IPsec connection (VPN gateway)-VPN Gateway(VPN)-阿里云帮助中心

After you create a VPN gateway, you must configure IPsec connections on both the Alibaba Cloud side and the local IDC side to enable communication between your local data center and the VPC.

How it works

Alibaba Cloud IPsec connections use Dual-tunnel mode (primary tunnel + backup tunnel) by default, providing link redundancy and high availability.

Primary tunnel (IPsec address 1): Carries all service traffic.
Backup tunnel (IPsec address 2): In standby state. Automatically takes over when the primary tunnel fails.
Fixed roles: The primary and backup roles cannot be changed.
Health check: The system automatically detects the connectivity of the primary tunnel, automatically switches over on failure, and automatically switches back after recovery.
Zone-level disaster recovery: The two tunnels are deployed in different availability zones by default to provide cross-zone disaster recovery. In regions that support only one availability zone, the two tunnels are deployed in the same availability zone, which does not support zone-level disaster recovery, but still provides link redundancy.
Existing single-tunnel VPN gateways can only create IPsec connections in single-tunnel mode. Please Upgrade to dual-tunnel mode as soon as possible.

Create an IPsec-VPN connection

Before creating an IPsec connection, make sure you have created VPN gateway and User gateway instance.

If you are creating a cryptography (SM) VPN gateway instance, the following conditions must also be met:

For the cryptography (SM) VPN gateway Associate an SM certificate.
You have obtained the CA (Certification Authority) certificate of the cryptography (SM) VPN gateway peer and the subject information of the peer signature certificate.

Enhanced VPN gateway (console)

Go to the VPN console IPsec Connections page, click Bind VPN Gateway, and complete the following configuration:

Name: Enter a meaningful name, for example dev-dc01-backup (environment-peer identifier-purpose).
Region: Select the region of the VPN gateway to be associated.
Gateway Type: Select Enhanced IPsec-VPN.
Billing: By default, a BGP (multi-line) line type is used. With CDT billing, you can enjoy a free quota of 220 GB per month (20 GB/month in the Chinese mainland and 200 GB/month in regions outside the Chinese mainland).
Bind VPN Gateway: Select the target VPN gateway.
Routing Mode:
- Destination Routing Mode (default value): Matches the "destination IP address" to forward traffic. Suitable for simple scenarios.
- Protected Data Flows: Matches the "source IP address" and "destination IP address" to forward traffic. Only traffic that matches successfully is sent through the VPN tunnel.
  After you select this mode, you must configure Local Network (the CIDR blocks that need to communicate in the VPC) and Remote Network (the CIDR blocks that need to communicate in the local data center).
  After the IPsec connection is configured, the system automatically generates Destination route: Destination CIDR Block is the IPsec connection Remote Network, and the next hop points to the IPsec connection. It can be published to the VPC route table (not published by default).
  - When configuring traffic of interest on the local gateway device, make sure that the CIDR blocks used are consistent with those on the Alibaba Cloud side, and swap the CIDR blocks on both ends.
  - You can click the icon on the right side of the text box to add multiple CIDR blocks. When configuring multiple CIDR blocks, select ikev2 for the IKE protocol version. GM-compliant Traditional VPN Gateways support only IKEv1 and therefore cannot be configured with multiple CIDR blocks.
Effective Immediately: If you need to quickly enable the connection or avoid traffic latency, we recommend selecting "Yes". If you want to conserve resources and traffic is infrequent, select "No".
BGP configuration: See Enable or disable BGP.
Tunnel configuration: See Tunnel and encryption for the configuration of the parameters in Tunnel 1 (Primary) and Tunnel 1 (Backup).

