VPN Gateway supports the dynamic routing feature of Border Gateway Protocol (BGP). You can use a VPN gateway to connect a data center to Alibaba Cloud. Then, you can enable BGP dynamic routing for the VPN gateway to automatically learn routes. This reduces the costs of network maintenance and avoids network configuration errors.
Overview
BGP is a dynamic routing protocol based on Transmission Control Protocol (TCP). BGP is used to exchange routing and network accessibility information across autonomous systems (AS).
BGP dynamic routing is developed from the IPsec-VPN feature. BGP dynamic routing integrates the route learning and route advertisement features of Cloud Enterprise Network (CEN). You can establish a connection between Alibaba Cloud and your data center in a more efficient, flexible, and reliable manner with BGP dynamic routing.
- Automatically advertises dynamic routes to the cloud and data centers, and handles route conflicts.
- Enables static routing and dynamic routing. These routing methods allows you to route network traffic from specified egresses.
- Establishes multiple tunnel connections between a VPN gateway and a data center. Supports equal-cost multi-path routing (ECMP) to achieve disaster recovery.
- Make sure that the same autonomous system number (ASN) of the data center is specified on the virtual border router (VBR) and the VPN gateway. This condition must be met when you connect the data center to a virtual private cloud (VPC) by using leased lines and VPN gateways for connection resilience. This avoids route flapping in the data center.
- If multiple VPCs are associated with the same CEN instance, make sure that the VPN gateways associated with the VPCs are not connected to the data centers through BGP. This avoids route flapping in the CEN.
- If you use the same VPN gateway to establish VPN connections with more than one data center, you must not advertise routes of different VPN connections to each other.
- If multiple VPN gateways are created in a VPC, you must not advertise routes of different VPN gateways to each other.
How dynamic routes are advertised
- To Alibaba Cloud
The customer VPN gateway automatically learns BGP routes that are destined for the CIDR block of the data center and advertises the routes to the VPN gateway in the cloud. If you enable automatic BGP advertisement for the VPN gateway on Alibaba Cloud, the VPN gateway uses BGP to learn routes and automatically advertises the routes to the default route table of the VPC. No BGP route is advertised to the custom route tables.
- To the data center
The VPN gateway on Alibaba Cloud automatically learns BGP routes from the default route table of the VPC, and then advertises the routes to the customer VPN gateway.
Routing priorities
Route type | Priority of routes on a VPN gateway | Priority of routes within a VPC |
---|---|---|
Specific routes | P0 | P0 |
Default routes | P1 | P1 |
Static routing | P2 | P2 |
Dynamic routing | P3 | P3 |
Limits
Each VPN gateway can hold a BGP route table that contains at most 50 route entries. To increase the quota,submit a ticket.
Use BGP dynamic routing
For more information, see Establish a connection between a VPC network and an on-premises data center with BGP dynamic routing.