This topic walks you through setting up three IPsec-VPN connections over the Internet between an on-premises data center and a virtual private cloud (VPC). Attached to a Cloud Enterprise Network (CEN) transit router, these connections automatically form an Equal-Cost Multipath Routing (ECMP) group that load-balances traffic between the data center and the VPC.
Scenario example
This topic uses the scenario shown in the preceding figure as an example. An enterprise has a data center in Hangzhou, China, and a VPC instance in the China (Shanghai) region of Alibaba Cloud. The enterprise has deployed related workloads in the VPC instance by using Elastic Compute Service (ECS). The enterprise wants the data center to connect to the cloud over encrypted connections through the VPN Gateway service, so that the data center can communicate with the VPC instance. In addition, the enterprise wants the data center and the VPC instance to communicate with each other over multiple encrypted tunnels, which form ECMP links to implement load balancing of traffic.
The enterprise can establish multiple IPsec-VPN connections between the data center and Alibaba Cloud to connect the data center to the cloud over encrypted connections. Then, the enterprise can use the Cloud Enterprise Network service to connect the multiple IPsec-VPN connections with the VPC instance. After the multiple IPsec-VPN connections are added to the Cloud Enterprise Network, they can automatically form ECMP links to implement communication between the data center and the VPC instance and load balancing of traffic.
Network planning
Network feature planning
The network features used in the scenario in this topic are as follows:
Establish an IPsec-VPN connection between the data center and Alibaba Cloud over the Internet. That is, the Gateway Type of the IPsec connection is Public.
The resource type bound to the IPsec connection must be CEN so that the multiple IPsec-VPN connections can form ECMP links.
The BGP dynamic routing protocol is used between the IPsec connection and the data center.
CIDR block planning
When you plan CIDR blocks, make sure that the CIDR blocks that need to communicate between the data center and the VPC do not overlap.
Resource | CIDR block and IP address |
VPC | Primary CIDR block: 10.0.0.0/16
|
IPsec connection | BGP configuration:
|
On-premises gateway device | Public IP address of the on-premises gateway device:
|
BGP configuration of on-premises gateway devices:
| |
Data center | CIDR blocks to be connected to the VPC:
|
Prerequisites
Before you begin, make sure that you have completed the following operations:
You have created a VPC instance in the China (Shanghai) region and deployed business on ECS instances. For more information, see Create a VPC with an IPv4 CIDR block.
A CEN instance with an Enterprise Edition transit router in both the China (Hangzhou) and China (Shanghai) regions. For more information, see Create a CEN instance and Create a transit router.
ImportantWhen you create a transit router, you must configure a CIDR block for the transit router. Otherwise, IPsec connections cannot be associated with the transit router.
If you have created a transit router, you can configure a CIDR block for the transit router. For more information, see Transit router CIDR blocks.
You have learned about the security group rules applied to the ECS instances in the VPC and ensured that the security group rules allow the data center and ECS instances to communicate with each other. For more information, see View security group rules and Add a security group rule.
Configuration overview
Step 1: Create customer gateways
Before you establish an IPsec-VPN connection, you must create a customer gateway to register the information about your on-premises gateway device with Alibaba Cloud.
Log on to the VPN Gateway console.
In the navigation pane on the left, choose .
In the top navigation bar, select the region of the customer gateway.
When you select the region to which the customer gateway belongs, follow the nearest principle, which means selecting the Alibaba Cloud region that is closest to your data center. In this topic, China (Hangzhou) is selected.
On the Customer Gateway page, click Create Customer Gateway.
On the Create Customer Gateway panel, configure the parameters based on the following information, and then click OK.
Create three customer gateways in the China (Hangzhou) region based on the following configurations, and keep the default settings for the other configuration items. For more information, see Customer Gateway.
Configuration item
Description
Customer gateway 1
Customer gateway 2
Customer gateway 3
Name
Enter a name for the customer gateway.
In this example, Customer-Gateway1 is entered.
In this example, Customer-Gateway2 is entered.
