Cloud Enterprise Network:Connect a third-party SD-WAN to a transit router

Example scenario

This topic uses the scenario shown in the following figure. A company has two data centers, IDC1 and IDC2, in Shanghai. On Alibaba Cloud, the company uses service VPC1 in the China (Shanghai) region and service VPC2 in the China (Hangzhou) region. The company wants to connect IDC1, IDC2, service VPC1, and service VPC2 through a third-party SD-WAN appliance, which allows configuring access control policies to secure data center access to Alibaba Cloud. The company also wants to automate route advertisement and learning between Alibaba Cloud and the data centers to reduce route maintenance.

To implement this solution, connect the third-party SD-WAN appliance to a transit router through a VPN connection. This connects the data centers and the VPCs. Then, configure BGP on the transit router, the third-party SD-WAN appliance, IDC1, and IDC2 to automate route advertisement and learning.

Network planning

Network function planning

• Create an Elastic Compute Service (ECS) instance in a dedicated VPC, referred to as the security VPC in this topic. Deploy a third-party SD-WAN appliance by installing a third-party image on the ECS instance.

  For this example, the third-party SD-WAN appliance is an ECS instance in the security VPC running a FortiGate V6.2.4 image.

• The third-party SD-WAN appliance can connect directly to the transit router through a VPN connection. The VPN connection must be the Private gateway type.

• Use Border Gateway Protocol (BGP) between the third-party SD-WAN appliance and the transit router to automatically propagate and learn routes.

• The third-party SD-WAN appliance establishes IPsec-VPN connections with on-premises IDC1 and on-premises IDC2 to connect them to Alibaba Cloud.

  The third-party SD-WAN appliance establishes a full-mesh IPsec-VPN connection with on-premises IDC1 and on-premises IDC2 using Auto Discovery VPN (ADVPN). For more information about ADVPN, see the Fortinet documentation.

• The third-party SD-WAN appliance uses BGP with on-premises gateway device 1 and on-premises gateway device 2 to establish iBGP peer relationships to automatically advertise and learn routes.

  In this topic, both on-premises gateway device 1 and on-premises gateway device 2 are Fortinet devices with the FortiGate V6.2.4 image installed.

CIDR block planning

Prerequisites

Configuration flow

Step 1: Create transit router instances

To connect your on-premises IDCs and VPCs through CEN, create transit router instances in the China (Shanghai) and China (Hangzhou) regions. Assign a transit router CIDR block to the China (Shanghai) instance for creating VPC and VPN connections.

1. Log on to the CEN console.

2. On the CEN Instance page, select the CEN instance that you created in the Prerequisites section and click the CEN instance ID.

3. On the Basic Settings > Transit Router tab, click Create Transit Router.

4. In the Create Transit Router dialog box, configure the transit router instance and click OK.

   The following table describes only the parameters relevant to this topic. For all other parameters, use the default values. For more information, see Transit router CIDR blocks.

   Parameter	Description	China (Shanghai)	China (Hangzhou)
   Region	The region where the transit router instance is deployed.	Select China (Shanghai).	Select China (Hangzhou).
   Edition	The edition of the transit router instance.	The system automatically detects and displays the edition available in the selected region.
   Enable Multicast	Specifies whether to enable multicast for the transit router instance.	Retain the default value, which is to disable multicast.
   Name	The name of the transit router instance.	Enter TR-shanghai.	Enter TR-hangzhou.
   Transit Router CIDR	A custom CIDR block for the transit router. A transit router CIDR block is similar to the IP address range for a router's loopback interface. The transit router assigns IP addresses from this CIDR block for IPsec connections. For more information, see Transit router CIDR blocks.	Enter 10.10.10.0/24.	Leave the transit router CIDR block empty.

Step 2: Create VPC connections

Connect Service VPC1, the security VPC, and Service VPC2 to their respective transit router instances to enable communication between the on-premises IDCs and the VPCs.

1. On the CEN Instance page, select the CEN instance that you created in the Prerequisites section and click the CEN instance ID.

2. On the Basic Settings > Transit Router tab, find the transit router instance that you created in Step 1. In the Actions column, click Create Connection > Create Intra-Region Connection.

3. On the Create Intra-Region Connection page, set the following parameters and click OK.

   The following table describes only the parameters relevant to this tutorial. For all other parameters, retain the default values. For more information, see Create a VPC connection.

