When you attach an IPsec-VPN connection to a transit router (TR), you do not need to create a vpn gateway in the cloud. You only need to configure the IPsec-VPN connection to connect the TR to your on-premises data center.
How it works
An IPsec-VPN connection attached to a TR operates in dual-tunnel mode
Active-active: The two tunnels automatically form an ECMP (Equal-Cost Multipath Routing) link to transmit traffic at the same time, which enables load balancing.
Availability zone-level disaster recovery: By default, the two tunnels are deployed in different availability zones to provide cross-zone disaster recovery. For a region that supports only one availability zone, the two tunnels are deployed in the same availability zone. In this case, zone-level disaster recovery is not supported, but link redundancy is still available.
Traffic transmission
Egress traffic: When both tunnels are available, they form an ECMP link. Traffic is distributed based on a hash algorithm and is not guaranteed to be evenly distributed between the two tunnels. If one tunnel fails, the system automatically switches traffic to the other tunnel.
Ingress traffic: The traffic path depends on the routing configuration of your on-premises data center. We recommend that you configure ECMP routing to transmit traffic to the cloud through both tunnels. This ensures path symmetry with egress traffic. If your on-premises data center is configured with active-standby routes or transmits traffic for specific CIDR blocks through only one tunnel, asymmetric routing may prevent return traffic from reaching the on-premises data center through the expected path.
Routing principles
We recommend that you use BGP dynamic routing. If you use static routing, make sure that your on-premises gateway supports static ECMP. Otherwise, you cannot achieve ECMP load balancing for traffic from your on-premises data center to the cloud, which results in asymmetric paths.
Both tunnels must use the same routing protocol (either both BGP or both static routing).
When you use BGP, the two tunnels must use the same local autonomous system number (ASN). We recommend that you also use the same peer ASN for both tunnels.
Create an IPsec-VPN connection
Before you begin, make sure that:
A TR is created.
CIDR blocks are configured for the TR.
A customer gateway is created.
Console
Go to the IPsec Connections page in the vpn gateway console, click Bind CEN, and then configure the following parameters:
Name: Use a consistent and readable naming convention, such as
{project}-{env}-{type}.Region: Select the region where the destination transit router is deployed.
Gateway Type:
Public (default): The IPsec-VPN connection is established over the internet.
Private: The IPsec-VPN connection is established over a private network to encrypt private traffic. For more information about the use cases, see Encrypt private traffic over an Express Connect circuit.
Tunnel Bandwidth:
The 3 Gbps bandwidth feature is in invitation-only preview. To use this feature, contact your account manager.
Standard: 1 Gbps bandwidth per tunnel.
Large: 3 Gbps bandwidth per tunnel.
Bind CEN:
Same Account: Attach the IPsec-VPN connection to a TR that belongs to the current account.
Cross Account: Attach the IPsec-VPN connection to a TR that belongs to another account. After the IPsec-VPN connection is created, you must perform the following steps to complete the attachment:
On the IPsec Connections page of your account, grant cross-account permissions on the IPsec-VPN connection to the TR.
In the peer account, create a cross-account VPN connection.
CEN Instance ID: Select the Cloud Enterprise Network (CEN) instance to which the TR belongs.
This parameter is required only when you set Bind CEN to Same Account.
Routing Mode:
Destination Routing Mode (default): Forwards traffic based on the destination IP address. This mode is suitable for simple scenarios.
Protected Data Flows: Forwards traffic based on both the source and destination IP addresses. Only traffic that matches the specified flows is transmitted through the VPN tunnel.
If you select this mode, you must configure Local Network (the CIDR blocks in the VPC that need to communicate) and Remote Network (the CIDR blocks in the on-premises data center that need to communicate).
After the IPsec-VPN connection is configured, the system automatically generates a policy-based route. The Source CIDR Block is the Local Network of the IPsec-VPN connection, and the Destination CIDR Block is the Remote Network of the IPsec-VPN connection. The next hop points to the IPsec-VPN connection. You can advertise this route to the VPC route table. This option is disabled by default.
When you configure protected data flows on your on-premises gateway device, make sure that the CIDR blocks are consistent with those on the Alibaba Cloud side, but with the local and remote networks swapped.
