Combine static and BGP routing for encrypted traffic over a physical connection-VPN Gateway(VPN)-阿里云帮助中心

This guide explains how to encrypt traffic on an Express Connect circuit by creating a private IPsec-VPN connection between a customer gateway device and a transit router -- combining static routing on the virtual border router (VBR) with BGP dynamic routing over the VPN connection.

Background information

Before you begin, we recommend that you first understand the principles of encrypting private network traffic over Express Connect circuits. For more information, see Encrypt Express Connect traffic.
If the on-premises gateway device supports the BGP dynamic routing protocol, we recommend that both the VBR instance and the private IPsec-VPN connection use the BGP dynamic routing protocol to implement private network traffic encryption over Express Connect circuits. For related tutorials, see Encrypt private traffic over Express Connect with BGP.

Scenario

This topic uses the scenario shown in the following figure as an example. An enterprise has a data center (IDC, Internet Data Center) in Hangzhou and a VPC in the China (Hangzhou) region on Alibaba Cloud. Related services are deployed in the VPC by using Elastic Compute Service (ECS). As the business grows, the on-premises IDC needs to connect to the cloud. Based on certain security compliance requirements, the enterprise needs to use an Express Connect circuit and a transit router to implement private network communication between the on-premises IDC and the VPC. In addition, to reduce the risk of data leakage and prevent confidential enterprise data from being stolen or tampered with by internal or external personnel, the enterprise wants all traffic transmitted over the Express Connect circuit to be encrypted before being transmitted to Alibaba Cloud.

After establishing private connectivity between the on-premises data center and the VPC, the enterprise can create a private IPsec-VPN connection between its customer gateway device and the transit router. This private IPsec-VPN connection encrypts traffic passing through the physical connection, meeting the enterprise's security requirements.

Network plan

Important

When planning the CIDR blocks for your on-premises data center and related network instances, ensure the CIDR blocks do not overlap.

Routing mechanism

You can encrypt private traffic over a physical connection by controlling route selection:

Traffic from the VPC to the on-premises data center:
The transit router learns routes to the data center from both the VBR and the private IPsec-VPN connection. By default, the transit router prefers the VBR route, so traffic flows unencrypted over the physical connection.
To route traffic through the encrypted VPN path instead, use different subnet masks. Add a broader CIDR block (shorter mask) to the VBR, and advertise a more specific CIDR block (longer mask) over the IPsec-VPN connection.
For example, if the CIDR block of the data center is 192.168.0.0/16 and the client CIDR block in the data center that communicates with the VPC is 192.168.20.0/24, add the data center CIDR block 192.168.0.0/16 to the VBR instance, and have the on-premises gateway device advertise the specific client CIDR block 192.168.20.0/24 to the private IPsec-VPN connection. This ensures that the route learned through the private IPsec-VPN connection on the transit router is preferred, so that traffic from the VPC to the client is preferentially encrypted and transmitted through the private IPsec-VPN connection.
Traffic from the on-premises data center to the VPC:
The data center automatically learns routes to the VPC through the IPsec-VPN connection. You also add a static route for the VPC CIDR block on the customer gateway device with the next hop pointing to the physical connection, then lower its priority so the dynamically learned VPN route takes precedence. Traffic then flows through the encrypted IPsec-VPN connection.

Note

The current routing mechanism also ensures that, after the private IPsec-VPN connection is interrupted, the on-premises IDC and the VPC can still achieve private network communication through the Express Connect circuit and the transit router, but the traffic is no longer encrypted.