Traditional VPN gateway (console)

Go to the VPN console IPsec Connections page, click Bind VPN Gateway, and complete the following configuration:

Name: Enter a meaningful name, for example dev-dc01-backup (environment-peer identifier-purpose).
Region: Select the region of the VPN gateway to be associated.
Gateway Type: Select Standard VPN Gateway.
Bind VPN Gateway: Select the target VPN gateway.
Routing Mode:
- Destination Routing Mode (default value): Matches the "destination IP address" to forward traffic. Suitable for simple scenarios.
- Protected Data Flows: Matches the "source IP address" and "destination IP address" to forward traffic. Only traffic that matches successfully is sent through the VPN tunnel.
  After you select this mode, you must configure Local Network (the CIDR blocks that need to communicate in the VPC) and Remote Network (the CIDR blocks that need to communicate in the local data center).
  After the IPsec connection is configured, the system automatically generates Policy route: Source CIDR Block is the IPsec connection Local Network, Destination CIDR Block is the IPsec connection Remote Network, and the next hop points to the IPsec connection. It can be published to the VPC route table (not published by default).
  - When configuring traffic of interest on the local gateway device, make sure that the CIDR blocks used are consistent with those on the Alibaba Cloud side, and swap the CIDR blocks on both ends.
  - You can click the icon on the right side of the text box to add multiple CIDR blocks. When configuring multiple CIDR blocks, select ikev2 for the IKE protocol version. GM-compliant Traditional VPN Gateways support only IKEv1 and therefore cannot be configured with multiple CIDR blocks.
Effective Immediately: If you need to quickly enable the connection or avoid traffic latency, we recommend selecting "Yes". If you want to conserve resources and traffic is infrequent, select "No".
BGP Configuration: See Enable or disable BGP.
Tunnel configuration: See Tunnel and encryption for the configuration of the parameters in Tunnel 1 (Primary) and Tunnel 1 (Backup).

API

Call CreateVpnConnection to create an IPsec connection.

Next steps

To enable communication between the VPC on the cloud and the IDC on your premises after the IPsec connection is created, you also need to:

Route configuration.
Configure the local gateway device: Based on the IPsec connection parameters on the cloud, complete the IPsec and BGP (if enabled) configuration on the gateway device (such as a firewall or router) in your local data center.
If you use third-party or non-mainstream vendor routers on-premises such as TP-Link, D-Link, or Mikrotik, first confirm whether the device firmware supports the standard IPsec-VPN protocols (IKEv1/IKEv2). After confirming support, refer to the device vendor's documentation and complete the integration together with the parameter descriptions in the "Tunnel and encryption" section of this topic.

Enable or disable BGP

Before enabling BGP for an IPsec connection, make sure the associated Customer Gateway instance has been configured with the autonomous system number (ASN) of the on-premises network.

BGP configuration items related to the IPsec connection:

Local ASN: The ASN of the Alibaba Cloud side after BGP is enabled. Both tunnels use the same ASN. Default value: 45104. Valid values: 1 to 4294967295. When configuring the ASN on the on-premises device, we recommend using a private ASN.
Tunnel CIDR Block: The interconnection CIDR block used to establish BGP neighbor connections. In a VPN gateway instance, the CIDR block of each tunnel must be unique. It must be a /30 subnet within 169.254.0.0/16, and cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, or 169.254.169.252/30.
Local BGP IP address: The BGP IP on the Alibaba Cloud side. It must belong to the tunnel CIDR block. For example, in the 169.254.10.0/30 CIDR block, you can use 169.254.10.1.

For information about BGP routing support, route advertisement rules, and usage limits, see Configure BGP dynamic routing.

Console

Enable BGP

When creating an IPsec connection:
- In the Dual-Tunnel Settings area, Enable BGP, and configure Local ASN.
- In the BGP Configuration of each tunnel, enter Tunnel CIDR Block and Local BGP IP address.
For an existing IPsec connection, in the IPsec Connections area on the IPsec connection details page, Enable BGP.
Make sure the user gateway instance has been configured with an ASN. Otherwise, you must create a new user gateway and click Edit in the Actions column of each tunnel to re-associate the user gateway.

Disable BGP

In the IPsec Connections area on the IPsec connection details page, disable BGP Configuration.

API

When creating a new IPsec connection, set the EnableTunnelsBgp parameter of CreateVpnConnection to enable BGP, and set the TunnelOptionsSpecification -> TunnelBgpConfig parameters to configure BGP options for each tunnel.
For an existing IPsec connection, set the EnableTunnelsBgp parameter of ModifyVpnConnectionAttribute to enable or disable BGP, and configure BGP options for each tunnel by setting the TunnelOptionsSpecification -> TunnelBgpConfig parameters.

