Configure IPsec-VPN routes for traffic forwarding - VPN Gateway

After you attach an IPsec-VPN connection to a Transit Router (TR), you must configure routes for the connection to forward traffic from the TR to your on-premises data center.

Choose a routing method

An IPsec-VPN connection attached to a TR supports two routing methods: static routing and BGP dynamic routing. For a comparison of these methods, see Choose a routing method.

Recommendations:

We recommend that you use BGP. If you choose to use static routes, ensure that your on-premises gateway device supports static Equal-Cost Multi-Path (ECMP) routing.
We recommend that you use only one routing method for each IPsec-VPN connection. Do not use static routing and BGP simultaneously.
For a single IPsec-VPN connection, we recommend that you configure the same routing protocol for both tunnels. When you use BGP, both tunnels must have the same local ASN.

Route priority:

In the IPsec-VPN connection's route table, routes are matched based on the longest prefix match principle.
In the transit router route table, if multiple IPsec-VPN connections advertise both destination and BGP routes to the TR for the same destination CIDR block, BGP routes take precedence. For more information, see TR route priority.

Static route configuration

Important

When you use static routes, ensure that your on-premises gateway supports static ECMP routing. When an IPsec-VPN connection is attached to a TR, traffic from the cloud to your on-premises data center automatically uses ECMP links. If traffic from your on-premises data center to the cloud does not support ECMP, this can result in asymmetric routing paths.

End-to-end overview

When you use an IPsec-VPN connection attached to a TR to connect your VPCs to an on-premises data center with static routing, you must manage three route tables:

Traffic direction

Transit router route table

IPsec-VPN connection route table

On-premises data center route table

Outbound from the cloud

Enable route learning.

This allows the TR to automatically learn destination route entries from the IPsec-VPN connection.

When you create an IPsec-VPN connection, route learning is enabled by default if you keep Automatically Advertise System Routes to Default Route Table of Transit Router selected.

Manually add a route entry:

Set the destination CIDR block to the CIDR block of your on-premises data center and the next hop to the IPsec-VPN connection.

Ensure that a route to the internal network of your on-premises data center exists on your gateway device. If not, you must add one manually.

Inbound to the cloud

Create an associated forwarding relationship.
This allows the IPsec-VPN connection to forward traffic based on the transit router route table.
When you create an IPsec-VPN connection, this relationship is created by default if you keep Automatically Associate with Default Route Table of Transit Router selected.
Enable route synchronization.
The TR automatically advertises its route entries to the IPsec-VPN connection's route table.
When you create an IPsec-VPN connection, route synchronization is enabled by default if you keep Automatic Advertising selected.

No configuration is required.

The system forwards traffic to the TR by default.

Manually add two static ECMP routes: both with the destination CIDR block of the VPC, and each with a next hop pointing to one of the two tunnels of the IPsec-VPN connection.

Add or delete a static route

Console

Add a static route

Click the ID of the IPsec-VPN connection to open its details page.
On the Destination-based Route Table tab, click Add Route Entry:
- Destination CIDR Block: Enter the CIDR block of your on-premises data center.
- Next Hop: Select this IPsec-VPN connection.

Delete a static route

In the Actions column for the route entry, click Delete.

API

Call the CreateVcoRouteEntry operation to add a static route.
Call the DeleteVcoRouteEntry operation to delete a static route.

Limitations

Routes with a destination CIDR block of 0.0.0.0/0 are not supported.
Do not add routes that contain 100.64.0.0/10 (including its subnets and supernets). Otherwise, the IPsec connection status will become abnormal.
In dual-tunnel mode, destination routes are advertised to the transit router route table only when the tunnel status is Phase 2 Negotiation Succeeded.

BGP dynamic routing configuration

Border Gateway Protocol (BGP) dynamic routing establishes a BGP neighbor relationship between an IPsec connection and an on-premises data center to automatically learn and distribute routes.

End-to-end overview

When you use BGP and an IPsec-VPN connection bound to a Transit Router (TR) to connect a VPC to an on-premises data center, you must manage the following three route tables:

Traffic direction

Transit router route table

IPsec connection route table

On-premises data center route table

Outbound traffic

Enable route learning.

