VPC interconnection with an SM-based VPN gateway

Example scenario

This topic describes a scenario where an enterprise has a VPC (VPC1) in the China (Hangzhou) region and another VPC (VPC2) in the China (Shanghai) region. The enterprise runs services on ECS instances in both VPCs. As the business grows, services in VPC1 and VPC2 must communicate with each other.

To create a secure network, the enterprise plans to use a vpn gateway to establish an IPsec-VPN connection that encrypts data in transit between the two VPCs, enabling secure communication between resources. To comply with corporate policy, this connection must use commercial encryption. Therefore, the enterprise must use a commercial encryption vpn gateway to establish this connection.

Network planning

VPC instance CIDR block planning

BGP CIDR block planning for IPsec-VPN connections

This topic describes how to connect VPCs by using an IPsec-VPN connection with static or dynamic BGP routes. The following table shows the BGP network plan for this example.

Prerequisites

• You have created VPC1 in the China (Hangzhou) region and VPC2 in the China (Shanghai) region on Alibaba Cloud, and deployed services on ECS instances in both VPCs. For details, see Create an IPv4 VPC.

• You have verified that the security group rules for the ECS instances in both VPCs allow communication between them. For details, see Query security group rules and Add a security group rule.

Procedure

Step 1: Upload an SSL certificate

1. Generate a Guomi certificate.

   1. Log on to gmcert.

   2. Select Generate Key & Certificate Online.

   3. On the Issue Certificate Online page, configure the following parameters. For example:

      • Certificate Algorithm: Guomi SM2 algorithm

      • Guomi Certificate Type: Signature and Encryption

      • Country/C: CN

      • Province/S: zhejiang

      • City/L: hangzhou

      • Organization/O: hangzhou

      • Organizational Unit/OU: hangzhou

      • Common Name/CN: test (Example. Replace with the actual common name.)

      • Output Format: PEM certificate + key

      The certificate generated in this example can be used for both encryption and signing.

2. After you download the certificate, extract the files on your local computer. You will get three files with the .pem extension.

3. Upload the certificate to the Certificate Management Service console. The following table describes the parameters. For more information, see Upload, Synchronize, and Share SSL Certificates.

   Parameter	Description
   Certificate standard	Select Guomi (SM2) standard.
   Certificate name	Specify a custom name for the certificate.
   Certificate file	Upload the .cert.pem file.
   Certificate private key	Upload the .key.pem file.
   Encryption certificate	Upload the .cert.pem file.
   Encryption private key	Upload the .key.pem file.

4. After you upload the certificate, remain on the Upload Certificate tab. View and record the subject information of the SSL certificate. You need this information to create the IPsec-VPN connection.

   In the Actions column for the target SSL certificate, click More. On the certificate details page, find and record the subject information in the following format:

   CN=z****,O=hangzhou,OU=hangzhou,C=CN

Step 2: Create an SM-compliant VPN gateway

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where you want to create the VPN Gateway instance.

   In this example, China (Hangzhou) is selected.

   Note

   The VPN Gateway instance must be in the same region as the VPC that you want to associate it with.

3. On the VPN Gateways page, click Create VPN Gateway.

4. On the purchase page, configure the VPN Gateway based on the following information, and then click Buy Now and complete the payment.

