunnels.

Step 2: Create a customer gateway

A customer gateway records the public IP address of your on-premises gateway device in Alibaba Cloud. In this scenario the IDC has only one public egress IP, so you need to create only one customer gateway.

  1. In the left-side navigation pane of the VPN Gateway console, click Customer Gateways.

  2. Configure the following parameters:Create Customer Gateway

    • Name: Enter a name for the customer gateway, such as cgw-idc-docdev.

    • IP Address: Enter the public egress IP of the on-premises IDC (XX.XX.3.3).

Step 3: Create an IPsec connection

  1. In the left-side navigation pane of the VPN Gateway console, click IPsec Connections.Bind VPN Gateway

  2. Configure the basic parameters of the IPsec connection:

    • Name: Enter a meaningful resource name, such as ipsec-docdev.

    • Region: Select China (Hangzhou).

    • Bind VPN Gateway: Select the VPN Gateway created in Step 1.

    • Routing Mode: Select Destination Routing Mode. In this mode, you define the CIDR blocks on both ends, and the system automatically routes matching traffic through the tunnel and generates the corresponding route.

    • Local Network: Enter the VPC CIDR block 10.0.0.0/16.

    • Remote Network: Enter the IDC CIDR block 172.16.0.0/16.

    • Effective Immediately: Select Yes. The Alibaba Cloud side initiates negotiation with the peer, so the connection can be quickly established after the peer is configured.

    • Enable BGP: Not enabled in this tutorial.

  3. Configure the tunnel parameters:

    • Tunnel 1 (Primary):

      • Customer Gateway: Select the customer gateway created in Step 2.

      • Pre-Shared Key: The pre-shared key used for identity authentication during IPsec tunnel negotiation. The pre-shared key on the local and peer ends must be identical, otherwise the tunnel cannot be established. Use a strong password that contains uppercase letters, lowercase letters, digits, and special characters.

      • Encryption Configuration: Keep the default settings. This tutorial uses the default encryption algorithm (AES128), authentication algorithm (SHA1), and DH group (group2). To manually specify algorithms, expand Encryption Configuration to modify them.

        Important

        If you need to change the configuration, ensure that the following parameters are consistent between cloud-side and on-premises: IKE version, negotiation mode, and SA lifetime.

    • Tunnel 1 (Backup):

      • Customer Gateway: Select the same customer gateway as the active tunnel (the IDC in this scenario has only one public egress IP).

      • Pre-Shared Key: This tutorial uses the same key as the active tunnel.

      • Encryption Configuration: Keep the same configuration as the active tunnel. Use the default values.

  4. After you click OK, the system prompts you whether to publish the route. Click Cancel for now.

    It takes about 5 minutes to initialize the IPsec connection resource (status: Preparing), during which you cannot configure routes. You can proceed to Step 4 to configure strongSwan first. Route configuration is completed in Step 5.

  5. Record the public IPs of the two cloud-side tunnels. You will need them when you configure strongSwan:

    • Go back to the IPsec-VPN connection list page and find the IPsec connection you just created.

    • In the Gateway IP Address column, record IPsec Address 1 and IPsec Address 2. This tutorial uses XX.XX.1.1 and XX.XX.2.2 as examples.

Step 4: Configure strongSwan

Important

The following information about third-party products is for reference only. Alibaba Cloud does not make any warranties, express or implied, for the performance or reliability of third-party products, or for any impact from operations you perform on them.

The following uses the CentOS Stream 9 64-bit operating system as an example to configure strongSwan. For other operating systems, see official strongSwan documentation.

1. Configure firewall rules

On the strongSwan device, allow ESP protocol (IP protocol number 50), UDP port 500, and UDP port 4500 to permit access from the two cloud-side IPsec addresses.