Basic CIDR block planning

Resource	CIDR block	IP address
VPC	Primary CIDR block: 172.16.0.0/16 vSwitch 1, located in zone H: 172.16.10.0/24 vSwitch 2, located in zone H: 172.16.20.0/24 vSwitch 3, located in zone J: 172.16.30.0/24	ECS1: 172.16.10.225 ECS2: 172.16.10.226
VBR	10.0.0.0/30	VLAN ID: 0 Alibaba Cloud-side IPv4 interconnection IP address: 10.0.0.1/30 Customer-side IPv4 interconnection IP address: 10.0.0.2/30 In this topic, the customer side refers to the customer gateway device.
On-premises data center	Client CIDR block: 192.168.20.0/24	Client IP address: 192.168.20.6
On-premises data center	Customer gateway device CIDR blocks: 10.0.0.0/30 192.168.10.0/24 192.168.40.0/24	VPN IP address 1: 192.168.10.136 VPN IP address 2: 192.168.40.159 The VPN IP address is the IP address of the interface on the customer gateway device that establishes the private IPsec-VPN connection with the transit router. IP address of the interface connected to the physical connection: 10.0.0.2/30 AS number: 65530

BGP CIDR block planning

The BGP tunnel CIDR block must be a CIDR block with a subnet mask of 30 within 169.254.0.0/16, and cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, 169.254.6.0/30, or 169.254.169.252/30. The two tunnels of an IPsec connection cannot use the same tunnel CIDR block.

Resource	Tunnel	BGP tunnel CIDR block	BGP IP address	BGP AS number (local autonomous system number)
IPsec connection instance	Tunnel 1	169.254.10.0/30	169.254.10.1	65534
IPsec connection instance	Tunnel 2	169.254.20.0/30	169.254.20.1	65534
On-premises gateway device	Tunnel 1	169.254.10.0/30	169.254.10.2	65530
On-premises gateway device	Tunnel 2	169.254.20.0/30	169.254.20.2	65530

Prerequisites

You have created a VPC in the China (Hangzhou) region of Alibaba Cloud and deployed relevant services by using ECS. For more information, see Create a VPC with an IPv4 CIDR block.
Check the on-premises gateway device to ensure that it supports the standard IKEv1 and IKEv2 protocols so that it can establish a private IPsec-VPN connection with Alibaba Cloud. To confirm whether the on-premises gateway device supports the standard IKEv1 and IKEv2 protocols, consult the vendor of the on-premises gateway device.

Procedure

Step 1: Connect the data center to a VPC

Step 1: Deploy an Express Connect circuit

Deploy an Express Connect circuit to connect the on-premises IDC to Alibaba Cloud.

Create an Express Connect circuit.
Apply for an Express Connect circuit in the China (Hangzhou) region. For more information, see Apply for Classic Mode or Shared circuit access process. In this topic, Dedicated Physical Connection is selected.

Create a VBR instance.

Log on to the Express Connect console.
In the left-side navigation pane, click Virtual Border Router (VBR).
In the top menu bar, select the China (Hangzhou) region.
The region of the VBR instance must be the same as the region to which the Express Connect circuit belongs.
On the Virtual Border Router (VBR) page, click Create VBR.

On the Create VBR panel, configure based on the following information, and then click OK.

The following lists only the configuration items that are strongly related to this topic. Keep the default settings for other configuration items. For more information, see Create and manage VBRs.

Configuration item	Description
Name	In this topic, enter `VBR`.
Physical Connection	In this topic, select the Dedicated Express Connect Circuits type, and then select the created Express Connect circuit interface.
VLAN ID	In this topic, enter `0`.
IPv4 Address of Gateway at Alibaba Cloud Side	In this topic, enter `10.0.0.1`.
IPv4 Address of Gateway at Customer Side	In this example, enter `10.0.0.2`.
Subnet Mask (IPv4 Address)	In this example, enter `255.255.255.252`.

Add a route destined for the on-premises IDC in the VBR instance.

On the Virtual Border Router (VBR) page, click the VBR instance ID.
Click the Route tab, and then click Add Route Entry under the Custom Route Entry tab.

On the Add Route Entry panel, configure based on the following information, and then click OK.

Configuration item	Route entry
Next Hop Type	Select Express Connect Circuit.
Destination CIDR Block	Enter the CIDR block `192.168.0.0/16` of the on-premises IDC.
Next Hop	Select the Express Connect circuit that you created.

Important

When you add a route to the data center (IDC) in the VBR instance, we recommend that you add a large CIDR block to ensure that the routes to the data center (IDC) that the transit router subsequently learns over the private IPsec-VPN connection are more specific than the current routes and have a higher route priority.