Tunnel and encryption

Important

When creating an IPsec-VPN connection in dual-tunnel mode, configure both tunnels so that they are both in an available state. If you configure or use only one tunnel, you cannot benefit from the primary-backup link redundancy and zone-level disaster recovery capabilities of the IPsec-VPN connection.

When creating or editing an IPsec connection, you need to configure tunnel-related parameters, which are divided into three parts:

Basic Settings:
- Customer Gateway: Select the user gateway instance that represents your local gateway device. Both tunnels can be associated with the same user gateway.
  If the drop-down list is empty or you cannot find the customer gateway instance you created, confirm the following two points: the VPN gateway, IPsec connection, and Customer Gateway must be in the same region; a customer gateway instance has been successfully created in that region. The Customer Gateway drop-down list is filtered by the currently selected region and displays only customer gateway instances in the same region. Switching the region clears the selected customer gateway, and you need to select it again.
- RemoteId: This option is available only when the Standard VPN Gateway is cryptography (SM) type. Set the subject information of the peer signature certificate. Make sure the subject information (such as company name, department, region, etc.) provided when applying for the peer signature certificate is in English. For example:
  CN=z****,O=hangzhou,OU=hangzhou,C=CN
- Peer CA Certificate: This option is available only when the Standard VPN Gateway is cryptography (SM) type. By entering the peer CA certificate, the VPN gateway instance can verify the validity of the peer certificate when establishing an IPsec-VPN connection.
  If you have saved the peer CA certificate locally, click Upload Certificate to upload it to Alibaba Cloud.
- Pre-Shared Key: The pre-shared key used for identity authentication. The keys of both tunnels must be identical to the configuration on the local gateway device. If left empty, the system generates a random key.

Encryption Configuration:

Enhanced VPN: Supports multi-algorithm compatibility mode. The system selects multiple encryption algorithms by default and automatically negotiates algorithms with on-premises gateway devices that support multi-algorithm compatibility.
Standard VPN: You must specify the algorithm configuration separately, and it must match the algorithms supported by the on-premises gateway device.