The following uses iptables as an example. Adjust the commands based on the firewall tool you actually use:

iptables -I INPUT -s XX.XX.1.1,XX.XX.2.2 -p esp -j ACCEPT
iptables -I INPUT -s XX.XX.1.1,XX.XX.2.2 -p udp --dport 500 -j ACCEPT
iptables -I INPUT -s XX.XX.1.1,XX.XX.2.2 -p udp --dport 4500 -j ACCEPT

2. Enable IP forwarding

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sudo sysctl -p

3. Install strongSwan

dnf install epel-release -y
dnf install strongswan -y

Step 4: Configure strongSwan

  1. Back up the original configuration file: mv /etc/strongswan/swanctl/swanctl.conf /etc/strongswan/swanctl/swanctl.conf.bak

  2. Create a new configuration file: vi /etc/strongswan/swanctl/swanctl.conf

  3. Add and save the following configuration. Replace the IP addresses and pre-shared key in the example with your actual values:

    # strongSwan dual-tunnel IPsec-VPN configuration for: Alibaba Cloud Traditional VPN Gateway + on-premises single public egress IP + destination-based routing (traffic selector)
#
# Only parameters marked with "(Modify)" need to be changed for your environment. Keep all other parameters as default.
# Algorithm note: aes128-sha1-modp1024 = AES-128 / SHA-1 / DH Group 2 (console default)
# Active/standby logic: vco1 (priority=1) is the active tunnel, and vco2 (priority=2) is the standby tunnel. Failover is automatic when the active tunnel fails.

connections {

   # === Tunnel 1 (Active) ===
   vco1 {
      version = 2
      dpd_delay = 10
      rekey_time = 84600
      over_time = 1800
      proposals = aes128-sha1-modp1024
      encap = yes

      local_addrs  = 172.16.0.1                # (Modify) Private IP of the strongSwan NIC. In a NAT environment, use the private IP. If the NIC is bound to the public IP, use the public IP.
      local {
         auth = psk
         id = XX.XX.3.3                        # (Modify) On-premises public egress IP
      }

      remote_addrs = XX.XX.1.1                 # (Modify) Public IP of Tunnel 1 on Alibaba Cloud
      remote {
         auth = psk
         id = XX.XX.1.1                        # (Modify) Public IP of Tunnel 1 on Alibaba Cloud. Must match remote_addrs above.
      }

      children {
         vco_child1 {
            local_ts  = 172.16.0.0/16          # (Modify) On-premises traffic selector CIDR block
            remote_ts = 10.0.0.0/16            # (Modify) Alibaba Cloud traffic selector CIDR block
            mode = tunnel
            rekey_time = 85500
            life_time = 86400
            dpd_action = restart
            start_action = start
            close_action = start
            esp_proposals = aes128-sha1-modp1024
            priority = 1                       # Specifies the active tunnel. Do not modify.
         }
      }
   }

   # === Tunnel 2 (Standby) ===
   vco2 {
      version = 2
      dpd_delay = 10
      rekey_time = 84600
      over_time = 1800
      proposals = aes128-sha1-modp1024
      encap = yes

      local_addrs  = 172.16.0.1                # (Modify) Private IP of the strongSwan NIC. Same as local_addrs of Tunnel 1.
      local {
         auth = psk
         id = XX.XX.3.3                        # (Modify) On-premises public egress IP. Same as Tunnel 1.
      }

      remote_addrs = XX.XX.2.2                 # (Modify) Public IP of Tunnel 2 on Alibaba Cloud
      remote {
         auth = psk
         id = XX.XX.2.2                        # (Modify) Public IP of Tunnel 2 on Alibaba Cloud. Must match remote_addrs above.
      }

      children {
         vco_child2 {
            local_ts  = 172.16.0.0/16          # (Modify) On-premises traffic selector CIDR block. Same as local_ts of Tunnel 1.
            remote_ts = 10.0.0.0/16            # (Modify) Alibaba Cloud traffic selector CIDR block. Same as remote_ts of Tunnel 1.
            mode = tunnel
            rekey_time = 85500
            life_time = 86400
            dpd_action = restart
            start_action = start
            close_action = start
            esp_proposals = aes128-sha1-modp1024
            priority = 2                       # Specifies the standby tunnel. Do not modify.
         }
      }
   }
}

secrets {
   ike-vco1 {
      id = XX.XX.1.1                           # (Modify) Public IP of Tunnel 1 on Alibaba Cloud
      secret = your-psk-here                   # (Modify) Pre-shared key for Tunnel 1. Must match the key on the Alibaba Cloud side.
   }
   ike-vco2 {
      id = XX.XX.2.2                           # (Modify) Public IP of Tunnel 2 on Alibaba Cloud
      secret = your-psk-here                   # (Modify) Pre-shared key for Tunnel 2. Must match the key on the Alibaba Cloud side.
   }
}