You can click the
icon to the right of the text box to add multiple CIDR blocks. If you configure multiple CIDR blocks, you must set the IKE version to ikev2.
Effective Immediately: When you create an IPsec-VPN connection, select Yes. When you modify an existing IPsec-VPN connection:
Yes: The system immediately disconnects the current IPsec tunnel and initiates a new IKE negotiation with the new parameters to rebuild the tunnel. This causes a brief traffic interruption.
No: The new configuration is not applied immediately. Instead, the new parameters are used during the next renegotiation, which occurs when the current SA (Security Association) lifetime expires. Until then, the tunnel continues to operate with the old configuration.
Advanced Configuration (including route table association and route forwarding): We recommend that you select all options.
Automatic Advertising: Enables the route synchronization feature for the TR. This automatically advertises routes from the TR route table to the route table of the IPsec-VPN connection.
Automatically Associate with Default Route Table of Transit Router: Traffic that enters the TR from the IPsec-VPN connection is forwarded based on the default route table of the TR.
Automatically Advertise System Routes to Default Route Table of Transit Router: Enables the route learning feature for the TR. The TR automatically learns routes from the route table of the IPsec-VPN connection.
BGP Configurations: For more information, see Enable or disable BGP.
Tunnel Configurations: For more information about the parameters of Tunnel 1 (Primary) and Tunnel 1 (Backup), see Tunnel and encryption configuration.
API
Call the CreateVpnAttachment operation to create an IPsec-VPN connection attached to a TR.
Next steps
After you create the IPsec-VPN connection, you must perform the following steps to connect your VPCs and your on-premises data center:
Configure your on-premises gateway device: On the gateway device in your on-premises data center, such as a firewall or router, configure IPsec and BGP (if enabled) to match the settings of the IPsec-VPN connection on Alibaba Cloud.
Enable or disable BGP
Before you enable BGP for an IPsec-VPN connection, make sure that the associated customer gateway instance is configured with the on-premises autonomous system number (ASN).
The IPsec-VPN connection has the following BGP parameters:
Local ASN: The ASN on the Alibaba Cloud side after you enable BGP. Both tunnels use the same ASN. Default value: 45104. Valid values: 1 to 4294967295. We recommend that you use a private ASN for the peer on-premises device.
Tunnel CIDR Block: The interconnect CIDR block used to establish a BGP peering connection. Within a vpn gateway instance, the tunnel CIDR block for each tunnel must be unique. The CIDR block must be a /30 subnet within 169.254.0.0/16 and cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, or 169.254.169.252/30.
Local BGP IP address: The BGP IP address on the Alibaba Cloud side, which must be within the tunnel CIDR block. For example, in the
169.254.10.0/30CIDR block, you can use169.254.10.1.
For information about BGP feature support, route advertisement principles, and limits, see BGP dynamic routing (attached to a TR).
Console
Enable BGP
When you create an IPsec-VPN connection:
In the Dual-Tunnel Settings section, turn on Enable BGP and configure the Local ASN.
In the BGP Configuration section for each tunnel, enter the Tunnel CIDR Block and Local BGP IP address.
For an existing IPsec-VPN connection, go to its details page and turn on Enable BGP in the IPsec Connections section.
Make sure that the customer gateway instance is configured with an ASN. If not, you must create a new customer gateway. Then, on the details page of the IPsec-VPN connection, click Edit in the Actions column of each tunnel to associate the tunnel with the new customer gateway.
Disable BGP
On the details page of the IPsec-VPN connection, turn off the switch for BGP Configuration in the IPsec Connections section.
API
When you create an IPsec-VPN connection, use the EnableTunnelsBgp parameter of the CreateVpnAttachment operation to enable BGP, and use the TunnelOptionsSpecification -> TunnelBgpConfig parameter to configure the BGP options for each tunnel.
For an existing IPsec-VPN connection, use the EnableTunnelsBgp parameter of the ModifyVpnConnectionAttribute operation to enable or disable BGP, and use the TunnelOptionsSpecification -> TunnelBgpConfig parameter to configure the BGP options for each tunnel.
Tunnel and encryption configuration
When you create an IPsec-VPN connection in dual-tunnel mode, you must configure both tunnels and ensure that they are active. If you configure or use only one tunnel, you lose link redundancy and availability zone-level disaster recovery.