   Parameter	Description	Service VPC1	Security VPC	Service VPC2
   Instance Type	The type of the network instance.	In this example, select VPC.	In this example, select VPC.	In this example, select VPC.
   Region	The region where the network instance is located.	In this example, select China (Shanghai).	In this example, select China (Shanghai).	In this example, select China (Hangzhou).
   Transit Router	The system automatically displays the ID of the transit router instance created in the current region.
   Account	Indicates if the network instance belongs to your Alibaba Cloud account.	In this example, select Your Account.	In this example, select Your Account.	In this example, select Your Account.
   Billing Method	The billing method of the VPC connection. The default value is Pay-As-You-Go. For more information about the billing of transit routers, see Billing.
   Connection Name	Enter a name for the VPC connection.	In this example, enter Service-VPC1-Connection.	In this example, enter Security-VPC-Connection.	In this example, enter Service-VPC2-Connection.
   Networks	Select a network instance.	In this example, select Service VPC1.	In this example, select the security VPC.	In this example, select Service VPC2.
   vSwitch	Select vSwitches in zones supported by the transit router. For single-zone regions, select one vSwitch. For multi-zone regions, select at least two vSwitches in different zones. To reduce latency, select one vSwitch per zone. Make sure that each selected vSwitch has an idle IP address. If the VPC does not have a vSwitch in the zones supported by the transit router, or if the vSwitches do not have idle IP addresses, you must create a vSwitch. For more information, see Create and manage vSwitches.	In this example, select vSwitch 1 in Shanghai Zone F and vSwitch 2 in Shanghai Zone G.	In this example, select vSwitch 1 in Shanghai Zone F and vSwitch 2 in Shanghai Zone G.	In this example, select vSwitch 1 in Hangzhou Zone I and vSwitch 2 in Hangzhou Zone H.
   Advanced Settings	Select the advanced features to enable.	In this example, retain the default settings, which enable all advanced features.	In this example, retain the default settings, which enable all advanced features.	In this example, retain the default settings, which enable all advanced features.

Step 3: Create an inter-region connection

After Service VPC1 and the security VPC are connected to a transit router in the same region, they can communicate. However, they cannot communicate with Service VPC2 because its transit router is in a different region. To enable cross-region communication, create an inter-region connection between the transit routers in the China (Hangzhou) and China (Shanghai) regions.

1. On the CEN Instance page, find your Cloud Enterprise Network (CEN) instance and click its instance ID.

2. On the Basic Settings > Bandwidth Plans tab, click Set Inter-region Bandwidth.

3. On the Create Inter-Region Connection page, set the following parameters to configure the inter-region connection, and then click OK.

   Leave the other parameters at their default settings. For more information, see Create an inter-region connection.

   Parameter	Description
   Local Region	Select the local region for the connection. This tutorial uses China (Hangzhou).
   Local Transit Router	The system automatically displays the ID of the transit router in the current region.
   Name	Enter a name for the inter-region connection. This tutorial uses Inter-region Connection.
   Peer Region	Select the peer region for the connection. This tutorial uses China (Shanghai).
   Peer Transit Router	The system automatically displays the ID of the transit router in the peer region.
   Bandwidth Allocation Mode	An inter-region connection supports the following bandwidth allocation methods: Allocate from Bandwidth Plan: Allocates bandwidth from a purchased bandwidth plan. Pay-By-Data-Transfer: Bills you for the actual traffic transferred over the connection. This tutorial uses Pay-By-Data-Transfer.
   Bandwidth	Enter the peak bandwidth for the inter-region connection. Unit: Mbps.
   Default Line Type	Use the default link type.
   Advanced Settings	Keep the default settings. All advanced options are enabled by default.

Step 4: Create a VPN connection

After you complete the preceding configurations, Service VPC1, Service VPC2, and the security VPC can communicate with each other. However, the transit router and the security VPC cannot learn routes from the on-premises data center. You must establish a VPN connection between the third-party SD-WAN appliance and the transit router. This allows the third-party SD-WAN appliance to learn routes from the on-premises data center and advertise them to the transit router over the VPN connection.

1. Log on to the VPN Gateway console.

2. Create a customer gateway.

   Before establishing a VPN connection to the transit router, create a customer gateway to register the third-party SD-WAN appliance information with Alibaba Cloud.