Parameter		Description
IKE Configurations	Version	We recommend using ikev2. IKEv2 simplifies the SA negotiation process and provides better support for multi-CIDR-block scenarios. GM-compliant VPN gateways support only IKEv1.
	Negotiation Mode	main (default): Main mode. This mode encrypts identity information during transmission, and the negotiation process is more secure than aggressive mode. aggressive: Aggressive mode. Negotiation is fast with a high success rate. After negotiation is successful, both modes provide the same level of security for information transmission.
	Encryption Algorithm	The encryption algorithm used in phase 1 negotiation. Enhanced VPN: supports AES128, AES128-GCM-16, AES192, AES256, AES256-GCM-16, DES, and 3DES. Recommended: AES128-GCM-16 and AES256-GCM-16, which offer high performance and are more secure. Not recommended: DES, 3DES. Standard VPN: Compared with Enhanced VPN, AES128-GCM-16 and AES256-GCM-16 are not supported. When the type is cryptography (SM), the encryption algorithm supports sm4 (default). When the instance bandwidth is 200 Mbps or higher, we recommend using AES128, AES192, or AES256 encryption algorithms, and do not recommend using the 3des encryption algorithm. AES is a symmetric key encryption algorithm that provides high-strength encryption and decryption. It ensures secure data transmission with minimal impact on network latency, throughput, and forwarding performance. 3DES is the Triple Data Encryption Algorithm. It takes longer to encrypt, has higher algorithm complexity, and requires more computation, which reduces forwarding performance compared with AES.
	Authentication Algorithm	The authentication algorithm used in phase 1 negotiation. Supports sha1 (default), md5, sha256, sha384, and sha512. When the Standard VPN Gateway is cryptography (SM) type, the authentication algorithm supports sm3 (default). When adding VPN configuration on some local gateway devices, you may need to specify the PRF algorithm. The PRF algorithm should be consistent with the IKE phase authentication algorithm.
	DH Group (Perfect Forward Secrecy)	Select the Diffie-Hellman key exchange algorithm for phase 1 negotiation. disabled: indicates that the DH key exchange algorithm is not used. For clients that do not support PFS, select disabled. If you select any group other than disabled, PFS (Perfect Forward Secrecy) is enabled by default. This means the key is updated during each re-negotiation. Therefore, the corresponding client must also enable PFS. group1-group24: A larger DH group number indicates higher security, but also higher performance overhead. We recommend confirming which DH Groups the VPN peer supports, and then selecting an ECDH group (Group 19, 20, 21) from the commonly supported list. Standard VPN only supports group1/2/5/14.
	SA Life Cycle (seconds)	Set the lifetime of the SA (Security Association) negotiated in phase 1. Default value: 86400. Valid values: 0 to 86400. The lifetime configuration on the cloud must be consistent with the on-premises configuration.
	LocalId	The identifier of the local end of the tunnel. The IP address of the tunnel is used as the local identifier by default. This parameter is only used as an identifier to identify Alibaba Cloud during IPsec-VPN connection negotiation, and has no other purpose. It supports IP address format or FQDN (Fully Qualified Domain Name) format, and cannot contain spaces. We recommend using a private IP address as the local identifier of the tunnel. If LocalId uses the FQDN format, for example example.aliyun.com, the peer ID of the IPsec connection on the local gateway device must be consistent with the value of LocalId, and the negotiation mode should be aggressive.
	RemoteId	The identifier of the peer end of the tunnel. By default, the IP address in the user gateway associated with the tunnel is used as the peer identifier. This parameter is only used as an identifier to identify the local gateway device during IPsec-VPN connection negotiation, and has no other purpose. It supports IP address format or FQDN (Fully Qualified Domain Name) format, and cannot contain spaces. We recommend using a private IP address as the peer identifier of the tunnel. If RemoteId uses the FQDN format, for example example.aliyun.com, the local ID of the IPsec connection on the local gateway device must be consistent with the value of RemoteId, and the negotiation mode should be aggressive.
IPsec Configurations	Encryption Algorithm	Configure the phase 2 negotiation settings. You can refer to the corresponding option descriptions in phase 1 IKE Configurations.
	Authentication Algorithm
	DH Group (Perfect Forward Secrecy)
	SA Life Cycle (seconds)
DPD		Peer liveliness detection, We recommend keeping it enabled (default).. It can detect peer failures in a timely manner and trigger switchover, which is key to high availability. After DPD is enabled, the IPsec connection sends DPD packets to detect whether the peer device is alive. If no correct response is received within the specified time, the peer is considered offline. The IPsec connection deletes the ISAKMP SA and the corresponding IPsec SA, and the secure tunnel is also deleted. After a DPD timeout, the IPsec connection automatically re-initiates the IPsec-VPN tunnel negotiation. The DPD packet timeout is 30 seconds. When the IPsec connection uses IKEv2, for some existing VPN gateway instances, the DPD timeout may be 130 seconds or 3600 seconds. In this case, you can Upgrade the VPN gateway instance to the latest version.
NAT Traversal		We recommend keeping the default enabled state. After it is enabled, the IKE negotiation process skips the UDP port number verification, and NAT gateway devices in the encrypted communication channel can be detected.

BGP Configuration: This option is available only after BGP is enabled. For details, see Enable or disable BGP.

Console

When creating an IPsec connection, you can directly configure tunnel-related settings.
For an existing IPsec connection, click the target IPsec connection Instance ID to go to the details page, and click Edit in the Actions column of the target tunnel to modify the tunnel configuration.

Important

API

Call ModifyTunnelAttribute to modify the tunnel configuration.

Modify an IPsec-VPN connection

When the IPsec connection is already associated with a VPN gateway instance, you cannot change the associated VPN gateway instance. You can only modify the Routing Mode and Effective Immediately configurations of the IPsec connection. The Effective Immediately option controls when the new configuration takes effect:

Yes: The system immediately triggers IKE re-negotiation and rebuilds the tunnel with the new configuration, causing a brief traffic interruption. We recommend performing this operation during off-peak hours.
No: The new configuration is not applied immediately. Instead, it takes effect automatically during the next SA lifecycle re-negotiation.

