DocsICP FilingConsole
官方文档
首页

Connect an Azure VNet to an Alibaba Cloud VPC

更新时间：
复制 MD 格式
产品详情
我的收藏

You can establish an IPsec connection between an Alibaba Cloud VPC and an Azure virtual network (VNet) to enable network communication.

Use case

image

This topic uses the scenario shown in the preceding figure, in which an enterprise:

  • Has an Azure VNet with a VM instance in the Germany West Central region.

  • Has an Alibaba Cloud VPC with an ECS instance in the Germany (Frankfurt) region.

  • Wants to use an Alibaba Cloud IPsec connection associated with a VPN Gateway to enable communication between the Azure VNet and the Alibaba Cloud VPC.

Prerequisites

Before you begin, ensure you have the following resources and information:

  • An Azure virtual network with an Azure VM instance deployed in the Germany West Central region. For more information, see the Azure documentation.

  • An Alibaba Cloud VPC in the Germany (Frankfurt) region that has an ECS instance created.

  • The CIDR blocks of the Azure virtual network and Alibaba Cloud VPC that you want to connect.

    Important

    You can plan the CIDR blocks as required. Make sure that the CIDR blocks for the Azure virtual network and the Alibaba Cloud VPC do not overlap.

    Resource

    CIDR block

    Resource IP address

    Alibaba Cloud VPC

    10.0.0.0/16

    ECS instance IP address:

    10.0.0.1

    Azure virtual network

    192.168.0.0/16

    VM instance IP address:

    192.168.0.1

Step 1: Create an Alibaba Cloud VPN Gateway

Create a VPN Gateway instance on Alibaba Cloud. After creation, the system assigns two IP addresses to the instance. These IP addresses are used to establish an IPsec connection with the Azure virtual network.

  1. Go to the VPN Gateway buy page and configure the following parameters:

    The following table describes only the parameters that are relevant to this topic. For the other parameters, retain the default values or leave them empty. For more information about each parameter, see Create and manage a VPN Gateway instance.

    Parameter

    Description

    Example value

    Instance Name

    Enter a name for the VPN Gateway instance.

    Enter VPN-Gateway-example.

    Region and Zone

    Select the region of the VPN Gateway instance.

    Select Germany (Frankfurt).

    Gateway Type

    Select the type of the VPN Gateway instance.

    Select Standard.

    Network Type

    Select the network type of the VPN Gateway instance.

    Select Public Network.

    Tunnel mode

    The tunnel modes supported by IPsec-VPN connections in the current region.

    • Dual-tunnel

    • Single-tunnel

    For more information about single-tunnel and dual-tunnel modes, see (Deprecated) Associate an IPsec connection with a VPN Gateway.

    In this topic, the default value Dual-tunnel is used.

    VPC

    Select the VPC to associate with the VPN Gateway instance.

    Select the VPC in the Germany (Frankfurt) region.

    VSwitch

    Select a VSwitch from the VPC.

    • If the IPsec connection is in single-tunnel mode, you need to specify only one VSwitch.

    • If the IPsec connection is in dual-tunnel mode, you must specify two VSwitches.

      After you enable the IPsec-VPN feature, the system creates an elastic network interface (ENI) in each of the two VSwitches. The ENIs serve as interfaces for traffic between the VPC and the data center over the IPsec-VPN connection. Each ENI consumes an IP address from its VSwitch.

    Note

    • The system selects the first VSwitch by default. You can manually change the VSwitch or use the default one.

    • After a VPN Gateway instance is created, you cannot change the VSwitches associated with it. You can view the associated VSwitches, the availability zones where the VSwitches reside, and the ENI information on the instance details page.

    Select a VSwitch from the VPC.

    vSwitch 2

    Select the second VSwitch from the VPC.

    • To implement zone-level disaster recovery for the IPsec-VPN connection, you must specify two VSwitches that are deployed in different availability zones within the VPC associated with the VPN Gateway instance.

    • For regions that support only one availability zone, zone-level disaster recovery is not supported. We recommend that you specify two different VSwitches in the availability zone to ensure high availability for the IPsec-VPN connection. You can select the same VSwitch as the first VSwitch.

    Note

    If the VPC does not have a second VSwitch, you can create one. For more information, see Create and manage a vSwitch.

    Select the second VSwitch from the VPC.

    IPsec-VPN

    Select whether to enable or disable the IPsec-VPN feature. Default value: Enabled.

    Select Enable.

    SSL-VPN

    Specifies whether to enable the SSL-VPN feature. Default value: Disable.

    Select Disable.

  2. Return to the VPN Gateway page to view the created VPN Gateway instance.

    The status of a newly created VPN gateway instance is Preparing and changes to Active in about 1 to 5 minutes. The Active status indicates that the VPN gateway has been initialized and is ready for use.

    The following table lists the two IP addresses that are assigned to the VPN Gateway instance.

