Connect an Alibaba Cloud VPC to an AWS VPC

Create two customer gateways. Use the two IP addresses of the Alibaba Cloud VPN Gateway instance as the customer gateway IP addresses.

Create two customer gateways named aliyun1 and aliyun2. Set the BGP ASN to 65530 for both. Use the two public IP addresses of the Alibaba Cloud VPN Gateway instance as the customer gateway IP addresses. Set the type to ipsec.1 for both. After creation, the status of both customer gateways shows Available.

Create a virtual private gateway. Create a virtual private gateway and attach it to the AWS VPC.

After creation, the virtual private gateway status shows Attached, the type is ipsec.1, and the Amazon ASN is 64512. Record the VPC ID associated with this gateway — you need it in subsequent configurations.

Create two site-to-site VPN connections. Associate each VPN connection with a different customer gateway. The following shows the configuration for one connection — the other uses the second customer gateway with the same remaining settings. Keep the tunnel options at their default values. After creation, note the outside IP address of Tunnel 1 for each VPN connection — you use these in Step 3.

Set Local IPv4 Network CIDR to the Alibaba Cloud VPC CIDR block and Remote IPv4 Network CIDR to the AWS VPC CIDR block.

In the Details section of the site-to-site VPN connection creation page, configure the following parameters:

• Name tag: Enter vpn-01

• Target gateway type: Select Virtual private gateway and choose the virtual private gateway you created

• Customer gateway: Select Existing and choose the customer gateway you created from the Customer gateway ID drop-down list

• Routing options: Select Static

• Static IP prefixes: Enter 10.0.0.0/16

• Local IPv4 network CIDR: Enter 10.0.0.0/16

• Remote IPv4 network CIDR: Enter 192.168.0.0/16

On the Tunnel Details tab of the site-to-site VPN connection, you can view the Outside IP address and Inside IPv4 CIDR for each tunnel. At this point, both tunnels show a Down (not connected) status, which is expected.

Enable route propagation. In the route table of the VPC associated with the virtual private gateway, enable route propagation so that routes from the site-to-site VPN connections are automatically propagated to the VPC route table.

On the Route Table details page, select the Route Propagation tab and confirm that the Propagation column for the target virtual private gateway shows Yes, indicating that automatic route propagation is enabled.

Create two customer gateways. Use the two IP addresses of the Alibaba Cloud VPN Gateway instance as the customer gateway IP addresses. Register the BGP Autonomous System Number (ASN) of the Alibaba Cloud IPsec-VPN connection.

In the Customer Gateways page of the AWS VPN console, create two customer gateways:

• aliyun1: BGP ASN 65530, IP address is the first public IP of the Alibaba Cloud VPN Gateway instance.

• aliyun2: BGP ASN 65530, IP address is the second public IP of the Alibaba Cloud VPN Gateway instance.

Both gateway types are ipsec.1, and both statuses show Available.

Create a virtual private gateway. Create a virtual private gateway, specify the BGP ASN for the AWS side, and attach the gateway to the AWS VPC.

After creation, confirm that the virtual private gateway status is Attached, it is associated with the target VPC, and the Amazon ASN is 64512.

Create two site-to-site VPN connections. Associate each VPN connection with a different customer gateway. The following shows the configuration for one connection. For the second connection, set Tunnel 1 Inside IPv4 CIDR to 169.254.214.96/30; all other settings are the same. After creation, view the tunnel details to get the outside IP addresses and BGP IP addresses.

Set Local IPv4 Network CIDR to the Alibaba Cloud VPC CIDR block and Remote IPv4 Network CIDR to the AWS VPC CIDR block.

Configure the key parameters on the VPN connection creation page:

• Target gateway type: Select Virtual private gateway

• Customer gateway: Select Existing and choose the customer gateway you created in the Customer gateway ID field

• Routing options: Select Dynamic (requires BGP)

• Local IPv4 network CIDR: Enter 10.0.0.0/16

• Remote IPv4 network CIDR: Enter 192.168.0.0/16

• Tunnel 1 inside IPv4 CIDR: Enter 169.254.116.208/30

• Tunnel 1 pre-shared key: Enter a custom pre-shared key

After creating the site-to-site VPN connection, click the Tunnel Details tab on the VPN connection page to view tunnel information. Record the Outside IP address and Inside IPv4 CIDR of Tunnel 1 (in this example, 169.254.116.208/30). You need this information when configuring the IPsec-VPN connection on the Alibaba Cloud side. At this point, both tunnels show a Down (not connected) status, which is expected.

Get the pre-shared key and BGP IP addresses for the Alibaba Cloud side. Download the VPN configuration file for the Alibaba Cloud VPN Gateway from the AWS console. The file contains the pre-shared keys and BGP IP addresses you need for Step 3. When downloading, select Generic for Vendor and IKEv2 for IKE version. See Download the configuration file. View the pre-shared key: View the Alibaba Cloud BGP IP address: The outside IP addresses, BGP IP addresses, and associated customer gateway IP addresses for Tunnel 1 of each VPN connection:

If you specified a pre-shared key when creating the site-to-site VPN connection, you don't need to look it up in the configuration file. If you used a system-generated key, find it in the file. The pre-shared keys on the Alibaba Cloud and AWS sides must match.

IPSec Tunnel #1
=====================================

#1: Internet Key Exchange Configuration

Configure the IKE SA as follows:
Please note, these sample configurations are for the minimum requirement...
Category "VPN" connections in the GovCloud region have a minimum requirement...
You will need to modify these sample configuration files to take advantage...
NOTE: If you customized tunnel options when creating or modifying your ...

Higher parameters are only available for VPNs of category "VPN," and not...
The address of the external interface for your customer gateway must be a...
Your customer gateway may reside behind a device performing network a...
To ensure that NAT traversal (NAT-T) can function, you must adjust your f...
If not behind NAT, and you are not using an Accelerated VPN, we recomm...
  - IKE version              : IKEv2
  - Authentication Method     : Pre-Shared Key
  - Pre-Shared Key            : xxx38iNi
  - Authentication Algorithm  : sha1
  - Encryption Algorithm      : aes-128-cbc
  - Lifetime                  : 28800 seconds
  - Phase 1 Negotiation Mode  : main
  - Diffie-Hellman            : Group 2

#3: Tunnel Interface Configuration

Your Customer Gateway must be configured with a tunnel interface that is
associated with the IPSec tunnel. All traffic transmitted to the tunnel
interface is encrypted and transmitted to the Virtual Private Gateway.

The Customer Gateway and Virtual Private Gateway each have two addresses that relate
to this IPSec tunnel. Each contains an outside address, upon which encrypted
traffic is exchanged. Each also contain an inside address associated with
the tunnel interface.

The Customer Gateway outside IP address was provided when the Customer Gateway
was created. Changing the IP address requires the creation of a new
Customer Gateway.

The Customer Gateway inside IP address should be configured on your tunnel
interface.

Outside IP Addresses:
  - Customer Gateway                : 8.xxx.146
  - Virtual Private Gateway         : 3.xxx.52

Inside IP Addresses
  - Customer Gateway                : 169.254.116.210/30
  - Virtual Private Gateway         : 169.254.116.209/30

Enable route propagation. In the route table of the VPC associated with the virtual private gateway, enable route propagation so that routes from the site-to-site VPN connections are automatically propagated to the AWS VPC route table.

On the Route Table details page, select the Route Propagation tab and confirm that the Propagation column for the target virtual private gateway shows Yes, indicating that automatic route propagation is enabled.