Add a route to the VPC on the on-premises gateway device.

Note

In this example, the software Adaptive Security Appliance (ASA) 9.19.1 is used to describe how to configure a Cisco firewall. The commands may vary with software versions. Consult the documentation or your vendor based on your actual environment during operations. For more information, see Configure local gateways.

The following content contains third-party product information, which is only for reference. Alibaba Cloud does not make guarantees or other forms of commitments for the performance and reliability of third-party products, or the potential impacts of operations performed by using these products.

ciscoasa> enable
Password: ********             # Enter the enable mode password.
ciscoasa# configure terminal   # Enter configuration mode.
ciscoasa(config)#   
#The interface configuration on the Cisco firewall is complete and the interfaces are enabled. The following section provides an example of the interface configuration used in this topic.
ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0                #The interface that connects to the VBR.
 nameif VBR                                 #The name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 10.0.0.1 255.255.255.252        #The IP address configured on the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/2                #The interface that connects to the data center (IDC).
 nameif private                             #The name of the GigabitEthernet0/2 interface.
 security-level 100                         #Specifies that the security-level of the interface that connects to the data center (IDC) is lower than that of the interface that connects to Alibaba Cloud.
 ip address 192.168.50.215 255.255.255.0    #The IP address configured on the GigabitEthernet0/2 interface.
!
interface GigabitEthernet0/3                #The interface connecting to private IPsec-VPN tunnel 1.
 nameif VPN-IP1                             #The name of the GigabitEthernet0/3 interface.
 security-level 0
 ip address 192.168.10.136 255.255.255.0    #The private IP address configured for the GigabitEthernet0/3 interface.
!
interface GigabitEthernet0/4                #The interface connecting to private IPsec-VPN tunnel 2.
 nameif VPN-IP2                             #The name of the GigabitEthernet0/4 interface.
 security-level 0
 ip address 192.168.40.159  255.255.255.0   #The private IP address configured for the GigabitEthernet0/4 interface.
!
#Configure a static route to the Alibaba Cloud VPC (172.16.0.0/16).
route VBR 172.16.0.0 255.255.0.0 10.0.0.2     
#Configure a route to the on-premises IDC clients.
route private 192.168.0.0 255.255.0.0 192.168.50.216

Step 2: Configure a transit router

After the on-premises IDC is connected to Alibaba Cloud over an Express Connect circuit, start configuring the transit router to enable private network communication between the on-premises IDC and the VPC through the transit router.

Create a CEN instance.
In the Create a CEN instance. dialog box, select Create CEN Only, then customize the Cloud Enterprise Network (CEN) instance name and keep the other configuration items at their default values.
Create a transit router.
Create a transit router instance in the China (Hangzhou) region to connect the VBR instance and the VPC instance. Keep the default settings for the other configuration items.

Create a VPC connection.

On the Basic Information > Forwarding Router tab of the CEN instance details page, find the transit router instance in the China (Hangzhou) region and click Create Connection in the Actions column.

On the Connection with Peer Network Instance page, configure the settings based on the following information, and then click OK to connect the VPC instance to the transit router.

The following section describes only the configuration items that are closely related to this topic. Keep the default settings for the other configuration items. For more information, see Procedure.

Configuration item	Description
Instance Type	Select Virtual Private Cloud (VPC).
Region	Select China (Hangzhou).
Attachment Name	Set a custom name to `VPC-Attachment`.
Network Instance	Select VPC.
VSwitch	Select a vSwitch instance in a zone supported by the transit router. In this topic, vSwitch 2 and vSwitch 3 are selected. In a region that supports multiple zones, you must select one vSwitch instance in each of at least two zones. We recommend that you use vSwitches that do not carry workloads to create the VPC connection.
Advanced Settings	Use the default route configuration, which means enabling all three advanced configurations.

Click Create More Connections to return to the Connection with Peer Network Instance page.

Create a VBR connection.