   1. In the navigation pane on the left, choose Interconnections > VPN > Customer Gateways.

   2. In the top navigation bar, select the region of the customer gateway.

      Select the region of the VPC that contains the third-party SD-WAN appliance. In this example, China (Shanghai) is selected.

   3. On the Customer Gateway page, click Create Customer Gateway.

   4. In the Create Customer Gateway panel, set the following parameters and click OK.

      This section describes only the required parameters. For all other parameters, use the default values. For more information, see customer gateway.

      Parameter	Description	Example value
      Name	Enter a name for the customer gateway.	Enter Customer-Gateway.
      IP Address	Enter the IP address of the third-party SD-WAN appliance used for the VPN connection.	Enter the private IP address of the third-party SD-WAN appliance: 172.16.0.15.
      ASN	Enter the BGP ASN of the third-party SD-WAN appliance.	Enter 65534.

3. Create an IPsec connection.

   After creating the customer gateway, create an IPsec connection in Alibaba Cloud. The transit router uses this connection to establish a VPN connection with the third-party SD-WAN appliance.

   1. In the navigation pane on the left, go to Interconnections > VPN > IPsec Connections.

   2. In the top navigation bar, select the region for the IPsec connection.

      The region of the IPsec connection must be the same as the region of the customer gateway. In this example, China (Shanghai) is selected.

   3. On the IPsec Connections page, click Bind CEN.

   4. On the Create IPsec Connection (CEN) page, set the parameters as described in the following table, and then click OK.

      Creating an IPsec connection incurs fees. For more information about , see the billing documentation.

      Parameter	Description	Example value
      Name	Enter a name for the IPsec connection.	Enter IPsec-Connection.
      Region	Select the region that contains the transit router you want to bind. After the IPsec connection is created, it is in the same region as the transit router.	Select China (Shanghai).
      Gateway Type	Select the network type for the IPsec connection.	Select Private. The security VPC is already attached to the transit router. The third-party SD-WAN appliance can establish a VPN connection with the transit router over a private network.
      Bind CEN Instance	Select the account that owns the transit router to which you want to bind the IPsec connection.	Select Same Account.
      CEN ID	Select a CEN instance.	Select the CEN instance that you created in the Prerequisites section.
      Routing Mode	Select a routing mode.	Select Destination Routing.
      Apply Immediately	Specifies whether the configuration takes effect immediately. Valid values: Yes: Negotiation starts immediately after the configuration is complete. No: Negotiation starts when traffic is detected.	Select Yes.
      Customer Gateway	Select the customer gateway to associate with the IPsec connection.	Select Customer-Gateway.
      Pre-shared Key	Enter a key for authentication between the on-premises gateway device and the IPsec connection. The key can be 1 to 100 characters in length and can contain digits, letters, and the following special characters: ~`!@#$%^&*()_-+={}[]\|;:',.<>/?. The key cannot contain spaces. If you do not specify a pre-shared key, the system generates a random 16-character string. After you create the IPsec connection, you can click Edit on the tunnel to view the key. For more information, see Modify tunnel configurations. Important The pre-shared key of the IPsec-VPN connection must be the same as the pre-shared key of the peer gateway device. Otherwise, the IPsec-VPN connection cannot be established.	Enter fddsFF123****.
      Enable BGP	Specifies whether to enable BGP. By default, BGP is disabled.	Enabled
      Local ASN	The ASN of the IPsec connection. The default value is 45104. The valid values are 1 to 4294967295.	Enter 65531.
      Encryption Settings	Add encryption settings, such as the IKE configuration and IPsec configuration.	Use the default values for all parameters except for the following: For the IKE Settings, set Encryption Algorithm to DES. For the IPsec Settings, set Encryption Algorithm to DES. Note Select encryption parameters that are supported by your on-premises gateway device. Make sure that the IPsec connection and the on-premises gateway device use the same encryption settings.
      BGP Settings
      Tunnel CIDR Block	The CIDR block used to establish the encrypted tunnel. The CIDR block must be a /30 subnet within the 169.254.0.0/16 range. The tunnel CIDR block must be a /30 subnet within 169.254.0.0/16. It cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, 169.254.6.0/30, or 169.254.169.252/30.	Enter 169.254.20.0/30.
      Local BGP IP address	The BGP IP address of the IPsec connection. This address must be an IP address within the tunnel CIDR block.	Enter 169.254.20.1.
      Advanced Settings	Specifies whether to enable advanced features for the IPsec connection.	Use the default setting, which enables all advanced features.