In this example, Customer-Gateway3 is entered.
IP Address
Enter the public IP address of the on-premises gateway device on the Alibaba Cloud side to be connected.
In this example, the public IP address 11.XX.XX.1 of on-premises gateway device 1 is entered.
In this example, the public IP address 11.XX.XX.2 of on-premises gateway device 2 is entered.
In this example, the public IP address 11.XX.XX.3 of on-premises gateway device 3 is entered.
ASN
Enter the BGP ASN used by the on-premises gateway device.
In this example, 65530 is entered.
Step 2: Create IPsec-VPN connections
After you create the customer gateway, you need to create an IPsec connection on the Alibaba Cloud side to establish an IPsec-VPN connection between the data center and Alibaba Cloud.
Go to the VPN console IPsec Connections page, click Bind CEN, and complete the following configurations:
Based on the following configuration information, create three IPsec connections in the China (Hangzhou) region, and keep the default settings for the remaining configuration items. For more information, see Manage single-tunnel mode IPsec-VPN connections.
Configuration item
Description
IPsec connection 1
IPsec connection 2
IPsec connection 3
Name
Enter a name for the IPsec connection.
In this example, IPsec connection 1 is entered.
In this example, IPsec connection 2 is entered.
In this example, IPsec connection 3 is entered.
Region
Select the region where the transit router is deployed.
The ipsec-vpn connection is created in the same region as the transit router.
Select China (Hangzhou).
Gateway Type
Select the network type of the IPsec connection.
In this example, Public is selected.
Bind CEN
Select the account to which the transit router that you want to associate with the IPsec connection belongs.
Select Same Account.
CEN Instance ID
Select a Cloud Enterprise Network instance.
In this example, the Cloud Enterprise Network instance that you created in the prerequisites is selected.
The console displays the ID and CIDR block of the transit router that is created for the CEN instance in the current region. The ipsec-vpn connection will be attached to this transit router.
Zone
Select a zone in which you want to deploy the IPsec connection from the zones supported by the transit router.
In this example, Hangzhou Zone H is selected.
Routing Mode
Select a routing mode.
In this example, Destination Routing Mode is selected.
NoteIf you use the BGP dynamic routing protocol, we recommend that you use Destination Routing Mode.
Effective Immediately
Specify whether the configuration of the IPsec connection takes effect immediately. Valid values:
Yes. Start negotiations after the configuration is completed.
No. Start negotiations when inbound traffic is detected.
In this example, Yes is selected.
Customer Gateway
Select the customer gateway associated with the IPsec connection.
In this example, Customer-Gateway1 is selected.
In this example, Customer-Gateway2 is selected.
In this example, Customer-Gateway3 is selected.
Pre-Shared Key
Enter the authentication key of the IPsec connection, which is used for identity authentication between the on-premises gateway device and the IPsec connection.
The key must be 1 to 100 characters in length and can contain digits, uppercase and lowercase letters, and the following characters
~`!@#$%^&*()_-+={}[]\|;:',.<>/?. It cannot contain spaces.If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. After you create the IPsec connection, you can view the pre-shared key generated by the system by clicking the Edit button of the tunnel.
ImportantThe pre-shared key of the IPsec-VPN connection must be the same as the pre-shared key of the peer gateway device. Otherwise, the IPsec-VPN connection cannot be established.
In this example, fddsFF123**** is entered.
In this example, fddsFF456**** is entered.
In this example, enter fddsFF789****.
Enable BGP
Select whether to enable the BGP feature. The BGP feature is disabled by default.
In this example, the BGP feature is enabled.
Local ASN
Enter the ASN of the IPsec connection.
In this example, enter 65531.
In this example, enter 65531.
In this example, enter 65531.
Encryption Configuration
Add encryption configurations such as IKE configurations and IPsec configurations.
All configuration items retain their default values except for the following parameters.
Select group14 for DH Group (Perfect Forward Secrecy) of IKE Configurations.