If you use the destination route mode, adding or removing interconnected CIDR blocks only requires adjusting the route configuration. You do not need to modify the IPsec connection itself, and the IPsec-VPN connection will not be interrupted.

Console

Go to the VPC console IPsec Connections page, switch to the target region, and click Edit in the Actions column of the target IPsec connection.
On the Modify IPsec-VPN Connection page, modify settings such as the connection name and network segments, and then click OK.
For detailed descriptions of the parameters, see Create an IPsec-VPN connection.

API

Call ModifyVpnConnectionAttribute to modify the IPsec connection configuration.

Delete an IPsec-VPN connection

Console

Go to the VPC console IPsec Connections page, switch to the target region, and click Delete in the Actions column of the target IPsec connection.
In the dialog box that appears, confirm the information, and then click OK.

API

Call DeleteVpnConnection to delete the IPsec connection.

Billing

Enhanced VPN: Only the IPsec connection is billed. Connection fee + public network traffic fee and are charged.
Standard VPN: The IPsec connection itself is not billed, but the associated VPN gateway instance incurs charges. For details, see IPsec-VPN billing .

FAQ

Phase 1 negotiation failed

If both the cloud and on-premises sides have completed IPsec-related configuration, the common causes are:

Pre-shared key mismatch: Carefully verify the pre-shared key on the Alibaba Cloud side and the local gateway device to ensure they are identical, including case sensitivity and special characters.
Inconsistent IKE parameters: Check whether the IKE version, negotiation mode, encryption algorithm, authentication algorithm, DH group, and other parameters match exactly on both ends.
Network issue: Check whether the public IP of the local gateway device is reachable, and whether a firewall or ISP policy is blocking UDP ports 500/4500.

Tunnel is up but no connectivity

Successful tunnel negotiation only indicates that the encrypted channel has been established. Whether data can pass through also depends on the following:

Route configuration: Check whether the Alibaba Cloud VPC route table and the local data center route table are correctly configured to direct traffic to the IPsec connection.
Security group and network ACL: Check whether the security group of the cloud ECS instance allows ICMP or other service port traffic from the local CIDR block.
Local firewall policy: Check whether the firewall in the local data center allows traffic from the VPC CIDR block.

After connecting different cloud environments through a combination of IPsec VPN and Express Connect, why is the internal network still unreachable?

Physical network connectivity does not mean that internal networks are automatically interconnected. If the IPsec connection uses interesting traffic mode, only traffic that matches Local Network and Remote Network enters the VPN tunnel for transmission.

Therefore, when connecting different cloud environments (for example, Alibaba Cloud and other cloud environments) through a combination of IPsec VPN and Express Connect, you must explicitly add the CIDR blocks of the other cloud environment to Local Network or Remote Network in the interesting traffic configuration of the IPsec connection, to ensure that the traffic matching rules cover all subnets that need to be interconnected. Traffic from subnets that are not covered does not enter the VPN tunnel.

When configuring multiple CIDR blocks, you need to select ikev2 for the IKE protocol version. For more information, see Multi-CIDR block communication: configuration recommendations and FAQ.

If I modify the local or remote CIDR block of an IPsec connection, does the route take effect automatically?

After you modify Local Network or Remote Network, the system synchronously updates the route entries associated with the IPsec connection (an Enhanced VPN Gateway generates a destination-based route, and a Standard VPN Gateway generates a policy-based route). Note that these routes are not published to the VPC route table by default. After the modification is complete, you can go to the VPN gateway to confirm the route configuration or publishing status.

If the connection is still unreachable or the route table is not refreshed after the modification, we recommend that you troubleshoot as follows:

Confirm that the associated route has been published to the VPC route table.
Check whether there is a static route in the VPC route table that conflicts with the new CIDR block.
Confirm that the mask of the local/remote CIDR block is set correctly and covers all target server addresses.
Confirm that the interesting traffic on the on-premises gateway device has been modified synchronously, and that the CIDR blocks on both ends are swapped.

