This topic describes how to use Data Transmission Service (DTS) to synchronize data between an on-premises data center and a Virtual Private Cloud (VPC) over a public VPN gateway.
Scenario
An enterprise has a VPC in the Alibaba Cloud China (Hohhot) region and an on-premises data center in the same region. The enterprise wants to automatically synchronize data from its on-premises database to the database in the VPC.
The enterprise creates a VPN gateway and establishes an encrypted IPsec-VPN connection between the on-premises data center and the VPC. Then, it uses DTS over this connection to synchronize the data.
Prerequisites
You have a database in an on-premises data center, and a VPC in the Alibaba Cloud China (Hohhot) region with another database deployed on an Elastic Compute Service (ECS) instance. For instructions, see Create an IPv4 VPC.
The following table lists the network configurations for the on-premises data center and the VPC used in this example.
To enable communication, ensure the CIDR blocks of your on-premises data center and VPC do not overlap.
|
Resource |
CIDR block |
IP address |
Database account |
|
On-premises data center |
172.16.0.0/12 |
|
|
|
VPC |
10.0.0.0/8 |
IP address of the ECS instance hosting the database: 10.0.0.252 |
|
Workflow
Step 1: Create a VPN gateway
-
Go back to the VPN Gateway page to view the VPN gateway instance that you created.
After you create a VPN gateway instance, its status is Preparing. The status changes to Normal in approximately 1 to 5 minutes. An Normal status indicates that the VPN gateway instance is ready for use.
The system assigns two different public IP addresses to a public VPN gateway instance to establish two encrypted tunnels. The following table lists the two public IP addresses assigned in this example.
Instance name
Instance ID
Public IP address
VPNGW
vpn-bp1ox1xu1jo8m1ph0****
47.XX.XX.3
47.XX.XX.169
Step 2: Create a customer gateway
In the left-side navigation pane, choose .
In the top navigation bar, select the region in which you want to create the customer gateway.
Make sure that the customer gateway and the VPN gateway to be connected are deployed in the same region.
On the Customer Gateways page, click Create Customer Gateway.
In the Create Customer Gateway panel, configure the following parameters and click OK.
You must create two customer gateways in order to create two encrypted tunnels. The following table describes only the parameters that are relevant to this topic. You can use the default values for other parameters or leave them empty. For more information, see Customer Gateway.
Parameter
Description
Customer Gateway 1
Customer Gateway 2
Name
Enter a name for the customer gateway.
For Customer Gateway 1, CustomerGW1 is used.
For Customer Gateway 2, CustomerGW2 is used.
IP Address
Enter the public IP address of the gateway device in the data center.
For Customer Gateway 1, 211.XX.XX.36 is used.
For Customer Gateway 2, 211.XX.XX.71 is used.
Step 3: Create an IPsec-VPN connection
After creating the VPN gateway and customer gateways, create an IPsec-VPN connection on the VPN gateway to establish an encrypted tunnel. The procedure varies depending on the IKE version.
IKEv2
In the left navigation pane, choose .
On the IPsec Connections page, click Bind VPN Gateway.
-
Configure the IPsec-VPN connection with the following information and click OK.
Parameter
Description
Example
IPsec-VPN Connection Name
Enter a name for the IPsec-VPN connection.
Enter IPsec-Connection.
Region
Select the region where the VPN gateway to be associated with the IPsec-VPN connection is deployed.
The IPsec-VPN connection is created in the same region as the VPN gateway.
Select China (Hohhot).
Bind VPN Gateway
Select the VPN gateway to associate with the IPsec-VPN connection.
Select VPNGW.
Routing Mode
Select a routing mode.
-
Destination Routing Mode: Routes and forwards traffic based on destination IP addresses.
-
Protected Data Flows: Routes and forwards traffic based on specific source and destination IP addresses.
Select Protected Data Flows.
Local Network
Enter the CIDR blocks of the VPC associated with the VPN gateway.
Enter the following two CIDR blocks:
-
VPC CIDR block: 10.0.0.0/8
-
DTS CIDR block: 100.104.0.0/16
ImportantYou must add the Data Transmission Service (DTS) CIDR blocks to the local network to allow DTS to access the peer database through the VPN gateway.