      After the IPsec connection is created, the system automatically assigns a gateway IP address to it. This IP address is used to establish the VPN connection with the third-party SD-WAN appliance. You can view the gateway IP address on the details page of the IPsec connection, as shown in the following figure.

      Note

      • The system assigns a gateway IP address to an IPsec connection only after the connection is bound to a transit router instance. If you set Associate Resource to Do Not Associate or VPN Gateway when you create the ipsec connection, no gateway IP address is assigned.

      • After a private IPsec connection is bound to a transit router instance, the system automatically advertises the gateway IP address of the IPsec connection to the route table of the transit router.

4. Download the peer configuration for the IPsec connection.

   Return to the IPsec-VPN Connection page. Find the IPsec connection that you just created and click Generate Peer Configuration in the Actions column.

5. Add VPN and BGP configurations on the third-party SD-WAN appliance.

   After creating the IPsec connection, use the downloaded peer configuration to add VPN and BGP configurations on the third-party SD-WAN appliance. This establishes a VPN connection to the transit router.

   Note

   This topic uses a FortiGate firewall (software version V6.2.4) as an example. Configuration commands may vary based on the software version. For specific commands, refer to the documentation for your device or contact the vendor. For more configuration examples for on-premises gateway devices, see On-premises gateway device configuration examples.

   The following content contains information about third-party products and is for reference only. Alibaba Cloud makes no representations or warranties, express or implied, about the performance or reliability of third-party products. Alibaba Cloud is not liable for any issues that may arise from using these products.

   1. Log on to the command-line interface (CLI) of the third-party SD-WAN appliance.

   2. Add the phase 1 configuration (IKE configuration) for the IPsec VPN.

      # Add the phase 1 IPsec VPN configuration for tunnel 1.
      config vpn ipsec phase1-interface
       edit "to_aliyun_test1"
       set interface "port1"             # Use "port1" to establish a vpn connection with the transit router.
       set ike-version 2
       set peertype any
       set net-device disable
       set proposal des-sha1             # Configure the phase 1 encryption and authentication algorithms to match the IKE configuration of the ipsec connection.
       set localid-type address          # Specify the localid format as an IP address to match the RemoteId format of the Alibaba Cloud ipsec connection.
       set dhgrp 2                       # Configure the phase 1 DH group to match the IKE configuration of the ipsec connection.
       set remote-gw 192.168.168.1       # Specify the peer IP address. This is the gateway IP address of the ipsec connection.
       set psksecret fddsFF123****       # Specify the pre-shared key for the tunnel. This must match the key configured for the Alibaba Cloud ipsec connection.
       next
      end

   3. Add the phase 2 configuration (IPsec configuration) for the IPsec VPN.

      # Add the phase 2 IPsec VPN configuration for the tunnel.
      config vpn ipsec phase2-interface
          edit "to_aliyun_test1"
              set phase1name "to_aliyun_test1"    # Associate this with the phase1-interface of the tunnel.
              set proposal des-sha1               # Configure the phase 2 encryption and authentication algorithms to match the IPsec configuration of the ipsec connection.
              set dhgrp 2                         # Configure the phase 2 DH group to match the IPsec configuration of the ipsec connection.
              set auto-negotiate enable           
              set keylifeseconds 86400            # Configure the Security Association (SA) lifetime.
          next
      end

   4. Configure the BGP IP address for the tunnel interface.

      config system interface
          edit "to_aliyun_test1"
              set ip 169.254.20.2 255.255.255.255          # Configure the BGP IP address for the tunnel interface.
              set type tunnel                              # Specify the interface type as tunnel.
              set remote-ip 169.254.20.1 255.255.255.255   # Specify the BGP IP address of the tunnel peer.
              set interface "port1"                        # Associate the tunnel with the physical interface "port1".
          next
      end