Why can't I enable BGP?

This is because the User gateway associated with the IPsec connection you created is not configured with an ASN (Autonomous System Number). You must delete the current IPsec connection, create a new user gateway configured with an ASN, and then use this new user gateway to create the IPsec connection.

Can Tunnel 2 be the active tunnel?

No. Tunnel 1 (using VPN gateway IP address 1) is fixed as the primary tunnel, and Tunnel 2 (using VPN gateway IP address 2) is fixed as the backup tunnel. These roles cannot be changed.

What should I do if the on-premises device cannot automatically switch dual-tunnel traffic due to mechanism limitations?

The Alibaba Cloud side automatically detects the connectivity of the active tunnel and switches to the standby tunnel when a failure occurs. However, if the on-premises gateway device (for example, a Palo Alto firewall) cannot detect tunnel status changes due to its own mechanism limitations, causing traffic not to switch accordingly, you can use the following two methods:

Use BGP dynamic routing: BGP dynamically distributes and learns routes on both ends, and when the tunnel status changes, route convergence drives traffic switchover.
Configure health check on the on-premises device side: The on-premises device actively probes the reachability of the remote end and triggers a switchover. For specific configuration methods, contact the device vendor.

What should I do if an on-premises data center fails to access a CLB instance over the standby tunnel in dual-tunnel mode?

CLB instances support session persistence by default. When an on-premises data center accesses a CLB instance over the standby tunnel, the CLB instance also sends response packets to the on-premises data center over the standby tunnel. However, by default, a VPN gateway forwards traffic from Alibaba Cloud to the on-premises data center only over the active tunnel and does not forward the response packets that the CLB instance sends over the standby tunnel. As a result, the on-premises data center cannot receive response packets from Alibaba Cloud and access to the CLB instance fails.

Select a solution based on the route type of the IPsec-VPN connection:

Static routing: Modify the route configuration on the on-premises data center side so that traffic destined for the CLB instance is transmitted over the active tunnel.
BGP dynamic routing: Modify the BGP configuration so that traffic destined for the CLB instance is transmitted over the active tunnel.
BGP configuration cannot be modified: Do not enable the standby tunnel and transmit traffic only over the active tunnel. To ensure high availability (HA), create multiple IPsec-VPN connections and enable only the active tunnel for each connection.

How do I automate the configuration of an IPsec connection?

To create in bulk or centrally manage VPN gateways and IPsec connections, we recommend that you use Alibaba Cloud OpenAPI, SDKs, or Terraform to implement automated deployment and management.

Recommended procedure: first manually create an IPsec connection in the console, and verify that tunnel negotiation and business connectivity are normal. Then write an automation script based on this configuration as a baseline.

Related APIs:

Create an IPsec connection: call CreateVpnConnection.
Modify IPsec connection attributes: call ModifyVpnConnectionAttribute.

Related Terraform resources: alicloud_vpn_connection

Can I create a single-tunnel IPsec-VPN connection?

Single-tunnel mode is an early version. Newly created IPsec connections no longer support single-tunnel mode.

For existing single-tunnel Standard VPN gateways, we strongly recommend Upgrade an IPsec-VPN connection to dual-tunnel mode.

The steps to create an IPsec connection for an existing single-tunnel VPN instance are as follows (not recommended):

Create an IPsec-VPN connection for a single-tunnel VPN gateway instance

1. Configure the IPsec connection

Before creating an IPsec connection, make sure you have created User gateway instance.

If you are creating a cryptography (SM) VPN gateway instance, the following conditions must also be met:

For the cryptography (SM) VPN gateway Associate an SM certificate.
You have obtained the CA (Certification Authority) certificate of the cryptography (SM) VPN gateway peer and the subject information of the peer signature certificate.