On the Connection with Peer Network Instance page, configure the connection based on the following information, and then click OK to connect the VBR instance to the transit router. Only the configuration items that are strongly related to this topic are listed below. Keep the other configuration items at their default values. For more information, see Connect a VBR to a transit router.

Configuration item	Description
Instance Type	Select Virtual Border Router (VBR).
Region	Select China (Hangzhou).
Attachment Name	Set the custom name to `VBR-Attachment`.
Network Instance	Select VBR.
Advanced Settings	Use the default route configuration, that is, enable all three advanced configurations.

Step 3: Test private network connectivity

After you complete the preceding configurations, private network communication between the data center (IDC) and the VPC is established. You can perform the following steps to test private network connectivity.

Note

Make sure that you understand the security group rules applied to the ECS instances in the VPC and the access control rules applied to the clients in the data center (IDC), and make sure that the security group rules of the ECS instances and the access control rules of the clients in the data center (IDC) allow the clients in the data center (IDC) to communicate with the ECS instances in the VPC. For more information, see View security group rules and Add a security group rule.

In this step, the access control rules of the data center (IDC) must allow the ICMP protocol and the VPC CIDR block, and the security group rules of the ECS instances must allow the ICMP protocol and the data center (IDC) CIDR block.

Log on to the ECS1 instance in the VPC. For more information, see Connection method overview.

Run the ping command to access any client in the data center (IDC) CIDR block.

ping <the IP address of a client in the data center>

[root@iZr***viZ ~]# ping 192.168.20.6
PING 192.168.20.6 (192.168.20.6) 56(84) bytes of data.
64 bytes from 192.168.20.6: icmp_seq=1 ttl=60 time=153 ms
64 bytes from 192.168.20.6: icmp_seq=2 ttl=60 time=152 ms
64 bytes from 192.168.20.6: icmp_seq=3 ttl=60 time=152 ms
64 bytes from 192.168.20.6: icmp_seq=4 ttl=60 time=152 ms
64 bytes from 192.168.20.6: icmp_seq=5 ttl=60 time=152 ms
64 bytes from 192.168.20.6: icmp_seq=6 ttl=60 time=152 ms
^Z
[1]+  Stopped                 ping 192.168.20.6

As shown in the preceding output, if ECS1 can receive response packets, private network communication between the on-premises IDC and the VPC is established.

Step 2: Encrypt private network traffic

After you establish a private connection between the data center and the VPC, create a private IPsec-VPN connection between your customer gateway device and the transit router. Then, configure routes to direct traffic through the IPsec-VPN connection to encrypt the private network traffic.

Step 2a: Create a private IPsec-VPN connection

Add a transit router CIDR block 10.10.10.0/24 to the transit router. For more information, see Add a CIDR block to an existing router.
The transit router CIDR block is used to assign gateway IP addresses to the IPsec connection so that a private IPsec-VPN connection can be established. The transit router CIDR block cannot conflict with the CIDR blocks in the data center (IDC) and the VPC that need to participate in network communication.
Create two customer gateways to register the VPN IP addresses and BGP ASN of the customer gateway device with Alibaba Cloud.
1. Log on to the VPN gateway console.
2. In the left-side navigation pane, choose Interconnections - VPN - Customer Gateways.
3. On the Customer Gateway page, click Create Customer Gateway.
4. In the Create Customer Gateway panel, configure the following parameters and then click OK.
  Only the parameters that are strongly related to this topic are described below. Keep the default values for the other parameters. For more information, see Customer Gateway.
  - Customer gateway 1
    - Name: Set the customer gateway name to Customer-Gateway1.
    - IP Address: Enter VPN IP address 1 of the on-premises gateway device192.168.10.136.
    - ASN: Enter the BGP AS number of the on-premises gateway device65530.
  - Customer gateway 2
    - Name: Set the customer gateway name to Customer-Gateway2.
    - IP Address: Enter the VPN IP address 2 of the on-premises gateway device 192.168.40.159.
    - ASN: Enter the BGP AS number of the on-premises gateway device 65530.

Create a VPC connection.