Select group14 for DH Group (Perfect Forward Secrecy) of IPsec Settings.
NoteYou need to select encryption parameters based on the on-premises gateway device to ensure that the encryption configurations for the IPsec connection are the same as those for the on-premises gateway device.
BGP Configuration
Tunnel CIDR Block
Enter the CIDR block used to establish the encrypted tunnel.
The tunnel CIDR block must be a /30 subnet within 169.254.0.0/16. It cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, 169.254.6.0/30, or 169.254.169.252/30.
In this example, enter 169.254.10.0/30.
In this example, enter 169.254.11.0/30.
In this example, enter 169.254.12.0/30.
Local BGP IP address
Enter the BGP IP address of the IPsec connection.
This address is an IP address within the tunnel CIDR block.
In this example, enter 169.254.10.1.
In this example, enter 169.254.11.1.
In this example, enter 169.254.12.1.
Advanced Configuration
Specify whether to enable advanced settings to implement automatic advertisement and learning of IPsec connection routes. Advanced settings are enabled by default.
In this example, the default values are retained, which means all advanced settings are enabled.
After the IPsec connection is created, the system automatically assigns a gateway IP address to each IPsec connection, which is used to establish an IPsec-VPN connection between the IPsec connection and the on-premises gateway device. You can view the gateway IP address on the IPsec connection details page.
In this example, the gateway IP addresses assigned by the system to IPsec connection 1, IPsec connection 2, and IPsec connection 3 are shown in the following table.
IPsec connection
Gateway IP address
IPsec connection 1
120.XX.XX.191
IPsec connection 2
47.XX.XX.213
IPsec connection 3
47.XX.XX.161
NoteThe system assigns a gateway IP address to an IPsec connection only after the IPsec connection is associated with a transit router instance.
Return to the IPsec-VPN connection page, find the IPsec connection that you just created, and select Generate Peer Configuration in the Actions column.
Download the configurations of the three IPsec connections separately and save them to your local computer for subsequent use when adding VPN configurations to the on-premises gateway devices.
Step 3: Configure on-premises gateway devices
After you create the IPsec connections, add VPN configurations and BGP configurations to on-premises gateway device 1, on-premises gateway device 2, and on-premises gateway device 3 based on the downloaded IPsec connection configurations and the following steps, so that IPsec-VPN connections can be established between the data center and Alibaba Cloud.
In this example, the software Adaptive Security Appliance (ASA) 9.19.1 is used to describe how to configure a Cisco firewall. The commands may vary with software versions. Consult the documentation or your vendor based on your actual environment during operations. For more information, see Configure local gateways.
The following content contains third-party product information, which is only for reference. Alibaba Cloud does not make guarantees or other forms of commitments for the performance and reliability of third-party products, or the potential impacts of operations performed by using these products.
Configure the on-premises gateway devices.
Configuration example for on-premises gateway device 1
Log on to the CLI of the Cisco firewall and enter the configuration mode.
ciscoasa> enable Password: ******** # Enter the password for entering the enable mode. ciscoasa# configure terminal # Enter the configuration mode. ciscoasa(config)#View the interface configuration.
Make sure that the Cisco firewall has completed the interface configuration and enabled the interface. The following is an interface configuration example used in this topic.
# View the interface configuration of on-premises gateway device 1. ciscoasa(config)# show running-config interface ! interface GigabitEthernet0/0 # Internet-facing interface. nameif outside1 security-level 0 ip address 11.XX.XX.1 255.255.255.255 # Public IP address. ! interface GigabitEthernet0/1 # Data center-facing interface. nameif private security-level 100 ip address 192.168.50.216 255.255.255.0 !Enable IKEv2 for the public-facing interface.
crypto ikev2 enable outside1 crypto ikev2 enable outside1 #Enable IKEv2 for the outside1 interface (public-facing interface) of on-premises gateway device 1.Create an IKEv2 policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.