When you create or edit an IPsec-VPN connection, you must configure the following three sets of tunnel parameters:
Basic Settings:
Customer Gateway: Select the customer gateway instance that represents your on-premises gateway device. Both tunnels can be associated with the same customer gateway.
Pre-Shared Key: The secret key used for authentication. The pre-shared keys of the two tunnels must exactly match the keys configured on the on-premises gateway device. If you leave this parameter empty, the system generates a random key.
Encryption Configuration:
IKE Configurations (Phase 1 encryption)
Parameter
Description
Version
We recommend using ikev2. It simplifies the SA negotiation process and provides better support for scenarios with multiple CIDR blocks.
Negotiation Mode
main (default): Main mode. This mode encrypts identity information during transmission and provides higher security during negotiation than aggressive mode.
aggressive: Aggressive mode. This mode offers faster negotiation and a higher success rate.
After a successful negotiation, both modes provide the same level of security for data transmission.
Encryption Algorithm
The encryption algorithm used in Phase 1 negotiation.
Supported algorithms: AES128-GCM16 (in preview), AES256-GCM16 (in preview), AES128, AES192, AES256, DES, and 3DES (not recommended).
The AES128-GCM16 and AES256-GCM16 encryption algorithms are in invitation-only preview. To use them, contact your account manager.
Authentication Algorithm
The authentication algorithm used in Phase 1 negotiation.
Supported algorithms: sha1 (default), md5, sha256, sha384, and sha512.
When you configure the VPN on some on-premises gateway devices, you may need to specify a PRF algorithm. The PRF algorithm must be the same as the IKE authentication algorithm.
DH Group (Perfect Forward Secrecy)
Select the Diffie-Hellman (DH) key exchange algorithm for Phase 1 negotiation.
disabled: Disables the DH key exchange algorithm.
Select disabled for clients that do not support perfect forward secrecy (PFS).
If you select any group other than disabled, the PFS feature is enabled by default. This requires the key to be updated at each renegotiation. Therefore, you must also enable PFS on your on-premises gateway device.
group1/2/5/14/15-24: A larger DH group number indicates higher security but also consumes more resources.
Support for DH groups 15 to 24 is in invitation-only preview. To use these groups, contact your account manager.
SA Life Cycle (seconds)
The lifetime of the SA (Security Association) established in Phase 1. Default value: 86400. Valid values: 0 to 86400.
LocalId
The identifier of the local end of the tunnel. By default, the IP address of the tunnel is used as the local identifier.
This parameter identifies the Alibaba Cloud endpoint during the IPsec-VPN connection negotiation. The value can be an IP address or a Fully Qualified Domain Name (FQDN) and cannot contain spaces. We recommend using a private IP address as the identifier for the local end of the tunnel.
If you use an FQDN for LocalId, such as example.aliyun.com, the peer ID configured on your on-premises gateway device must match the value of LocalId. We recommend that you set the negotiation mode to aggressive.
RemoteId
The identifier of the remote end of the tunnel. By default, the IP address in the associated customer gateway is used as the remote identifier.
This parameter identifies the on-premises gateway device during the IPsec-VPN connection negotiation. The value can be an IP address or a Fully Qualified Domain Name (FQDN) and cannot contain spaces. We recommend using a private IP address as the identifier for the remote end of the tunnel.
If you use an FQDN for RemoteId, such as example.aliyun.com, the local ID configured on your on-premises gateway device must match the value of RemoteId. We recommend that you set the negotiation mode to aggressive.
IPsec Configurations (Phase 2 encryption)
Configure the parameters for Phase 2 negotiation:
Encryption Algorithm, Authentication Algorithm, DH Group (Perfect Forward Secrecy), and SA Life Cycle (seconds): You can refer to the descriptions of the corresponding options in the Phase 1 IKE Configurations section.
DPD: We recommend keeping this feature enabled. DPD (Dead Peer Detection) checks whether the peer device is active. If a peer times out (after 30 seconds), the SA is deleted and renegotiation is automatically initiated.