    Gateway name

    Gateway ID

    IP address

    VPN-Gateway-example

    vpn-gw8dickm386d2qi2g****

    IPsec Address 1 (active tunnel by default): 8.XX.XX.130

    IPsec Address 2 (standby tunnel by default): 8.XX.XX.75

Step 2: Deploy VPN resources on Azure

To establish an IPsec connection between the Azure virtual network and the Alibaba Cloud VPC, deploy VPN resources on Azure. For detailed steps, see the Azure documentation.

  1. Create a gateway subnet in the virtual network. This subnet is required when you create a virtual network gateway.

    On the Subnets page of your virtual network, click + Gateway subnet. After the subnet is created, an entry named GatewaySubnet appears in the subnet list.

  2. Create a virtual network gateway.

    Associate the virtual network gateway with the virtual network that needs to communicate with Alibaba Cloud. In this example, active-active mode is enabled for the virtual network gateway and two new public IP addresses are created. Default values are used for other settings. On the page for creating a virtual network gateway, set Region to Germany West Central, Gateway type to VPN, SKU to VpnGw2AZ, and Generation to Generation2. Select the created virtual network. The subnet is GatewaySubnet 192.168.1.0/24. In the Public IP address section, select Create new, set Public IP address SKU to Standard, and set Availability zone to Zone-redundant. Set Enable active-active mode to Enabled and create a second public IP address with the same SKU and zone settings.

    After the virtual network gateway is created, go to the Public IP addresses page in the Azure portal to view and record its assigned public IP addresses (4.XX.XX.224 and 4.XX.XX.166 in this example). Confirm that they are associated with the virtual network gateway.

  3. Create local network gateways.

    Create two local network gateways in Azure. Configure each local network gateway with one of the public IP addresses of the Alibaba Cloud VPN Gateway instance, and add the CIDR block of the Alibaba Cloud VPC to each local network gateway. On the page for creating a local network gateway, set IP address to a public IP address of the Alibaba Cloud VPN Gateway instance and add the CIDR block of the Alibaba Cloud VPC to the Address space.

    Important

    If you use Data Transmission Service (DTS) to synchronize data from Azure to Alibaba Cloud, you must also add the 100.104.0.0/16 CIDR block. DTS uses IP addresses from this CIDR block for data migration.

    For more information about the CIDR blocks used by DTS, see Add the CIDR blocks of DTS servers to IP address whitelists.

  4. Create site-to-site VPN connections.

    Important

    IPsec connections on both Alibaba Cloud and Azure support dual-tunnel mode. However, Azure associates both tunnels with the same local network gateway by default, whereas the two tunnels on the Alibaba Cloud side have different IP addresses. This prevents a one-to-one mapping between the tunnels on the Alibaba Cloud and Azure sides. To ensure that both tunnels of the IPsec connection on the Alibaba Cloud side are active, you must create two site-to-site VPN connections in Azure. Each site-to-site VPN connection must be associated with a different local network gateway.

    The following describes the configuration of one site-to-site VPN connection. When you create the VPN connection, select the Site-to-site (IPsec) type, associate it with the virtual network gateway that connects to Alibaba Cloud, select a local network gateway, and set a pre-shared key. Use the default values for other settings. Associate the other site-to-site VPN connection with a different local network gateway, but use the same settings as the first VPN connection. On the Basics tab of the Create connection page in the Azure portal, set Connection type to Site-to-site (IPsec) and Region to Germany West Central.

Step 3: Deploy the VPN Gateway

After you configure the VPN resources on Azure, deploy the VPN Gateway on Alibaba Cloud to establish the IPsec connection between the Azure virtual network and the Alibaba Cloud VPC.

  1. Create customer gateways.

    1. Go to the Customer Gateway page. In the top menu bar, select Germany (Frankfurt) as the region.

    2. In the Create Customer Gateway panel, configure the settings based on the following information, and then click OK.

      Create two customer gateways and use the two public IP addresses of the Azure virtual network gateway as the IP addresses of the customer gateways to establish two encrypted tunnels. The following table describes only the parameters that are relevant to this topic. For other parameters, retain the default values or leave them empty. For more information, see Customer gateways.

      Parameter

      Description

      Customer gateway 1

      Customer gateway 2

      Name

      Enter a name for the customer gateway.

      Enter Customer-Gateway-1.

      Enter Customer-Gateway-2.

      IP Address

      Enter the public IP address of the Azure virtual network gateway.

      Enter 4.XX.XX.224.

      Enter 4.XX.XX.166.

  2. Create an IPsec connection.

    1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

    2. On the IPsec Connections page, click Bind VPN Gateway.

    3. On the Create IPsec Connection (VPN) page, configure the IPsec connection based on the following information, and then click OK.

      Parameter

      Description

      Example value

      Name

      Enter a name for the IPsec connection.

      Enter IPsec-Connection-example.

      Region

      Select the region where the VPN gateway to be associated with the IPsec-VPN connection is deployed.

