A customer gateway represents your on-premises gateway device in an IPsec-VPN connection. When you create one, you register the device IP address and autonomous system number (ASN) with Alibaba Cloud. A customer gateway works with an IPsec-VPN connection and a VPN gateway or transit router to form a complete VPN tunnel.
Create a customer gateway
Console
Go to the Customer Gateway page in the VPN Gateway console. Select the target region.
Click Create Customer Gateway, configure the settings based on the following information, and then click OK after the configuration is complete.
IP Address:
If you need to create a public IPsec connection, enter the static public IP address of the on-premises gateway device;
If you need to create a private IPsec connection, enter the static private IP address of the on-premises gateway device.
The following IP addresses are not supported: 100.64.0.0~100.127.255.255; 127.0.0.0~127.255.255.255; 169.254.0.0~169.254.255.255; 224.0.0.0~239.255.255.255; 255.0.0.0~255.255.255.255.
ASN: If you plan to enable BGP, configure the ASN (Autonomous System Number) of the on-premises gateway device.
The ASN value range is 1~4294967295. It cannot be the same as the Alibaba Cloud ASN
45104.You can enter the value in a two-segment format: first 16 bits.last 16 bits. Enter each segment in decimal. For example, entering 123.456 indicates the ASN 123*65536+456=8061384.
API
Call the CreateCustomerGateway API:
Pass the region ID where the customer gateway is located in the
RegionIdfield. You can obtain the region ID by calling the DescribeRegions API. The region of the customer gateway must be the same as the region of the VPN Gateway instance or the Transit Router (TR) instance.Pass the static IP address of the on-premises data center gateway device in the
IpAddressfield.(Optional) Pass the ASN of the on-premises gateway device in the
Asnfield.
After creating the customer gateway, you can start creating an IPsec connection. See:
Modify IP address or ASNModify a customer gateway
You cannot directly modify the IP address or ASN of a customer gateway. Delete the customer gateway and then create a new one.
Delete a customer gateway
Before deleting a customer gateway, ensure that it is not associated with any IPsec connections. See:
Console
Go to the Customer Gateway page in the VPN Gateway console. Select the target region.
Find the target customer gateway, click Actions in the Delete column, and then confirm.
API
Call the DeleteCustomerGateway API:
Pass the region ID where the customer gateway is located in the
RegionIdfield. You can obtain the region ID by calling the DescribeRegions API.Pass the ID of the customer gateway in the
CustomerGatewayIdfield. You can obtain the ID of an existing customer gateway by calling the DescribeCustomerGateways API.
Billing description
Customer gateways are free. You are charged for IPsec-VPN connections based on the attached resource type. See IPsec-VPN billing.