Console

Go to the VPN console IPsec Connections page, click Bind VPN Gateway, and complete the following configuration:

IPsec Settings

Select the Region and the corresponding instance of the VPN gateway to be associated.
Routing Mode:
- Destination Routing Mode (default): Forwards traffic based on the destination IP address. Suitable for scenarios that use BGP to dynamically learn routes or configure static routes on the VPN gateway. The configuration is simple.
- Protected Data Flows: Forwards traffic based on the source and destination IP addresses. Suitable for complex network scenarios where only specific CIDR blocks need to communicate. After you select this mode, you must configure Local Network (the CIDR blocks that need to communicate in the VPC) and Remote Network (the CIDR blocks that need to communicate in the local data center).
  After the IPsec connection is configured, the system automatically generates Policy route: Source CIDR Block is the IPsec connection Local Network, Destination CIDR Block is the IPsec connection Remote Network, and the next hop points to the IPsec connection. It can be published to the VPC route table (not published by default).
  - When configuring traffic of interest on the local gateway device, make sure that the CIDR blocks used are consistent with those on the Alibaba Cloud side, and swap the CIDR blocks on both ends.
  - You can click the icon on the right side of the text box to add multiple CIDR blocks. When configuring multiple CIDR blocks, select ikev2 for the IKE protocol version. GM-compliant VPN gateways support only IKEv1 and therefore cannot be configured with multiple CIDR blocks.
Effective Immediately: If you need to quickly enable the connection or avoid traffic latency, we recommend selecting "Yes". If you want to conserve resources and traffic is infrequent, select "No".

Basic Settings

Customer Gateway: Select the user gateway instance that represents the local gateway device. Both tunnels can be associated with the same user gateway.
Pre-Shared Key: The pre-shared key used for identity authentication. The keys of both tunnels must be identical to the configuration on the local gateway device. If left empty, the system generates a random key.
RemoteId: This parameter must be configured when the VPN gateway is cryptography (SM) type. Set the subject information of the peer signature certificate. Make sure the subject information (such as company name, department, region, etc.) provided when applying for the peer signature certificate is in English. For example:
CN=z****,O=hangzhou,OU=hangzhou,C=CN
Peer CA Certificate: This parameter must be configured when the VPN gateway is cryptography (SM) type. By entering the peer CA certificate, the VPN gateway instance can verify the validity of the peer certificate when establishing an IPsec-VPN connection.
If you have saved the peer CA certificate locally, click Upload Certificate to upload it to Alibaba Cloud.
BGP Configuration: Determines whether to use BGP dynamic routing.
- Disable (default): Uses static routes. Suitable for scenarios with simple network topologies.
- Enable: Suitable for scenarios with complex network topologies that require automatic route distribution and learning. Prerequisite: The associated user gateway must have an ASN configured.
Local ASN: The ASN of the Alibaba Cloud side after BGP is enabled. Default value: 45104. Valid values: 1 to 4294967295. When configuring the ASN on the on-premises device, we recommend using a private ASN.
Encryption Configuration :: See Tunnel and encryption.
Health Check: Disabled by default. In scenarios that do not involve primary-backup IPsec-VPN connections, configuring a health check for an IPsec connection is not recommended. If you configure a health check, make sure Destination IP Address supports ICMP responses, and add a route entry on the local data center side with the destination CIDR block Source IP Address, a subnet mask of 32 bits, and the next hop pointing to the IPsec connection, to ensure the IPsec connection health check works properly.

API

Call CreateVpnConnection to create an IPsec connection.

2. Configure VPN gateway and VPC routes

Configure according to Route configuration.

3. Configure the on-premises gateway

Based on the peer configuration downloaded in the "Configure IPsec connection" step, complete the IPsec and BGP (if enabled) configuration on the gateway device (such as a firewall or router) in your local data center. For specific configuration methods, refer to the vendor documentation of the corresponding device. Example: Configure the local gateway device.

Must the Local Network exactly match the VPC CIDR block when aggressive mode is used?

No. Negotiation Mode (main or aggressive) and the interesting traffic configuration belong to different stages of IPsec negotiation and are not bound to each other. Local Network only needs to include the service addresses in the VPC that must communicate with the on-premises data center. It does not need to exactly match the VPC CIDR block.

Make sure that the interesting traffic CIDR blocks configured on the on-premises gateway device are consistent with those on the Alibaba Cloud side, with the local and remote CIDR blocks swapped.