   Parameter	Description
   Instance name	Enter a name for the VPN Gateway instance. In this example, enter VPN Gateway 1.
   Resource group	Select the resource group to which the VPN Gateway instance belongs. In this example, the default resource group is used. If you do not select a resource group, the VPN Gateway instance is assigned to the default resource group after it is created.
   Region and zone	Select the region where you want to create the VPN Gateway instance. In this example, China (Hangzhou) is selected.
   Gateway type	Select a gateway type for the VPN Gateway instance. In this example, select SM-compliant.
   Tunnel	Default value: Dual-tunnel.
   VPC	Select the VPC to associate with the VPN Gateway instance. In this example, select VPC1.
   Virtual switch 1	Select the first virtual switch from the VPC1 instance. Note The system selects a vSwitch by default. You can change or use the default vSwitch. After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.
   Virtual switch 2	Select the second virtual switch from the VPC1 instance. Specify two vSwitches in different zones in the associated VPC to implement disaster recovery across zones for IPsec-VPN connections. For a region that supports only one zone, disaster recovery across zones is not supported. We recommend that you specify two vSwitches in the zone to implement high availability of IPsec-VPN connections. You can also select the same vSwitch as the first one.
   Bandwidth	Select the maximum public bandwidth for the VPN Gateway instance. Unit: Mbps.
   IPsec-VPN	Specifies whether to enable the IPsec-VPN feature. In this example, select Enable.
   Billing cycle	Select a subscription duration. You can choose whether to enable auto-renewal: Monthly subscription: The renewal period is one month. Yearly subscription: The renewal period is one year.
   Service-linked role	Click Create Service-Linked Role. The system automatically creates the AliyunServiceRoleForVpn service-linked role. A VPN Gateway uses this role to access resources of other cloud services. For more information, see AliyunServiceRoleForVpn. If Created is displayed for this parameter, the role has been created for your account and you do not need to create it again.

5. Return to the VPN Gateways page to view the created VPN Gateway instance.

   After a VPN Gateway instance is created, its status is Preparing. The status changes to Normal within 1 to 5 minutes. An Normal status indicates the instance is initialized and ready for use.

6. Repeat Step 2 to Step 4 to create another VPN Gateway instance named VPN Gateway 2 in the China (Shanghai) region. Associate this VPN Gateway instance with VPC2, and apply the same configurations as for VPN Gateway 1.

   The details of the created instances are as follows:

   VPN gateway name	Associated VPC	VPN gateway IPs
   VPN Gateway 1	VPC1	IPsec address 1: 120.XX.XX.33 IPsec address 2: 47.XX.XX.109
   VPN Gateway 2	VPC2	IPsec address 1: 139.XX.XX.86 IPsec address 2: 139.XX.XX.89

Step 3: Bind certificates to VPN gateways

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where the VPN Gateway instance is located.

3. On the VPN Gateways page, find the target VPN Gateway instance and click its instance ID.

4. On the details page of the VPN Gateway instance, click the Associate Certificate tab.

5. On the Associate Certificate tab, click Associate SSL Certificate. In the Associate SSL Certificate dialog box, bind an encryption certificate and a signature certificate, and then click OK.

   You must bind one encryption certificate and one signature certificate to both VPN Gateway 1 and VPN Gateway 2. In this example, both gateways use the same SSL certificates, as shown in the following table.

   VPN Gateway instance	Certificate type	Certificate
   VPN Gateway 1	encryption certificate	Select the certificate that you uploaded to the Certificate Management Service console.
   	signature certificate	Select the certificate that you uploaded to the Certificate Management Service console.
   VPN Gateway 2	encryption certificate	Select the certificate that you uploaded to the Certificate Management Service console.
   	signature certificate	Select the certificate that you uploaded to the Certificate Management Service console.

Step 4: Create customer gateways

1. In the navigation pane on the left, choose Interconnections > VPN > Customer Gateways.

2. In the top navigation bar, select the region for the customer gateway instance.

   Note

   The customer gateway instance must be in the same region as the vpn gateway instance you want to connect to.

3. On the Customer Gateway page, click Create Customer Gateway.

4. In the Create Customer Gateway panel, configure the customer gateway instances using the parameters in the following table, and then click OK.

   You will create four customer gateway instances to establish the vpn tunnels. For parameters not specified in the table, use the default values.

