DocsICP FilingConsole
官方文档
首页

Manage VPN gateway instances

更新时间：
复制 MD 格式
产品详情
我的收藏

A VPN Gateway instance is a cloud ingress/egress point that connects a VPC with an on-premises data center. When you select IPsec-VPN in VPN Gateway binding mode, you must first create a VPN Gateway instance.

If you select an IPsec connection in TR binding mode, you do not need to create a VPN Gateway instance and can directly create IPsec-VPN connection (attached to a TR).

Features

  • A VPN Gateway instance is a gateway device deployed on the Alibaba Cloud side and serves as the cloud endpoint of an encrypted tunnel. You must first create a VPN Gateway, and then create an IPsec connection based on the VPN Gateway.

  • When creating a VPN Gateway instance, you need to associate a VPC and specify 2 vSwitches in different zones to establish a dual-tunnel IPsec-VPN connection and achieve zone-level disaster recovery.

    For regions that support only one zone, zone-level disaster recovery is not supported. We recommend that you specify two different vSwitch instances in the zone to achieve high availability of IPsec connections.

  • After you create a VPN Gateway instance, the system creates one Elastic Network Interface (ENI) under each of the two specified vSwitches as the interface for traffic exchange between the VPN Gateway and the VPC. Each ENI occupies 1 private IP address under the vSwitch. Ensure that there are sufficient available IP addresses under the vSwitch.

Create a VPN gateway

VPN Gateways are available in two forms: Enhanced and Standard. For details about their differences, see Enhanced vs. standard VPN.

Enhanced VPN gateway (console)

Important

Only the following regions currently support Enhanced VPN Gateway: China (Beijing), China (Hangzhou), China (Shanghai), China (Shenzhen), China (Chengdu), China (Hong Kong), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), US (Silicon Valley), US (Virginia), Germany (Frankfurt), UK (London).

Go to the Console VPN Gateway page, switch to the Enhanced IPsec-VPN tab, and click Create Enhanced IPsec-VPN to start configuration:

  • Region: Select the region where the VPC to be connected is located.

  • VPC: Select the target VPC.

  • vSwitch 1 and vSwitch 2: You need to select the associated VPC and 2 vSwitches deployed in different zones to ensure cross-zone high availability. After IPsec-VPN is enabled, the system creates one Elastic Network Interface (ENI) under each of the 2 vSwitches as the interface for traffic exchange with the VPC using IPsec connections. Each ENI occupies 1 IP address under the vSwitch.

    China (Wuhan) supports only a single zone and cannot achieve zone-level disaster recovery. We recommend that you specify 2 different vSwitches in the zone to achieve high availability of IPsec connections.

Standard VPN gateway (console)

Go to the Console VPN Gateway page, on the Standard VPN Gateway tab, click Create VPN Gateway to start configuration:

If there is no Standard VPN Gateway tab, click Create VPN Gateway directly.

  • Region and zone: Select the region where the VPC is located.

  • Gateway Type: Select Standard. After an IPsec connection is established, the international standard commercial cryptographic algorithm (standard cryptographic algorithm) will be used.

  • Network Type: Select Public network. A public IP will be allocated to establish an IPsec connection. To establish a private IPsec connection, we recommend Use a private IPsec connection to bind the Enterprise Transit Router.

  • Tunnel: Select Dual tunnel.

  • VPC and Virtual vSwitch: You need to select the associated VPC and 2 vSwitches deployed in different zones to ensure cross-zone high availability. After IPsec-VPN is enabled, the system creates one Elastic Network Interface (ENI) under each of the 2 vSwitches as the interface for traffic exchange with the VPC using IPsec connections. Each ENI occupies 1 IP address under the vSwitch. After a VPN Gateway is created, the associated vSwitches cannot be modified.

    China (Wuhan) supports only a single zone and cannot achieve zone-level disaster recovery. We recommend that you specify 2 different vSwitches in the zone to achieve high availability of IPsec connections.

  • Maximum Bandwidth: The maximum bandwidth specification supported by a VPN Gateway varies by region. If you select a bandwidth specification of 5 Mbps or 10 Mbps, the peak bandwidth from the on-premises data center to the VPN Gateway is limited to 10 Mbps. For details, see Quotas and limitations.

  • Enable IPsec-VPN and disable SSL-VPN.