   5. Configure firewall policies.

      config firewall policy
          edit 1
              set name "forti_to_aliyun1"       # Configure a security policy for traffic from the third-party SD-WAN appliance to Alibaba Cloud.
              set srcintf "port1"               # The source interface is "port1".
              set dstintf "to_aliyun_test1"     # The destination interface is the vpn connection tunnel interface.
              set srcaddr "all"                 # Match traffic from all source CIDR blocks.
              set dstaddr "all"                 # Match traffic to all destination CIDR blocks.
              set action accept                 # Allow traffic to pass.
              set schedule "always"
              set service "ALL"
          next
          edit 2
              set name "aliyun_to_forti1"       # Configure a security policy for traffic from Alibaba Cloud to the third-party SD-WAN appliance.
              set srcintf "to_aliyun_test1"     # The source interface is the vpn connection tunnel interface.
              set dstintf "port1"               # The destination interface is "port1".
              set srcaddr "all"                 # Match traffic from all source CIDR blocks.
              set dstaddr "all"                 # Match traffic to all destination CIDR blocks.
              set action accept                 # Allow traffic to pass.
              set schedule "always"
              set service "ALL"
          next
      end

   6. Configure BGP dynamic routing.

      config router bgp
          set as 65534
          set router-id 172.16.0.15
          config neighbor
              edit "169.254.20.1"                       # Specify the BGP neighbor at the other end of the tunnel.
                  set remote-as 65531
              next
          end
          config network
              edit 1
                  set prefix 172.16.0.0 255.255.0.0    # Advertise the CIDR block of the security VPC that needs to communicate with other networks.
              next
          end
      end

Step 5: Configure the on-premises gateway devices

Configure VPN and BGP on on-premises gateway device 1, on-premises gateway device 2, and the third-party SD-WAN device. This establishes IPsec-VPN connections among the devices and enables communication between the on-premises IDCs and the Alibaba Cloud VPCs.

Step 6: Test connectivity

The preceding configurations enable communication between the on-premises IDCs and VPCs. Test the network connectivity between sites as follows.

1. Test connectivity from on-premises IDC1 to service VPC1, service VPC2, and on-premises IDC2.

   1. Log on to the CLI of a client in on-premises IDC1.

   2. Run the ping command on the client to ping ECS1 in service VPC1, ECS1 in service VPC2, and the client in on-premises IDC2.

      As shown in the figure above, if the client in on-premises IDC1 receives a response, this confirms that on-premises IDC1 can reach resources in service VPC1, service VPC2, and on-premises IDC2.

2. Test connectivity from on-premises IDC2 to service VPC1, service VPC2, and on-premises IDC1.

   1. Log on to the CLI of a client in on-premises IDC2.

   2. Run the ping command on the client to ping ECS1 in service VPC1, ECS1 in service VPC2, and the client in on-premises IDC1.

      As shown in the figure above, if the client in on-premises IDC2 receives a response, this confirms that on-premises IDC2 can reach resources in service VPC1, service VPC2, and on-premises IDC1.

3. Test connectivity from service VPC1 to on-premises IDC1 and on-premises IDC2.

   1. Log on to the ECS1 instance in service VPC1. For more information, see ECS remote connection guide.

   2. On the ECS1 instance, run the ping command to ping the clients in on-premises IDC1 and on-premises IDC2.

      ping <IP address of the on-premises IDC client>

      

      As shown in the figure above, if the ECS1 instance receives a response, this confirms that service VPC1 can reach resources in on-premises IDC1 and on-premises IDC2.

4. Test connectivity from service VPC2 to on-premises IDC1 and on-premises IDC2.

   1. Log on to the ECS1 instance in service VPC2. For more information, see ECS remote connection guide.

   2. On the ECS1 instance, run the ping command to ping the clients in on-premises IDC1 and on-premises IDC2.

      ping <IP address of the on-premises IDC client>

      

      As shown in the figure above, if the ECS1 instance receives a response, this confirms that service VPC2 can reach resources in on-premises IDC1 and on-premises IDC2.

5. Test connectivity between service VPC1 and service VPC2.

   1. Log on to the ECS1 instance in service VPC1. For more information, see ECS remote connection guide.

   2. On the ECS1 instance, run the ping command to ping the ECS1 instance in service VPC2.

      ping <IP address of the ECS instance>

      

      As shown in the figure above, if the ECS1 instance in service VPC1 receives a response, this confirms that service VPC1 can reach resources in service VPC2.

   3. Log on to the ECS1 instance in service VPC2. For more information, see ECS remote connection guide.

   4. On the ECS1 instance, run the ping command to ping the ECS1 instance in service VPC1.

      ping <IP address of the ECS instance>

      

      As shown in the figure above, if the ECS1 instance in service VPC2 receives a response, this confirms that service VPC2 can reach resources in service VPC1.