#Add the following configuration to on-premises gateway device 1 crypto ikev2 policy 10 encryption aes #Specify the encryption algorithm. integrity sha #Specify the authentication algorithm. group 14 #Specify the DH group. prf sha #The prf setting must be consistent with the integrity setting. On the Alibaba Cloud side, prf is consistent with the authentication algorithm by default. lifetime seconds 86400 #Specify the SA lifetime.Create an IPsec proposal and profile, and specify the IPsec phase encryption algorithm, authentication algorithm, DH group, and SA lifetime on the Cisco firewall side. These must be consistent with the Alibaba Cloud side.
#Add the following configuration on on-premises gateway device 1 crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL #Create an ipsec proposal. protocol esp encryption aes #Specify the encryption algorithm. The protocol uses ESP. The Alibaba Cloud side always uses the ESP protocol. protocol esp integrity sha-1 #Specify the authentication algorithm. The protocol uses ESP. The Alibaba Cloud side always uses the ESP protocol. crypto ipsec profile ALIYUN-PROFILE set ikev2 ipsec-proposal ALIYUN-PROPOSAL #Create an ipsec profile and apply the created proposal. set ikev2 local-identity address #Specify that the local ID uses the IP address format, which must be consistent with the RemoteId format on the Alibaba Cloud side. set pfs group14 #Specify pfs and the DH group. set security-association lifetime seconds 86400 #Specify the time-based SA lifetime. set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.Create a tunnel group and specify the pre-shared key of the tunnel. This must be consistent with the Alibaba Cloud side.
#Add the following configuration on on-premises gateway device 1 tunnel-group 120.XX.XX.191 type ipsec-l2l #Set the tunnel encapsulation mode to l2l. tunnel-group 120.XX.XX.191 ipsec-attributes ikev2 remote-authentication pre-shared-key fddsFF123**** #Specify the pre-shared key of the tunnel peer, which is the pre-shared key on the Alibaba Cloud side. ikev2 local-authentication pre-shared-key fddsFF123**** #Specify the pre-shared key of the local tunnel, which must be consistent with that on the Alibaba Cloud side. !Create a tunnel interface.
#Add the following configuration on on-premises gateway device 1 interface Tunnel1 #Create a tunnel interface. nameif ALIYUN1 ip address 169.254.10.2 255.255.255.252 #Specify the IP address of the interface. tunnel source interface outside1 #Specify the tunnel source address as the public-facing interface GigabitEthernet0/0. tunnel destination 120.XX.XX.191 #Specify the tunnel destination address as the public IP address of IPsec connection 1 on the Alibaba Cloud side. tunnel mode ipsec ipv4 tunnel protection ipsec profile ALIYUN-PROFILE #Apply the ipsec profile ALIYUN-PROFILE to the tunnel. no shutdown #Enable the tunnel interface. !Configure routes.
#Add the following configuration on on-premises gateway device 1 route outside1 120.XX.XX.191 255.255.255.255 192.XX.XX.172 #Configure a route to access the public IP address of IPsec connection 1 on the Alibaba Cloud side, with the next hop being the public network address. route private 192.168.0.0 255.255.255.0 192.168.50.215 #Configure a route to the data center. route private 192.168.1.0 255.255.255.0 192.168.50.215 route private 192.168.2.0 255.255.255.0 192.168.50.215 router bgp 65530 address-family ipv4 unicast neighbor 169.254.10.1 remote-as 65531 #Specify the BGP neighbor, that is, the BGP IP address of IPsec connection 1 on the Alibaba Cloud side. neighbor 169.254.10.1 ebgp-multihop 255 neighbor 169.254.10.1 activate #Activate the BGP neighbor. network 192.168.0.0 mask 255.255.255.0 #Advertise the CIDR block of the data center. network 192.168.1.0 mask 255.255.255.0 network 192.168.2.0 mask 255.255.255.0 exit-address-family
Configuration example for on-premises gateway device 2
Log on to the CLI of the Cisco firewall and enter the configuration mode.
ciscoasa> enable Password: ******** # Enter the password for entering the enable mode. ciscoasa# configure terminal # Enter the configuration mode. ciscoasa(config)#View the interface configuration.