5. Start strongSwan and verify the tunnel status

sudo systemctl restart strongswan
swanctl --load-all
watch swanctl --list-sas

If both tunnels show ESTABLISHED and CHILD_SA is in INSTALLED state, the IPsec-VPN connection between the strongSwan device and the Alibaba Cloud VPN Gateway is successfully established.

Step 5: Publish cloud routes

Because this tutorial uses destination-based routing, the system automatically generates a route entry in the VPN Gateway Policy-based Route Table.

You can publish this route to the VPC route table with one click, so that traffic from ECS instances in the VPC to the IDC CIDR block is routed to the VPN Gateway:

  1. Go back to the VPN Gateway list page and click the instance ID of the VPN Gateway created in Step 1 to open the details page.

  2. Click the Policy-based Route Table tab. You can see the destination route entry automatically generated by the system after the IPsec connection uses destination-based routing (destination CIDR block 172.16.0.0/16, next hop is the IPsec connection).

  3. In the Actions column of the target route entry, click Advertise to publish the route to the VPC route table.

    After the route is published, a new route entry is added to the VPC route table: destination CIDR block 172.16.0.0/16, next hop is the VPN Gateway. Traffic from ECS instances in the VPC to the IDC CIDR block is automatically transmitted through the VPN tunnel.

Verify

Verify connectivity

  1. Make sure the ECS security group rules allows inbound ICMP traffic, then log in to the strongSwan device and run the following command to ping the cloud-side ECS:

    ping 10.0.0.1

    If you receive reply packets, the cloud-side VPC and the on-premises IDC can communicate with each other.

  2. Make sure your on-premises firewall allows inbound ICMP traffic. Then, log in to the ECS instance ([[0]]) and ping the strongSwan device:

    ping 172.16.0.1

    If you receive reply packets, the reverse connectivity is also normal.

Verify high availability

  1. Start a long-running ping from the ECS instance to the on-premises server:

    ping 172.16.0.1 -c 10000

  2. Interrupt the active tunnel: in the Alibaba Cloud console, change the pre-shared key of the active tunnel to create a mismatch.

  3. Observe the ping results: traffic resumes after a brief interruption, which indicates that traffic has automatically switched to the standby tunnel.

  4. Restore the active tunnel: change the pre-shared key back to the correct value. Traffic fails back after the tunnel recovers.

Troubleshooting

Common issues and solutions:

Symptom

Possible cause

Solution

Console shows Negotiation Failed

Network connectivity issue

Verify that the strongSwan device can ping the Alibaba Cloud IPsec addresses. Confirm that the on-premises IDC firewall allows UDP port 500 and port 4500.

Pre-shared key mismatch

Verify that the pre-shared keys on both ends are identical, including case and special characters.

IKE parameter mismatch

Check whether the IKE version, encryption algorithm, authentication algorithm, and DH group match on both ends. Traditional VPN Gateways do not support multiple algorithm suites — the parameters must be identical on both ends.

Tunnel is established, but ping fails

Route not published

Check whether the VPN Gateway destination route has been published to the VPC route table.

Security group restriction

Check whether the ECS security group allows ICMP traffic from the IDC CIDR block (172.16.0.0/16).

On-premises firewall restriction

Check whether the on-premises IDC firewall allows traffic from the VPC CIDR block (10.0.0.0/16).

Missing route on the strongSwan device

Confirm that IP forwarding is enabled on the strongSwan device, and that other servers in the IDC have a route to the VPC CIDR block with the strongSwan device as the next hop.

Previous：Enhanced VPN gateway quick startNext：Bind to a transit router