DocsICP FilingConsole
Documentation
Home Page VPN Gateway IPsec-VPN User Guide Verify connectivity

Verify connectivity

Updated at:
Copy as MD
Product
My Favorites

After configuring IPsec-VPN and routing, verify end-to-end communication and test high-availability failover.

Check the tunnel status

Before testing connectivity, confirm that IPsec tunnels have negotiated successfully.

  1. Click the target IPsec connection ID to open its details page.

    On the Tunnel tab, check the Connection Status column for each tunnel:

    • Phase 2 of IKE Tunnel Negotiation Succeeded: The tunnel is active and can transmit data.

    • Phase I negotiation failed: IKE negotiation failed. Troubleshoot the parameter configuration.

    • Phase 2 negotiations failed.: IKE negotiation succeeded, but IPsec SA negotiation failed. Troubleshoot the IPsec parameters.

  2. In dual-tunnel mode, both tunnels must show a status of "Phase 2 of IKE Tunnel Negotiation Succeeded". If only one tunnel is active, check the configuration of the other tunnel.

Warning

A single-tunnel configuration lacks active-standby redundancy and cross-zone disaster recovery. Configure and activate both tunnels.

Verify basic connectivity

  1. Ping your on-premises data center from the cloud.

    From an ECS instance in your VPC, ping the private IP of a server in your on-premises data center:

    ping <on_premises_private_ip>

  2. Ping the cloud from your on-premises data center.

    From a server in your on-premises data center, ping the private IP of the ECS instance in your VPC:

    ping <ecs_instance_private_ip>

  3. Confirm bidirectional communication. If the ping commands succeed in both directions, the IPsec-VPN connection and routing are correctly configured.

    If the ping test fails, do not immediately modify the IPsec configuration. Instead, follow the Connection troubleshooting checklist below.

Test high availability failover

Dual-tunnel mode provides link redundancy. Test failover before your services go live.

VPN gateway (active-standby)

  1. Confirm the current traffic path. On the Monitor tab of the IPsec connection details page, view traffic rates of both tunnels by Dimension to verify traffic flows through tunnel 1 (the primary tunnel).

  2. Simulate a primary tunnel failure. On your on-premises gateway device, disable the IPsec configuration for tunnel 1 or shut down its physical interface.

  3. Verify automatic failover. Wait for the DPD timeout (approximately 30 seconds) and observe the following:

    • Tunnel 1 status shows as abnormal on the IPsec connection details page.

    • Ping the on-premises data center from the ECS instance to confirm connectivity is restored.

    • Traffic has switched to tunnel 2 (the standby tunnel).

  4. Restore the primary tunnel. Re-enable the IPsec configuration for tunnel 1 on your on-premises gateway device. After tunnel 1 renegotiates, confirm that traffic switches back automatically.

Transit router (ECMP)

  1. Confirm traffic on both tunnels. On the Monitor tab of the IPsec connection details page, view traffic rates of both tunnels by Dimension to confirm traffic is distributed across both tunnels (ECMP load balancing).

  2. Simulate a tunnel failure. On your on-premises gateway device, disable the IPsec configuration for one tunnel.

  3. Verify traffic convergence. Confirm the remaining tunnel carries all traffic. Ping your on-premises data center from the ECS instance to ensure communication is uninterrupted.

  4. Restore the tunnel. Re-enable the disabled tunnel configuration. After renegotiation, confirm that traffic returns to ECMP load balancing.

Connection troubleshooting checklist

If connectivity tests fail, check these items in order.

1. Abnormal tunnel status: Phase 1 failed

Network unreachability:

  • Check if the public IP address of your on-premises gateway device is reachable.

  • Check if your on-premises gateway device can ping the public IP address of the VPN gateway.

  • Check if your firewall allows traffic on UDP ports 500 and 4500.

Pre-shared key mismatch: Verify that pre-shared keys on Alibaba Cloud and your on-premises device match exactly. Keys are case-sensitive, including special characters.

IKE parameter mismatch: Compare these parameters:

  • IKE version (IKEv1 / IKEv2)

  • Negotiation mode (main / aggressive)

  • Encryption algorithm

  • Authentication algorithm

  • DH group

  • LocalId / RemoteId

2. Tunnel status is normal but ping fails

Routing issues (most common):

  • Check whether the destination route table or BGP route table of the VPN gateway contains a route to your on-premises data center.

  • Check whether the route has been propagated to the VPC route table.

  • Check whether the route table of your on-premises data center contains a route to the VPC CIDR block.

Security group restrictions:

  • Check if the security group of the ECS instance allows inbound ICMP traffic from your on-premises network.

  • Check if a network ACL is blocking the traffic.

On-premises firewall policies:

  • Check if the firewall in your on-premises data center allows traffic from the VPC CIDR block.

  • Confirm that the firewall is not performing secondary filtering on packets within the IPsec tunnel.

3. BGP neighborship fails to establish

  • Confirm that the customer gateway is configured with an ASN.

  • Confirm that BGP is enabled for the IPsec connection.

  • Check if the tunnel CIDR block and BGP IP addresses are correctly configured.

  • Confirm that the BGP configuration on your on-premises gateway device matches the Alibaba Cloud configuration (ASN, neighbor address).

  • If the VPN gateway indicates that BGP is not supported, upgrade the VPN gateway to the latest version.

4. One-way communication

This is usually caused by an incomplete routing configuration:

  • If cloud-to-on-premises works but on-premises-to-cloud fails: check whether the route table in the on-premises data center contains a route to the VPC CIDR block.

  • If on-premises-to-cloud works but cloud-to-on-premises fails: check whether the VPC route table contains a route to the on-premises network.

5. Connection drops intermittently

  • Always keep DPD enabled.

  • Check the SA lifetime settings. They must be identical on both ends.

  • Check if your on-premises gateway device has a connection limit.

  • Check the underlying internet connection quality, including packet loss and latency.

  • If you use BGP, check if the number of route entries is approaching the limit.

If the issue persists, see Troubleshooting.

Next steps

Previous：Route configuration (Transit Router attachment)Next：Configure on-premises devices