   Parameter	Description	China (Hangzhou)	China (Hangzhou)	China (Shanghai)	China (Shanghai)
   Name	Enter a name for the customer gateway instance.	VPN Gateway 1-Customer1	VPN Gateway 1-Customer2	VPN Gateway 2-Customer1	VPN Gateway 2-Customer2
   Ip address	Enter the ip address of the peer vpn gateway instance. The IP address of the peer for the VPN gateway instance. Note In this example, VPN Gateway 1 and VPN Gateway 2 function as customer gateways for each other.	The ip address of VPN Gateway 2's IPsec address 1: 139.XX.XX.86.	The ip address of VPN Gateway 2's IPsec address 2: 139.XX.XX.89.	The ip address of VPN Gateway 1's IPsec address 1: 120.XX.XX.33.	The ip address of VPN Gateway 1's IPsec address 2: 47.XX.XX.109.
   ASN	Enter the autonomous system number (ASN) of the peer vpn gateway instance. The autonomous system number (ASN) for the peer of the VPN gateway instance.	The BGP ASN for the primary tunnel of VPN Gateway 2: 65500.	The BGP ASN for the secondary tunnel of VPN Gateway 2: 65500.	The BGP ASN for the primary tunnel of VPN Gateway 1: 65530.	The BGP ASN for the secondary tunnel of VPN Gateway 1: 65530.

Step 5: Create IPsec connections

1. In the left navigation pane, choose Interconnections > VPN > IPsec Connections.

2. On the IPsec Connections page, click Bind VPN Gateway.

3. Configure the IPsec connections as follows, and then click OK.

   Create one IPsec connection for each of the two VPN Gateway instances. The following table describes the required settings.

   Parameter	Description	IPsec connection 1	IPsec connection 2
   IPsec connection name	Enter a name for the IPsec connection.	In this example, enter IPsec-connection-1.	In this example, enter IPsec-connection-2.
   Region	Select the region where the VPN gateway to be associated with the IPsec-VPN connection is deployed. The IPsec-VPN connection is created in the same region as the VPN gateway.	Select China (Hangzhou).	Select China (Shanghai).
   Bind VPN gateway	Select the VPN Gateway instance for the IPsec connection.	Select VPN-Gateway-1.	Select VPN-Gateway-2.
   Routing Mode	Select a routing mode. Note To use the BGP dynamic routing protocol for the IPsec connection, select the destination-based routing mode.	In this example, select destination-based routing mode.
   Effective Immediately	Determines if negotiation for the IPsec connection starts immediately. Valid values: Yes. Start negotiations after the configuration is completed. No. Start negotiations when inbound traffic is detected. Note When you establish an IPsec connection between two VPCs by using a VPN Gateway, we recommend that you set Effective Immediately to Yes for one of the IPsec connections. This allows the gateways to start IPsec negotiation after the configuration is complete.	In this example, select Yes.	In this example, select No.
   Enable BGP	Turn on this switch to use the BGP routing protocol for the IPsec connection. The BGP feature is disabled by default.	In this example, leave BGP disabled. You will configure BGP after creating the IPsec connection.	In this example, leave BGP disabled. You will configure BGP after creating the IPsec connection.
   Tunnel 1	Configure settings for Tunnel 1 (the primary tunnel). The roles of the primary and secondary tunnels cannot be changed.
   Customer Gateway	Select the customer gateway instance to associate with the primary tunnel.	Select VPN-Gateway-1-Customer-1.	Select VPN-Gateway-2-Customer-1.
   RemoteId	Enter the subject information of the peer certificate.	Enter the subject information of the signature certificate that is bound to VPN Gateway 2: CN=z****,O=hangzhou,OU=hangzhou,C=CN.	Enter the subject information of the signature certificate that is bound to VPN Gateway 1: CN=z****,O=hangzhou,OU=hangzhou,C=CN.
   Peer CA certificate	Select the CA certificate used by the peer.	Click Upload Certificate and select the .cert.pem file for VPN Gateway 2 from your local computer.	Click Upload Certificate and select the .cert.pem file for VPN Gateway 1 from your local computer.
   Encryption configuration	Configure settings for IKE, IPsec, DPD, and NAT traversal.	For an SM-compliant VPN gateway, you must select ikev1. Use the default values for the other parameters.	For an SM-compliant VPN gateway, you must select ikev1. Use the default values for the other parameters.
   Tunnel 2	Configure settings for Tunnel 2 (the secondary tunnel).
   Customer Gateway	Select the customer gateway instance to associate with the secondary tunnel.	Select VPN-Gateway-1-Customer-2.	Select VPN-Gateway-2-Customer-2.
   RemoteId	Enter the subject information of the peer certificate.	Enter the subject information of the signature certificate that is bound to VPN Gateway 2: CN=z****,O=hangzhou,OU=hangzhou,C=CN.	Enter the subject information of the signature certificate that is bound to VPN Gateway 1: CN=z****,O=hangzhou,OU=hangzhou,C=CN.
   Peer CA certificate	Select the CA certificate used by the peer.	Click Upload Certificate and select the .cert.pem file for VPN Gateway 2 from your local computer.	Click Upload Certificate and select the .cert.pem file for VPN Gateway 1 from your local computer.
   Encryption configuration	Configure settings for IKE, IPsec, DPD, and NAT traversal.	For an SM-compliant VPN gateway, you must select ikev1. Use the default values for the other parameters.	For an SM-compliant VPN gateway, you must select ikev1. Use the default values for the other parameters.