For DTS CIDR blocks, see Add the CIDR blocks of DTS servers to an allowlist.
Remote Network
Enter the CIDR blocks of the remote network that the VPC will access.
Enter 172.16.0.0/12.
Effective Immediately
Specifies whether the configuration takes effect immediately. Valid values:
-
Yes: Negotiation starts immediately after the configuration is complete.
-
No: Negotiation starts when traffic is detected.
Select Yes.
BGP Configuration
Enable this option if the IPsec-VPN connection uses BGP. This option is disabled by default.
In this example, the default setting is used, which means BGP is disabled.
Tunnel 1
Configure the VPN settings for Tunnel 1 (the active tunnel).
By default, Tunnel 1 is the active tunnel and Tunnel 2 is the standby tunnel. You cannot change this setting.
Customer Gateway
Select the customer gateway to associate with the active tunnel.
Select CustomerGW1.
Pre-Shared Key
Enter the pre-shared key for the active tunnel.
-
The key must be 1 to 100 characters in length and can contain digits, uppercase and lowercase letters, and the following special characters:
~`!@#$%^&*()_-+={}[]\|;:',.<>/?. -
If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key.
ImportantThe pre-shared key for the tunnel must match the key on the peer gateway device. Otherwise, the IPsec-VPN connection will fail to establish.
Enter fddsFF123****.
Encryption Configuration
Configure settings for IKE, IPsec, Dead Peer Detection (DPD), and NAT traversal.
In this example, the default values are used. See IPsec-VPN connection (bound to a VPN gateway) for details.
Tunnel 2
Configure the VPN settings for Tunnel 2 (the standby tunnel).
Customer Gateway
Select the customer gateway to associate with the standby tunnel.
Select CustomerGW2.
Pre-Shared Key
Enter the authentication key for the standby tunnel.
Enter fddsFF456****.
Encryption Configuration
Configure settings for IKE, IPsec, DPD, and NAT traversal.
In this example, the default values are used. See IPsec-VPN connection (bound to a VPN gateway) for details.
-
-
In the Created dialog box, click OK.
On the IPsec Connections page, find the IPsec-VPN connection that you create and click Generate Peer Configuration in the Actions column.
The configurations of the IPsec peer refer to the VPN configurations that you need to add when you create the IPsec-VPN connection. In this example, you need to add the VPN configurations to the gateway device of the data center.
-
In the IPsec Connection Configuration dialog box, copy and save the configuration. You will need it later to configure the peer gateway device.
IKEv1
-
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
On the IPsec Connections page, click Bind VPN Gateway.
-
On the Create IPsec-VPN Connection page, configure the IPsec-VPN connection with the following information, and then click OK.
IKEv1 does not support multiple CIDR blocks in a single IPsec-VPN connection. You must create two separate connections: one for DTS traffic and one for VPC traffic.
Parameter
Description
IPsec-VPN Connection 1
IPsec-VPN Connection 2
IPsec-VPN Connection Name
Enter a name for the IPsec-VPN connection.
Enter IPsec-Connection1.
Enter IPsec-Connection2.
Region
Select the region of the VPN gateway.
The IPsec-VPN connection and the VPN gateway must be in the same region.
Select China (Hohhot).
Select China (Hohhot).
Bind VPN Gateway
Select the VPN gateway to associate with the IPsec-VPN connection.
Select VPNGW.
Select VPNGW.
Routing Mode
Select a routing mode.
-
Destination Routing Mode: Routes and forwards traffic based on destination IP addresses.
-
Protected Data Flows: Routes and forwards traffic based on specific source and destination IP addresses.
Select Protected Data Flows.
Select Protected Data Flows.
Local Network
Enter the CIDR blocks of the VPC associated with the VPN gateway.
Enter the VPC CIDR block: 10.0.0.0/8
Enter the DTS CIDR block: 100.104.0.0/16
ImportantYou must add the Data Transmission Service (DTS) CIDR blocks to the local network to allow DTS to access the peer database through the VPN gateway.