NAT Traversal: We recommend keeping this feature enabled. When enabled, the system automatically detects NAT devices during tunnel negotiation. If a NAT device is detected, UDP 4500 encapsulation is used. During data transmission, UDP port validation is skipped to ensure that packets with port numbers rewritten by NAT are still received correctly.
BGP Configuration: This option is available only after BGP is enabled. For more information, see Enable or disable BGP.
Manage an IPsec-VPN connection
Modify tunnel configurations
Console
Click the Instance ID of the target IPsec-VPN connection to open the details page. In the Actions column of the target tunnel, click Edit to modify the tunnel configuration.
For a description of each parameter, see Tunnel and encryption configuration.
When you create an IPsec-VPN connection in dual-tunnel mode, you must configure both tunnels and ensure that they are active. If you configure or use only one tunnel, you lose link redundancy and availability zone-level disaster recovery.
API
Call the ModifyTunnelAttribute operation to modify the tunnel configuration.
Modify an IPsec-VPN connection
If an IPsec-VPN connection is attached to a transit router instance, you cannot modify the associated transit router instance or gateway type. You can modify only the Routing Mode and the Effective Immediately setting.
If an IPsec-VPN connection is not attached to a transit router, you cannot modify its gateway type. You can modify only the Routing Mode and the Effective Immediately setting.
Console
Go to the IPsec Connections page in the VPC console, switch to the target region, and click Edit in the Actions column of the target IPsec-VPN connection.
On the Modify IPsec-VPN Connection page, modify parameters such as the name and interconnected networks, and then click OK.
For a description of each parameter, see Create an IPsec-VPN connection.
API
Call the ModifyVpnConnectionAttribute operation to modify the configuration of the IPsec-VPN connection.
Delete an IPsec-VPN connection
Before you delete an IPsec-VPN connection, make sure that the IPsec-VPN connection is detached from the transit router instance.
Console
Go to the IPsec Connections page in the VPC console, switch to the target region, and click Delete in the Actions column of the target IPsec-VPN connection.
API
Call the DeleteVpnAttachment operation to delete the IPsec-VPN connection.
Cross-account TR authorization
Console
Click the Instance ID of the target IPsec-VPN connection to open its details page.
Go to the Cross-account Authorization tab and click Cross-account Authorization. In the Attach to CEN dialog box that appears, configure the following parameters:
Peer Account UID: Enter the main account ID of the peer account.
Peer CEN Instance ID: Enter the ID of the CEN instance to which the TR in the peer account belongs.
Payer:
CEN Instance Owner: The peer account pays the TR connection fee and TR traffic processing fee for the VPN connection.
VPN Owner: Your account pays the TR connection fee and TR traffic processing fee for the VPN connection.
After the authorization is successful, you must create a cross-account VPN connection in the peer account to complete the attachment.
API
Log on to the account to which the TR belongs:
Call the GrantInstanceToTransitRouter operation to authorize the IPsec-VPN connection to use the TR.
Call the CreateTransitRouterVpnAttachment operation to create a VPN connection.
Appendix: Single-tunnel mode (legacy)
For existing single-tunnel IPsec-VPN connections attached to a TR, we strongly recommend deleting and recreating them to enable dual-tunnel mode.
The procedure for single-tunnel mode is similar to that for dual-tunnel mode, with the following key differences:
Unlike in dual-tunnel mode, all parameters for single-tunnel mode are configured at the connection level. There is no separate configuration level for tunnels.
Single-tunnel mode supports a health check feature, which is disabled by default. We do not recommend that you enable health check in non-active/standby scenarios. If you need to configure health checks, add a route entry in your on-premises data center with the destination set to the Source IP, a /32 subnet mask, and the next hop pointing to the IPsec-VPN connection. This ensures that health checks function correctly.
Parameter
Description
Destination IP Address
The IP address in your on-premises data center that Alibaba Cloud can access through the IPsec-VPN connection. This IP address must respond to ICMP requests.
Source IP Address
The IP address on the Alibaba Cloud side that your on-premises data center can access through the IPsec-VPN connection.
Retry Interval
The interval between health check retries. Unit: seconds. Default value: 3.
Number of Retries
The number of health check retries. Default value: 3.
Switch Route
Specifies whether to withdraw the advertised route if the health check fails. Default value: Yes.