In the left navigation pane, choose Interconnections > VPN > IPsec Connections.
On the IPsec Connections page, click Bind CEN.

On the Create IPsec-VPN Connection page, configure the IPsec connection based on the following information, and then click OK.

The following content lists only the configuration items that are closely related to this topic. The other configuration items retain their default settings. For more information, see IPsec-VPN connection (attached to a TR).

Parameter	IPsec connection
Name	Set to `IPsec-Connection`.
Region	Select the region where the transit router is deployed. The ipsec-vpn connection is created in the same region as the transit router.
Gateway Type	Select Private.
Bind CEN	Select Same Account.
CEN Instance ID	Select the Cloud Enterprise Network (CEN) instance that you created. The console displays the ID and CIDR block of the transit router that is created for the CEN instance in the current region. The ipsec-vpn connection will be attached to this transit router.
Routing Mode	This topic uses Destination Routing Mode, and the transmitted traffic is then controlled by routes.
Enable BGP	Enable the BGP feature.
Local ASN	Enter the BGP AS number of the IPsec connection `65534`.
Tunnel 1
Customer Gateway	Associate `Customer-Gateway1`.
Pre-Shared Key	`fddsFF111**`. Important** The pre-shared key of the IPsec-VPN connection must be the same as the pre-shared key of the peer gateway device. Otherwise, the IPsec-VPN connection cannot be established.
Encryption Configuration	Keep the default values for all other configuration items except the following parameters. Select group14 for DH Group (Perfect Forward Secrecy) of IKE Settings. Select group14 for DH Group (Perfect Forward Secrecy) of IPsec Settings. Note You need to select encryption parameters based on the on-premises gateway device to ensure that the encryption configurations for the IPsec connection are the same as those for the on-premises gateway device.
BGP Configuration	Tunnel CIDR Block: Enter `169.254.10.0/30`. Local BGP IP address: Enter `169.254.10.1`.
Tunnel 2
Customer Gateway	Associate `Customer-Gateway2`.
Pre-Shared Key	`fddsFF222****`.
Encryption Configuration	Keep the default values for all other configuration items except the following parameters. For the DH Group (Perfect Forward Secrecy) of IKE Settings, select group14. For the DH Group (Perfect Forward Secrecy) of IPsec Settings, select group14. Note You need to select encryption parameters based on the on-premises gateway device to ensure that the encryption configurations for the IPsec connection are the same as those for the on-premises gateway device.
BGP Configuration	Tunnel CIDR Block: Enter `169.254.20.0/30`. Local BGP IP address: Enter `169.254.20.1`.
Advanced Configuration (including route table association and route forwarding)	Use the default route configuration, that is, enable all advanced configuration options.

After the IPsec connection is created, you can view the gateway IP addresses of the IPsec connection on the IPsec connection details page. The IPsec connection uses these two gateway IP addresses to establish a private IPsec-VPN connection with the on-premises gateway device. IPsec-BGP

Return to the IPsec-VPN connection page, find the created IPsec connection, and click Generate Peer Configuration in the Actions column.
The peer configuration is the VPN configuration that you must add to the peer of the IPsec connection. In the scenario described in this topic, you must add these configurations to the on-premises gateway device.
In the IPsec-VPN Connection Configuration dialog box, copy the configuration and save it locally for subsequent configuration of the on-premises gateway device.

Configure the customer gateway device.

After you create the IPsec-VPN connection, add the VPN configuration to your customer gateway device to establish a private IPsec-VPN connection with Alibaba Cloud.

Customer gateway configuration

Log on to the command line window of the Cisco firewall and enter configuration mode.

ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

View the interface and route configurations.

The Cisco firewall interfaces have been configured and enabled. The following shows the interface configuration for this topic.

ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/3               #Interface for private IPsec-VPN tunnel 1.
 nameif VPN-IP1                            #Name of the GigabitEthernet0/3 interface.
 security-level 0
 ip address 192.168.10.136 255.255.255.0   #Private IP address of the GigabitEthernet0/3 interface.
!
interface GigabitEthernet0/4               #Interface for private IPsec-VPN tunnel 2.
 nameif VPN-IP2                            #Name of the GigabitEthernet0/4 interface.
 security-level 0
 ip address 192.168.40.159  255.255.255.0  #Private IP address of the GigabitEthernet0/4 interface.
!