For DTS CIDR blocks, see Add the CIDR blocks of DTS servers to an allowlist.
Remote Network
Enter the CIDR blocks of the remote network that the VPC will access.
Enter 172.16.0.0/12.
Enter 172.16.0.0/12.
Effective Immediately
Specifies whether the configuration takes effect immediately. Valid values:
-
Yes: Negotiation starts immediately after the configuration is complete.
-
No: Negotiation starts when traffic is detected.
Select Yes.
Select Yes.
BGP Configuration
Enable this option if the IPsec-VPN connection uses BGP. This option is disabled by default.
In this example, the default setting is used, which means BGP is disabled.
In this example, the default setting is used, which means BGP is disabled.
Tunnel 1
Configure the VPN settings for Tunnel 1 (the active tunnel).
By default, Tunnel 1 is the active tunnel and Tunnel 2 is the standby tunnel. You cannot change this setting.
Customer Gateway
Select the customer gateway to associate with the active tunnel.
Select CustomerGW1.
Select CustomerGW1.
Pre-Shared Key
Enter the pre-shared key for the active tunnel.
-
The key must be 1 to 100 characters in length and can contain digits, uppercase and lowercase letters, and the following special characters:
~`!@#$%^&*()_-+={}[]\|;:',.<>/?. -
If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key.
ImportantThe pre-shared key for the tunnel must match the key on the peer gateway device. Otherwise, the IPsec-VPN connection will fail to establish.
Enter fddsFF123****.
Enter fddsFF123****.
Encryption Configuration
Configure settings for IKE, IPsec, DPD, and NAT traversal.
Use IKEv1 and the default values for the other parameters. See IPsec-VPN connection (bound to a VPN gateway) for details.
Use IKEv1 and the default values for the other parameters. See IPsec-VPN connection (bound to a VPN gateway) for details.
Tunnel 2
Configure the VPN settings for Tunnel 2 (the standby tunnel).
Customer Gateway
Select the customer gateway to associate with the standby tunnel.
Select CustomerGW2.
Select CustomerGW2.
Pre-Shared Key
Enter the authentication key for the standby tunnel.
Enter fddsFF456****.
Enter fddsFF456****.
Encryption Configuration
Configure settings for IKE, IPsec, DPD, and NAT traversal.
Use IKEv1 and the default values for the other parameters. See IPsec-VPN connection (bound to a VPN gateway) for details.
Use IKEv1 and the default values for the other parameters. See IPsec-VPN connection (bound to a VPN gateway) for details.
-
-
In the Created dialog box, click OK.
On the IPsec Connections page, find the IPsec-VPN connection that you create and click Generate Peer Configuration in the Actions column.
The configurations of the IPsec peer refer to the VPN configurations that you need to add when you create the IPsec-VPN connection. In this example, you need to add the VPN configurations to the gateway device of the data center.
In the IPsec-VPN Connection Configuration dialog box, copy and save the configurations to an on-premises machine. The configurations are required when you configure the gateway device of the data center.
Step 4: Configure VPN gateway routes
After you create an IPsec-VPN connection, you must configure routes for the VPN gateway instance. If you set Routing Mode to Protected Data Flows when you create the IPsec-VPN connection, the system automatically creates policy-based routes for the VPN gateway instance. These routes have an Unpublished status, and you must advertise them to the VPC.
In the left navigation pane, choose .
In the top navigation bar, select the region where the VPN gateway instance resides.
-
On the VPN Gateway page, click the target VPN gateway instance ID.
-
On the details page of the VPN gateway, click the Policy-based Route Table tab, find the target route entry, and click Advertise in the Actions column.
-
In the Advertise Route dialog box, click OK.
Step 5: Configure the on-premises gateway device
After creating the IPsec-VPN connection on Alibaba Cloud, add the VPN and routing configurations to your on-premises gateway device. These configurations establish an IPsec-VPN connection with the VPN gateway and route traffic from your on-premises data center to the VPC through the active tunnel by default. If the active tunnel fails, traffic automatically fails over to the standby tunnel.