    If the created VPN Gateway does not have IPsec-VPN enabled, in the Feature Configuration column of the target VPN Gateway, click Enable after IPsec Connections.

    Enabling IPsec-VPN for an existing VPN Gateway requires you to pay the feature price difference for the remaining time of the current billing cycle.

  • Billing Cycle:

    You can choose whether to enable auto-renewal:

    • Monthly subscription: The auto-renewal cycle is 1 month.

    • Annual subscription: The auto-renewal cycle is 1 year.

API

  • Call CreateEnhancedVpnGateway to create an Enhanced VPN Gateway.

    Important

    The enhanced VPN gateway was launched in February 2024 and is currently in an invitation-only preview. To use this feature, contact your Alibaba Cloud engineer for access. Supported regions: Malaysia (Kuala Lumpur), UK (London), China (Chengdu), US (Virginia), US (Silicon Valley), China (Hong Kong), and Singapore.

  • Call CreateVpnGateway to create a Standard VPN Gateway.

Next Steps

To enable communication between the cloud VPC and the on-premises IDC, after the VPN Gateway instance is created, you also need to:

  1. Customer Gateway: Register the information of the on-premises gateway device (such as IP address and BGP AS number) to Alibaba Cloud.

  2. Create an IPsec-VPN connection: Create an IPsec encrypted tunnel between the Alibaba Cloud VPN Gateway and the on-premises gateway device to ensure that the connection can be established properly.

Configure an SM-based VPN gateway (standard type)

To meet GM compliance requirements, you can create a GM VPN Gateway and bind two SSL certificate that comply with the GM (SM2) standard, for data encryption and identity authentication respectively.

  • Supported regions: China (Hangzhou), China (Shanghai), China (Nanjing - Local Region), China (Fuzhou - Local Region), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Wuhan - Local Region), and China (Chengdu).

  • Only SSL certificates that comply with the GM (SM2) standard under Alibaba Cloud Certificate Management Service can be bound. You can purchase GM (SM2) standard SSL certificates in Alibaba Cloud Certificate Management Service, or upload existing GM (SM2) standard SSL certificates to Alibaba Cloud Certificate Management Service.

  • The subject information of the GM (SM2) standard SSL certificate (such as the company name, department, and company region entered when applying for the certificate) must be in English.

  • Ensure that the peer to be connected by the GM VPN Gateway also uses GM cryptographic algorithms; otherwise, the IPsec connection cannot be established properly.

  • A Standard VPN Gateway and a GM VPN Gateway cannot be converted to each other.

  • When using a GM VPN Gateway to create an IPsec connection, the IKE version only supports IKEv1.

Console

  1. Create a GM VPN Gateway: Go to VPN Gateway purchase page, set Gateway Type to GM. For other parameter configurations, see Create a VPN gateway.

  2. Bind an SSL certificate:

    1. Log in to VPN Gateway console. In the top navigation bar, select the region of the VPN Gateway.

    2. Click the target VPN Gateway ID, select the Associate Certificate tab, click Bind SSL Certificate, and bind encryption certificate and signature certificate. If you hold an SSL certificate that supports both encryption and signing, we recommend binding the same SSL certificate for both the encryption certificate and the signature certificate.

      • Encryption certificate: Encrypts data to ensure the confidentiality and integrity of data.

      • Signature certificate: Signs and authenticates data to ensure the validity and non-repudiation of data.

API

  1. Call CreateVpnGateway to create a VPN Gateway.

  2. Call AssociateVpnGatewayWithCertificate to bind an SSL certificate.

Upgrade a VPN gateway (standard type only)

If a Standard VPN Gateway is not the latest version, we strongly recommend that you upgrade it for better features and compatibility.

Important

This refers only to a version upgrade, not a migration to Enhanced (the Enhanced type requires re-creation).

  • Upgrade check: On the VPN Gateway details page, you can determine whether the VPN Gateway is the latest version based on the status of the Upgrade button. A newly purchased VPN Gateway is the latest version by default.

  • Upgrade cost:

    • It takes about 10 minutes to upgrade a VPN Gateway.

      Important

      During the upgrade, the VPN Gateway cannot provide services and existing connections will be interrupted. We recommend performing the upgrade during a network maintenance window to avoid affecting business operations.

    • Upgrading a VPN Gateway does not incur fees.