4. In the Created Successfully dialog box, click OK.

   After you complete the configuration, the following table summarizes the relationships between your VPC instances, VPN Gateway instances, IPsec connections, and customer gateway instances.

   VPC instance name	VPN Gateway instance name	IPsec connection name	Tunnel	Customer gateway name
   VPC1	VPN-Gateway-1	IPsec-connection-1	Primary tunnel	VPN-Gateway-1-Customer-1
   			Secondary tunnel	VPN-Gateway-1-Customer-2
   VPC2	VPN-Gateway-2	IPsec-connection-2	Primary tunnel	VPN-Gateway-2-Customer-1
   			Secondary tunnel	VPN-Gateway-2-Customer-2

Step 6: Configure routes

In dual-tunnel mode, an IPsec connection supports both static route and BGP dynamic routing. You only need to configure one routing protocol.

Step 7: Verification test

After you complete the preceding steps, VPC1 and VPC2 can communicate with each other. This section describes how to test connectivity between VPC1 and VPC2 and verify the high availability of the dual-tunnel IPsec-VPN connection.

1. Test connectivity.

   1. Log on to the ECS1 instance in VPC1.

   2. Run the ping command to test connectivity to the ECS2 instance in VPC2.

      ping <IP address of the ECS2 instance>

      A successful ping response indicates that the instances can communicate.

2. Test high availability.

   An IPsec-VPN connection in dual-tunnel mode provides high availability by automatically switching traffic to the standby tunnel if the primary tunnel fails. The following steps show you how to verify this failover.

   1. Log on to the ECS1 instance in VPC1.

   2. Run the following command to continuously send packets from ECS1 to ECS2.

      ping <IP address of the ECS2 instance> -c 10000

   3. Interrupt the primary tunnel of the IPsec-VPN connection.

      In this example, we interrupt the primary tunnel by modifying the customer gateway instance associated with the primary tunnel of IPsec Connection 1.

   4. Check the communication status on ECS1. Communication will resume after a brief interruption, indicating that traffic has failed over to the standby tunnel.

      You can view traffic monitoring data for the tunnels on the Monitoring tab.

      Note

      In a dual-tunnel connection between an on-premises data center and a VPC, Alibaba Cloud automatically manages failover for traffic from the VPC to your data center. If the primary tunnel fails, traffic is rerouted to the standby tunnel. However, failover in the opposite direction—from your data center to the VPC—depends on your local routing configuration. If your on-premises equipment does not support automatic failover, you can configure CloudMonitor to monitor the primary tunnel of the IPsec-VPN connection. When a failure is detected, you must manually update your local routes to redirect traffic to the standby tunnel.