The following content contains information about third-party products. This information is for reference only. Alibaba Cloud does not make any warranties, express or implied, for the performance and reliability of third-party products, or the potential impacts of using them.
Configuration commands vary by device vendor. For specific commands, consult your vendor.
IKEv2
-
Use the saved peer configuration to add the VPN configuration to your on-premises gateway devices.
-
Log in to the command-line interface (CLI) of your on-premises gateway device.
-
Run the following commands to configure the IKEv2 proposal and policy.
// Add the following configuration to on-premises gateway device 1 and on-premises gateway device 2. crypto ikev2 proposal alicloud encryption aes-cbc-128 // Encryption algorithm. Example: AES-CBC-128. integrity sha1 // Authentication algorithm. Example: SHA-1. group 2 // DH group. Example: group 2. exit ! crypto ikev2 policy Pureport_Pol_ikev2 proposal alicloud exit ! -
Run the following commands to configure the IKEv2 keyring.
// Add the following configuration to on-premises gateway device 1. crypto ikev2 keyring alicloud peer alicloud address 47.XX.XX.3 // Public IP address of the active tunnel. Example: 47.XX.XX.3. pre-shared-key fddsFF123**** // Pre-shared key. Example: fddsFF123****. exit ! // Add the following configuration to on-premises gateway device 2. crypto ikev2 keyring alicloud peer alicloud address 47.XX.XX.169 // Public IP address of the standby tunnel. Example: 47.XX.XX.169. pre-shared-key fddsFF456**** // Pre-shared key. Example: fddsFF456****. exit ! -
Run the following commands to configure the IKEv2 profile.
// Add the following configuration to on-premises gateway device 1. crypto ikev2 profile alicloud match identity remote address 47.XX.XX.3 255.255.255.255 // Match the public IP address of the active tunnel. Example: 47.XX.XX.3. identity local address 211.XX.XX.36 // Public IP address of on-premises gateway device 1. Example: 211.XX.XX.36. authentication remote pre-share // Peer authentication method: pre-shared key (PSK). authentication local pre-share // Local authentication method: pre-shared key (PSK). keyring local alicloud // Use the keyring. exit ! // Add the following configuration to on-premises gateway device 2. crypto ikev2 profile alicloud match identity remote address 47.XX.XX.169 255.255.255.255 // Match the public IP address of the standby tunnel. Example: 47.XX.XX.169. identity local address 211.XX.XX.71 // Public IP address of on-premises gateway device 2. Example: 211.XX.XX.71. authentication remote pre-share // Peer authentication method: pre-shared key (PSK). authentication local pre-share // Local authentication method: pre-shared key (PSK). keyring local alicloud // Use the keyring. exit ! -
Run the following commands to configure the transform set.
// Add the following configuration to on-premises gateway device 1 and on-premises gateway device 2. crypto ipsec transform-set TSET esp-aes esp-sha-hmac mode tunnel exit ! -
Configure an access control list (ACL) to define which traffic to protect.
// Add the following configuration to on-premises gateway device 1 and on-premises gateway device 2. access-list 100 permit ip 172.16.0.0 0.15.255.255 10.0.0.0 0.255.255.255 -
Configure the IPsec policy.
// Add the following configuration to on-premises gateway device 1. crypto map ipsecpro64 10 ipsec-isakmp set peer 47.XX.XX.3 set transform-set TSET set ikev2-profile alicloud set pfs group2 match address 100 // Add the following configuration to on-premises gateway device 2. crypto map ipsecpro64 10 ipsec-isakmp set peer 47.XX.XX.169 set transform-set TSET set ikev2-profile alicloud set pfs group2 match address 100 -
Run the following commands to configure the IPsec tunnels.
// Add the following configuration to on-premises gateway device 1. interface GigabitEthernet1 // Configure the interface IP address to establish the active tunnel for the IPsec-VPN connection. ip address 211.XX.XX.36 255.255.255.0 crypto map ipsecpro64 // Apply the IPsec policy. negotiation auto ! // Add the following configuration to on-premises gateway device 2. interface GigabitEthernet1 // Configure the interface IP address to establish the standby tunnel for the IPsec-VPN connection. ip address 211.XX.XX.71 255.255.255.0 crypto map ipsecpro64 // Apply the IPsec policy. negotiation auto !