After it is enabled, the TR automatically learns the destination route entries from the IPsec connection.

When you create an IPsec connection, route learning is enabled by default because Automatically Advertise System Routes to Default Route Table of Transit Router is selected.

Enable BGP.

After it is enabled, cloud CIDR blocks are automatically advertised to the on-premises data center, and the CIDR blocks of the on-premises data center are automatically learned.

Enable BGP.

After it is enabled, local CIDR blocks are automatically advertised to the cloud, and the VPC CIDR blocks are automatically learned.

Inbound traffic

Create an associated forwarding relationship.
After it is created, traffic from the IPsec connection is forwarded based on the TR route table.
When you create an IPsec connection, an associated forwarding relationship is created by default because Automatically Associate with Default Route Table of Transit Router is selected.
Enable route synchronization.
After it is enabled, the TR automatically propagates entries from its route table to the IPsec connection route table.
When you create an IPsec connection, route synchronization is enabled by default because Automatic Advertising is selected.

BGP route advertisement principles

Inbound traffic: The on-premises data center advertises routes through BGP → The routes are propagated to the BGP route table of the IPsec connection → The routes are propagated to the TR route table through route learning.
Outbound traffic: Routes from the TR route table → The routes are propagated to the BGP route table of the IPsec connection through route synchronization → The routes are propagated to the on-premises data center through BGP.

Configuration steps

Console

Specify the ASN of the on-premises data center in the Customer Gateway
When you create a Customer Gateway, specify the autonomous system number (ASN) of the on-premises data center. If an existing Customer Gateway does not have an ASN specified, create a new one. For more information, see Customer Gateway.
Enable BGP in the IPsec connection
- When you create or modify an IPsec connection, configure Customer Gateway, Enable BGP, Local ASN, Tunnel CIDR Block, and Local BGP IP address. For parameter descriptions and instructions, see Enable or disable BGP (for connections bound to a TR).
- The local ASNs of the two tunnels must be the same. The peer BGP AS numbers should also be the same.
- For the IPsec connection's Route Mode, select Destination Route Mode.
Verify that the BGP routes have taken effect
- VPN Gateway BGP route table: On the details page of the VPN Gateway instance, go to the BGP Route Table tab to view the routes. The route source is marked as "CLOUD" (cloud routes) or "VPN_BGP" (routes learned through BGP).
- VPC system route table: In the VPC system route table, view the entries of the "Dynamic Route" type.

API

Specify the ASN of the on-premises data center in the Customer Gateway
Call CreateCustomerGateway to create a Customer Gateway and specify the ASN of the on-premises data center.
Enable BGP in the IPsec connection
- Call CreateVpnAttachment to create an IPsec connection.
- Call ModifyVpnAttachmentAttribute to modify the IPsec connection and tunnel configurations.
Verify that the BGP routes have taken effect
Call DescribeVcoRouteEntries to query BGP route entries.

Limits

Dual-tunnel mode: Each IPsec connection can receive up to 2,000 BGP routes (1,000 per tunnel). This limit cannot be changed.
Single-tunnel mode: Each IPsec connection can receive up to 50 BGP routes. To increase the limit to 200, submit a ticket.
A route with the destination CIDR block 0.0.0.0/0 can be propagated through BGP between a TR and an on-premises gateway device. This is different from the VPN Gateway scenario.
When you use an Express Connect circuit and an IPsec connection in active-standby mode to connect to a TR, the local ASN configured for the Virtual Border Router (VBR) and the IPsec connection must be the same.

Supported regions

BGP dynamic routing for IPsec connections (in scenarios where the connection is bound to a TR) is supported only in the following regions:

Area	Region
Asia Pacific	China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Shenzhen), China (Hong Kong), Japan (Tokyo), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta)
Europe and Americas	Germany (Frankfurt), UK (London), US (Virginia), US (Silicon Valley)
Middle East	UAE (Dubai)

Note

Some regions have been upgraded to support the BGP dynamic routing protocol. Single-tunnel mode IPsec-VPN connections created before the upgrade do not support BGP. New IPsec-VPN connections created after the upgrade are in dual-tunnel mode by default and automatically support BGP. If you need to use BGP, create a new IPsec-VPN connection.