  • Upgrade restrictions:

    • When the VPN Gateway has no IPsec connection, the configuration remains unchanged before and after the upgrade.

    • When the VPN Gateway has IPsec connections:

      • IKEv1 + multiple CIDR blocks: Change to IKEv2 or split the multiple CIDR blocks into multiple connections.

      • Gateways created before March 21, 2019 that have not been upgraded: After the upgrade, you need to manually Route configuration.

      • In other scenarios, the IPsec connection configuration remains unchanged before and after the upgrade.

Console

  1. Log in to VPN Gateway console. In the top navigation bar, select the region of the VPN Gateway.

  2. Click the target VPN Gateway ID to go to the details page, and click Upgrade.

Delete a VPN gateway

Enhanced VPN gateway (console)

In the Actions column of the target VPN Gateway, click Delete.

Before deletion, ensure that the VPN Gateway has no IPsec connection, SSL server, or IPsec server.

Standard VPN gateway (console)

  • A Standard VPN Gateway cannot be deleted. It will be automatically released after Expiration.

  • Before a Standard VPN Gateway expires, you can click Unsubscribe in the Actions column of the target VPN Gateway to apply for unsubscribe, and the system will automatically release the VPN Gateway instance.

    • For refund rules, see Partial Refund Policy for Unsubscriptions.

    • When a VPN Gateway is in a temporary upgrade state, unsubscribe is not supported. You need to wait until the upgrade is complete before applying for unsubscribe.

API

  • Enhanced VPN: Call DeleteEnhancedVpnGateway to delete it.

  • Standard VPN: Subscription-based gateways that have not expired can only be released through the console.

Quotas and limitations

Enhanced VPN gateway

  • For existing Standard VPN Gateways, direct migration to the Enhanced IPsec-VPN form is not supported. We recommend that you create a new one.

  • An Enhanced VPN Gateway does not support processing decrypted IP fragment packets.

  • When you add a route in an Enhanced VPN Gateway, the existing traffic requires 30 seconds to age out, after which the new route is used to guide forwarding. For route modifications and deletions, traffic forwarding takes effect immediately.

  • When the BGP route entries received by a single tunnel of an Enhanced VPN Gateway exceed 2000, the route learning function of the current tunnel will be interrupted.

  • For other quota restrictions, see Quotas and limits.

Standard VPN gateway

  • The maximum bandwidth specification supported by a Standard VPN Gateway varies by region.

    Category

    Region

    Up to 1000 Mbps

    China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Wuhan), China (Hong Kong), Singapore, Japan (Tokyo), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Thailand (Bangkok), South Korea (Seoul), Philippines (Manila), US (Silicon Valley), US (Virginia), Germany (Frankfurt), UK (London), Mexico, China (Hangzhou) Finance, China (Shanghai) Finance, China (Shenzhen) Finance, China (Beijing) Gov Cloud 1

    Up to 500 Mbps

    UAE (Dubai)

    In the The China (Beijing) Finance (invitational preview) region, VPN Gateway instances with up to 200 Mbps can be created.

  • For newly purchased VPN Gateway instances, IPsec connections use the dual-tunnel mode by default. Existing VPN Gateway instances only support creating IPsec-VPN connections in single-tunnel mode by default. We recommend that you upgrade to dual-tunnel mode as soon as possible for higher connection availability.

  • For Standard VPN Gateways with different IPsec-VPN tunnel modes and bandwidth specifications, the peak bandwidth in both directions between the on-premises data center and the Standard VPN Gateway is not exactly the same.

    IPsec-VPN tunnel mode

    Standard VPN Gateway bandwidth specification value

    Peak bandwidth in the outbound direction

    Peak bandwidth in the inbound direction

    Dual tunnel

    > 10 Mbps

    Standard VPN Gateway bandwidth specification value.

    Standard VPN Gateway bandwidth specification value.

    ≤ 10 Mbps

    Standard VPN Gateway bandwidth specification value.

    10 Mbps.

    Single tunnel

    > 100 Mbps

    Standard VPN Gateway bandwidth specification value.

    Standard VPN Gateway bandwidth specification value.

    ≤ 100 Mbps

    Standard VPN Gateway bandwidth specification value.

    100 Mbps.

  • For other quota restrictions, see Quotas and limits.

Previous：User GuideNext：Customer Gateway