-
-
Add routing configurations to on-premises gateway device 1 and on-premises gateway device 2.
-
Add routes that point to the VPC to on-premises gateway device 1 and on-premises gateway device 2.
// Add routes that point to the VPC on on-premises gateway device 1. ip route 10.0.0.0 255.0.0.0 47.XX.XX.3 ip route 100.104.0.0 255.255.0.0 47.XX.XX.3 // Add routes that point to the VPC on on-premises gateway device 2. ip route 10.0.0.0 255.0.0.0 47.XX.XX.169 ip route 100.104.0.0 255.255.0.0 47.XX.XX.169 -
Based on your network environment, add a routing configuration to your on-premises data center that routes traffic to the VPC through on-premises gateway device 1 by default and automatically fails over to on-premises gateway device 2 if device 1 fails. For specific commands, consult your device vendor.
-
IKEv1
-
Add the VPN configuration to your on-premises gateway devices by using the peer configuration that you saved.
-
Log in to the CLI of your on-premises gateway device.
-
Configure the ISAKMP policy.
// Add the following configuration to on-premises gateway device 1 and on-premises gateway device 2. crypto isakmp policy 1 authentication pre-share encryption aes hash sha group 2 lifetime 86400 -
Configure the pre-shared key.
// Add the following configuration to on-premises gateway device 1. crypto isakmp key fddsFF123**** address 47.XX.XX.3 // Add the following configuration to on-premises gateway device 2. crypto isakmp key fddsFF456**** address 47.XX.XX.169 -
Configure the IPsec security protocol.
// Add the following configuration to on-premises gateway device 1 and on-premises gateway device 2. crypto ipsec transform-set ipsecpro64 esp-aes esp-sha-hmac mode tunnel -
Configure an access control list (ACL) to define which traffic to protect.
// Add the following configuration to on-premises gateway device 1 and on-premises gateway device 2. access-list 100 permit ip 172.16.0.0 0.15.255.255 10.0.0.0 0.255.255.255 -
Configure the IPsec policy.
// Add the following configuration to on-premises gateway device 1. crypto map ipsecpro64 10 ipsec-isakmp set peer 47.XX.XX.3 set transform-set ipsecpro64 set pfs group2 match address 100 // Add the following configuration to on-premises gateway device 2. crypto map ipsecpro64 10 ipsec-isakmp set peer 47.XX.XX.169 set transform-set ipsecpro64 set pfs group2 match address 100 -
Apply the IPsec policy to the public-facing interface.
// Add the following configuration to on-premises gateway device 1. interface GigabitEthernet1 // Apply the IPsec policy to the public-facing interface. crypto map ipsecpro64 // Add the following configuration to on-premises gateway device 2. interface GigabitEthernet1 // Apply the IPsec policy to the public-facing interface. crypto map ipsecpro64
-
-
Add routing configurations to on-premises gateway device 1 and on-premises gateway device 2.
-
Add routes that point to the VPC to on-premises gateway device 1 and on-premises gateway device 2.
// Add routes that point to the VPC on on-premises gateway device 1. ip route 10.0.0.0 255.0.0.0 47.XX.XX.3 ip route 100.104.0.0 255.255.0.0 47.XX.XX.3 // Add routes that point to the VPC on on-premises gateway device 2. ip route 10.0.0.0 255.0.0.0 47.XX.XX.169 ip route 100.104.0.0 255.255.0.0 47.XX.XX.169 -
Based on your network environment, add a routing configuration to your on-premises data center that routes traffic to the VPC through on-premises gateway device 1 by default and automatically fails over to on-premises gateway device 2 if device 1 fails. For specific commands, consult your device vendor.
-
Step 6: Test connectivity
After you complete the configuration, verify that the data center and the VPC can communicate.
Before you test the connectivity, ensure that the security group rules for the ECS instance and the access control rules for the data center allow traffic between the data center and the VPC. For more information about security group rules for ECS instances, see Use security groups.