#Configure routes to the gateway IP addresses of the IPsec connection to establish the private IPsec-VPN connection.
route VBR 10.10.10.49 255.255.255.255 10.0.0.2   #Configure a route to the private IP address of Tunnel 1 on the Alibaba Cloud side.
route VBR 10.10.10.50 255.255.255.255 10.0.0.2   #Configure a route to the private IP address of Tunnel 2 on the Alibaba Cloud side.

Enable IKEv2 for the interface.

crypto ikev2 enable VPN-IP1
crypto ikev2 enable VPN-IP2

Create an IKEv2 Policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.
Important
On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.
```
crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.
```

Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

Important

On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

Create a tunnel group and specify the pre-shared key of the tunnel, which must be consistent with that on the Alibaba Cloud side.

tunnel-group 10.10.10.49 type ipsec-l2l                    #Specify l2l as the encapsulation mode of tunnel 1.
tunnel-group 10.10.10.49 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key fddsFF111****  #Specify the pre-shared key of the peer of tunnel 1, that is, the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF111****   #Specify the pre-shared key of the local end of tunnel 1, which must be consistent with that on the Alibaba Cloud side.
!
tunnel-group 10.10.10.50 type ipsec-l2l                    #Specify l2l as the encapsulation mode of tunnel 2.
tunnel-group 10.10.10.50 ipsec-attributes
 ikev2 remote-authentication pre-shared-key fddsFF222****  #Specify the pre-shared key of the peer of tunnel 2, that is, the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF222****   #Specify the pre-shared key of the local end of tunnel 2, which must be consistent with that on the Alibaba Cloud side.
!

Create a tunnel interface.

interface Tunnel1                                  #Create the interface for tunnel 1.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface VPN-IP1                   #Specify the source address of tunnel 1 as interface GigabitEthernet0/3.
 tunnel destination 10.10.10.49                    #Specify the destination address of tunnel 1 as the private IP address of tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Specify that tunnel 1 uses the ipsec profile ALIYUN-PROFILE.
 no shutdown                                       #Enable the tunnel 1 interface.
!
interface Tunnel2                                  #Create the interface for tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.20.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface VPN-IP2                   #Specify the source address of tunnel 2 as interface GigabitEthernet0/4.
 tunnel destination 10.10.10.50                    #Specify the destination address of tunnel 2 as the private IP address of tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Specify that tunnel 2 uses the ipsec profile ALIYUN-PROFILE.
 no shutdown                                       #Enable the tunnel 2 interface.
After completing the preceding configuration, the data center (IDC) can successfully establish a private IPsec-VPN connection with Alibaba Cloud. You can view the status of the private IPsec-VPN connection on the details page of the IPsec connection instance in Alibaba Cloud. If a private IPsec-VPN connection is not successfully established in your environment, try to troubleshoot the issue on your own. For more information, see [[0]]. After the configuration is complete, you can view the connection status of the two tunnels on the [[1]] tab of the VPN gateway. Both Tunnel 1 (gateway IP address [[2]]) and Tunnel 2 (gateway IP address [[3]]) display [[4]], and the status is [[5]], which indicates that the private IPsec-VPN connection is successfully established.
!

After you complete these configurations, your customer gateway device establishes a private IPsec-VPN connection with Alibaba Cloud, but BGP peering is not yet established. You can check the status on the IPsec connection details page in the Alibaba Cloud console. If the connection fails, see Self-service diagnostics. IPsec-VPN only

Step 2b: Configure routing

After you create the private IPsec-VPN connection, traffic between the data center and the VPC still flows over the unencrypted physical connection. Configure routes to direct traffic through the encrypted IPsec-VPN connection.

Add BGP configurations to your customer gateway device to establish a BGP peering relationship with the IPsec connection. This allows the on-premises data center and the VPC to automatically learn each other's routes through BGP dynamic routing.