      The IPsec-VPN connection is created in the same region as the VPN gateway.

      Select Germany (Frankfurt).

      Resource Group

      Select the resource group to which the VPN Gateway instance belongs.

      Select the default resource group.

      VPN Gateway

      Select the VPN Gateway instance to associate with the IPsec connection.

      Select the created VPN-Gateway-example.

      Routing Mode

      Select a routing mode.

      • Destination Routing Mode: Routes traffic based on destination IP addresses.

      • Protected Data Flows: Routes traffic based on specific source and destination IP addresses.

      Select Protected Data Flows.

      Local Network

      Enter the CIDR block of the VPC that is associated with the VPN Gateway instance.

      Enter the VPC CIDR block: 10.0.0.0/16

      Important

      If you use DTS to synchronize data from Azure to Alibaba Cloud, you must also add the 100.104.0.0/16 CIDR block. DTS uses IP addresses from this CIDR block for data migration.

      Remote Network

      Enter the CIDR block of the remote network that the VPC needs to access.

      Enter 192.168.0.0/16.

      Effective Immediately

      Specifies whether to immediately start negotiations for the IPsec connection. Valid values:

      • Yes: Negotiation starts immediately after the configuration is complete.

      • No: Negotiation is initiated when traffic is received.

      Select Yes.

      Enable BGP

      Enable BGP if the IPsec connection uses the BGP routing protocol. BGP is disabled by default.

      Retain the default setting, which is to leave BGP disabled.

      Tunnel 1

      Configure VPN settings for Tunnel 1 (active tunnel).

      By default, Tunnel 1 is the active tunnel and Tunnel 2 is the standby tunnel. You cannot change this setting.

      Customer Gateway

      Select the customer gateway to associate with the active tunnel.

      Select Customer-Gateway-1.

      Pre-Shared Key

      Enter the authentication key for the active tunnel.

      • The key must be 1 to 100 characters in length and can contain digits, letters, and the following characters: ~`!@#$%^&*()_-+={}[]\|;:',.<>/?.

      • If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key.

      Important

      The pre-shared key for the tunnel must match the key configured on its peer gateway device. Otherwise, the IPsec connection cannot be established.

      The authentication key for this tunnel must be the same as the key for the corresponding VPN connection on Azure.

      Encryption Configuration

      Configure settings for IKE, IPsec, DPD, and NAT traversal.

      Retain the default values. For more information about the default values, see Create an IPsec connection.

      Tunnel 2

      Configure VPN settings for Tunnel 2 (standby tunnel).

      Customer Gateway

      Select the customer gateway to associate with the standby tunnel.

      Select Customer-Gateway-2.

      Pre-Shared Key

      Enter the authentication key for the standby tunnel.

      The authentication key for this tunnel must be the same as the key for the corresponding VPN connection on Azure.

      Encryption Configuration

      Configure settings for IKE, IPsec, DPD, and NAT traversal.

      Retain the default values. For more information about the default values, see Create an IPsec connection.

    4. In the Created message, click Cancel.

  3. Configure routes for the VPN Gateway.

    After you create an IPsec connection, you need to configure routes for the VPN gateway instance. If you select Protected Data Flows for the Routing Mode, the system automatically creates a policy-based route for the VPN gateway instance. The route is in the Unpublished state. You need to perform this operation to publish the policy-based route to the VPC.

    1. In the left navigation pane, choose Interconnections > VPN > VPN Gateways.

    2. In the top navigation bar, select the region where the VPN gateway instance resides.

    3. On the VPN Gateway page, click the target VPN gateway instance ID.

    4. On the details page of the VPN gateway, click the Policy-based Route Table tab, find the target route entry, and click Advertise in the Actions column.

    5. In the Advertise Route dialog box, click OK.

Step 4: Test network connectivity

After you complete the preceding configurations, test the connectivity between the Alibaba Cloud VPC and the Azure virtual network.

  1. Create and log in to an Azure VM instance in the Azure virtual network. For details, see the Azure documentation.

    Important

    Before you test the connectivity, ensure the security group rules for both the Alibaba Cloud VPC and the Azure virtual network allow communication between the two networks.

  2. In the VM instance, execute the ping command to access the private IP address of the Alibaba Cloud ECS instance.

    ping 10.0.0.1

    Receiving reply packets similar to the following output confirms that the resources in the Alibaba Cloud VPC and Azure virtual network can communicate.

    PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=101 time=4.32 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=101 time=3.91 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=101 time=3.94 ms
64 bytes from 10.0.0.1: icmp_seq=4 ttl=101 time=3.75 ms
64 bytes from 10.0.0.1: icmp_seq=5 ttl=101 time=3.97 ms
64 bytes from 10.0.0.1: icmp_seq=6 ttl=101 time=3.81 ms
64 bytes from 10.0.0.1: icmp_seq=7 ttl=101 time=5.47 ms
Previous：Connect to AWS VPCNext：Encrypt Express Connect traffic