-
Log in to the ECS instance in the VPC.
-
On the ECS instance, run the
pingcommand to access the database server in the data center.Reply packets indicate that the data center and the VPC can communicate.
ping <IP address of the database server in the data center>
Step 7: Create a DTS task
After the data center and VPC can communicate, create a DTS data synchronization task. DTS then automatically synchronizes data from the data center to the database in the VPC.
The following example uses MySQL-to-MySQL data synchronization. For other synchronization scenarios, see Overview of data synchronization scenarios.
Go to the data synchronization task list page in the destination region. You can do this in one of two ways.
DTS console
Log on to the DTS console.
In the navigation pane on the left, click Data Synchronization.
In the upper-left corner of the page, select the region where the synchronization instance is located.
DMS console
NoteThe actual steps may vary depending on the mode and layout of the DMS console. For more information, see Simple mode console and Customize the layout and style of the DMS console.
Log on to the DMS console.
In the top menu bar, choose .
To the right of Data Synchronization Tasks, select the region of the synchronization instance.
Click Create Task to open the task configuration page.
Optional: In the upper-right corner of the page, click New Configuration Page.
NoteIf you are already on the new configuration page (the button in the upper-right corner is Back to Previous Version), you can skip this step.
Some parameters differ between the new and old configuration pages. We recommend using the new version.
-
Configure the source and destination databases.
Category
Parameter
Description
N/A
Task Name
DTS automatically generates a task name. We recommend that you specify a descriptive name for easy identification. The name does not need to be unique.
Source Database
Database Type
Select MySQL.
Connection Type
Select Express Connect/VPN Gateway/Smart Access Gateway.
Instance Region
Select the region where the source MySQL database resides.
In this example, China (Hohhot) is selected.
Replicate Data Across Alibaba Cloud Accounts
Select No.
Connected VPC
Select the VPC instance in the China (Hohhot) region.
DTS connects to the database in the on-premises data center through the VPC instance and the VPN Gateway.
Domain Name or IP
Enter the host IP address of the source MySQL database.
In this example, enter the IP address of the database server in the on-premises data center: 172.16.0.228.
Port Number
Enter the service port of the source MySQL database. The port must be accessible to the DTS servers. The default port is 3306.
Database Account
Enter the account for the source MySQL database.
Database Password
Enter the password for the database account.
Destination Database
Database Type
Select MySQL.
Connection Type
Select Express Connect/VPN Gateway/Smart Access Gateway.
Instance Region
Select the region where the destination MySQL database instance resides.
In this example, China (Hohhot) is selected.
Connected VPC
Select the VPC instance in the China (Hohhot) region.
Domain Name or IP
Enter the host IP address of the destination MySQL database.
In this example, enter the IP address of the ECS instance in the VPC: 10.0.0.252.
Port Number
Enter the service port of the destination MySQL database. The port must be accessible to the DTS servers. The default port is 3306.
Database Account
Enter the database account for the destination MySQL database instance.
Database Password
Enter the password for the database account.
-
After completing the configuration, click Test Connectivity and Proceed at the bottom of the page.
Ensure that the security group rules for the ECS instance and the access control rules for the on-premises data center allow access from DTS. For DTS CIDR blocks, see Add the CIDR blocks of DTS servers to an allowlist.
WarningAdding the public IP CIDR blocks of DTS servers, whether automatically or manually, can introduce security risks. By using this product, you acknowledge and accept these potential risks. You are responsible for implementing fundamental security measures, such as enforcing strong passwords, restricting open ports for each CIDR block, authenticating internal API calls, and regularly reviewing and limiting unnecessary CIDR blocks. Alternatively, connect to DTS over a private network by using Express Connect, a VPN Gateway, or Smart Access Gateway.
-
If the connectivity test succeeds, the system proceeds to the Configure Objects and Advanced Settings page. For task configuration details, see Configure two-way synchronization between MySQL databases.
-
If the connectivity test fails, you cannot proceed to the next page. Troubleshoot the issue as prompted. See What do I do if an error is reported when I connect a database instance to DTS over a VPN connection?
-