#Add BGP configurations to establish BGP peering between the customer gateway device and the IPsec connection.
router bgp 65530
 address-family ipv4 unicast
  neighbor 169.254.10.1 remote-as 65534       #Specify the BGP peer, which is the IP address of Tunnel 1 on the Alibaba Cloud side.
  neighbor 169.254.10.1 activate              #Activate the BGP peer.
  neighbor 169.254.20.1 remote-as 65534       #Specify the BGP peer, which is the IP address of Tunnel 2 on the Alibaba Cloud side.
  neighbor 169.254.20.1 activate              #Activate the BGP peer.
  network 192.168.10.0 mask 255.255.255.0     #Advertise a CIDR block of the on-premises data center. This CIDR block must be more specific than the CIDR block that is added to the VBR instance.
  network 192.168.20.0 mask 255.255.255.0
  network 192.168.40.0 mask 255.255.255.0 
  maximum-paths 5                             #Increase the number of BGP ECMP equal-cost routes.
 exit-address-family
 
#Change the administrative distance of the static route to the Alibaba Cloud VPC (172.16.0.0/16) to a value higher than the BGP route's administrative distance. A higher administrative distance indicates a lower priority. The default administrative distance for eBGP is 20.
route VBR 172.16.0.0 255.255.0.0 10.0.0.2 30

Add a custom route entry for the transit router.

After the preceding route configuration is complete, the private IPsec-VPN connection is interrupted. You must add a specific route destined for the VPN IP address of the on-premises gateway device to the route table of the transit router, with the next hop pointing to the VBR instance, to re-establish the private IPsec-VPN connection.

Stay on the Route Table tab, click the Route tab, and then click Create Route.

In the Add Route Entry dialog box, configure the route entry information, and then click OK.

Parameter	CIDR block 1	CIDR block 2
Destination CIDR	Enter VPN IP address 1 of the on-premises gateway device `192.168.10.136/32`.	Enter VPN IP address 2 of the on-premises gateway device `192.168.40.159/32`.
Blackhole Route?	Select No.
Next Hop Connection	Select VBR-Attachment.

Add a routing policy to the transit router route table to prevent the private IPsec-VPN connection from advertising VPN IP address routes back to the data center, which would create a routing loop.
1. Log on to the Cloud Enterprise Network console.
2. On the CEN Instance page, find the CEN instance that you created and click the instance ID.
3. On the instance details page, click the transit router ID for the China (Hangzhou) region.
4. On the transit router details page, click the Forwarding router routing table tab, and then click Routing Policy.
5. On the Routing Policy tab, click Add Route Map. Configure the route policy and click OK.
  This topic describes only the parameters that are relevant to this scenario. For the other parameters, use the default values. See Routing policies.
  - Policy priority: In this topic, enter 40.
  - Associate routing tables: Retain the default value.
  - Effective Direction: Select Outbound Gateway.
  - Match Condition:
    - Destination Instance IDs: the ID of the IPsec connection instance.
    - Route Prefix: Select Exact match and enter 192.168.10.136/32 and 192.168.40.159/32 for the VPN IP address of the on-premises gateway device.
  - Strategic Behavior: Select Reject.

Step 3: Verify the encryption effect

After you complete the preceding configurations, if you can view traffic transmission monitoring data on the details page of the IPsec connection, the private network traffic over the Express Connect circuit is encrypted.

Log on to the ECS1 instance in the VPC. Run the ping command to continuously access any client in the on-premises IDC CIDR block.
```
ping <IP address of a client in the data center> -s 1000 -c 10000
```
- -s 1000: specifies to send 1000-byte packets.
- -c 10000: continuously sends 10000 request packets.
Log on to the VPN Gateway console.
In the top navigation bar, select the China (Hangzhou) region.
In the left-side navigation pane, choose Interconnections - VPN - IPsec Connections.
On the IPsec-VPN connection page, find the created IPsec connection and click the IPsec connection ID.
View the traffic transmission monitoring data on the IPsec connection details page.