Make sure that the interface configuration on the Cisco firewall is complete and the interface is enabled. The following is an interface configuration example in this topic.
# View the interface configuration of on-premises gateway device 2. ciscoasa(config)# show running-config interface ! interface GigabitEthernet0/0 nameif outside1 security-level 0 ip address 11.XX.XX.2 255.255.255.255 ! interface GigabitEthernet0/1 nameif private security-level 100 ip address 192.168.50.218 255.255.255.0 !Enable the IKEv2 feature for the public-facing interface.
#Add the following configuration on on-premises gateway device 2 crypto ikev2 enable outside1 #Enable IKEv2 on the outside1 interface (public-facing interface) of on-premises gateway device 2.Create an IKEv2 policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.
#Add the following configuration to on-premises gateway device 2. crypto ikev2 policy 10 encryption aes #Specify the encryption algorithm. integrity sha #Specify the authentication algorithm. group 14 #Specify the DH group. prf sha #Keep prf consistent with integrity. On the Alibaba Cloud side, prf is consistent with the authentication algorithm by default. lifetime seconds 86400 #Specify the SA lifetime.Create an IPsec proposal and profile, and specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase on the Cisco firewall side. These settings must be consistent with those on the Alibaba Cloud side.
#Add the following configuration to on-premises gateway device 2. crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL #Create an IPsec proposal. protocol esp encryption aes #Specify the encryption algorithm. The protocol is ESP. The Alibaba Cloud side always uses the ESP protocol. protocol esp integrity sha-1 #Specify the authentication algorithm. The protocol uses ESP; the Alibaba Cloud side always uses the ESP protocol. crypto ipsec profile ALIYUN-PROFILE set ikev2 ipsec-proposal ALIYUN-PROPOSAL #Create an IPsec profile and apply the created proposal. set ikev2 local-identity address #Specify that the local ID uses the IP address format, consistent with the RemoteId format on the Alibaba Cloud side. set pfs group14 #Specify PFS and the DH group. set security-association lifetime seconds 86400 #Specify the time-based SA lifetime. set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.Create a tunnel group and specify the pre-shared key of the tunnel, which must be consistent with the one on the Alibaba Cloud side.
#Add the following configuration to on-premises gateway device 2 tunnel-group 47.XX.XX.213 type ipsec-l2l #Specify the encapsulation mode of the tunnel as l2l. tunnel-group 47.XX.XX.213 ipsec-attributes ikev2 remote-authentication pre-shared-key fddsFF456**** #Specify the pre-shared key of the tunnel peer, that is, the pre-shared key on the Alibaba Cloud side. ikev2 local-authentication pre-shared-key fddsFF456**** #Specify the local pre-shared key of the tunnel, which must be consistent with the one on the Alibaba Cloud side. !Create a tunnel interface.
#Add the following configuration on on-premises gateway device 2 interface Tunnel1 #Create the tunnel interface. nameif ALIYUN1 ip address 169.254.11.2 255.255.255.252 #Specify the IP address of the interface. tunnel source interface outside1 #Specify the tunnel source address as the public-facing interface GigabitEthernet0/0. tunnel destination 47.XX.XX.213 #Specify the tunnel destination address as the public IP address of IPsec connection 2 on the Alibaba Cloud side. tunnel mode ipsec ipv4 tunnel protection ipsec profile ALIYUN-PROFILE #Specify that the tunnel uses the ipsec profile ALIYUN-PROFILE. no shutdown #Enable the tunnel interface. !Configure routes.
#Add the following configuration on on-premises gateway device 2 route outside1 47.XX.XX.213 255.255.255.255 192.XX.XX.173 #Configure a route to access the public IP address of IPsec connection 2 on the Alibaba Cloud side, with the next hop being the public network address. route private 192.168.0.0 255.255.255.0 192.168.50.217 #Configure a route to the data center. route private 192.168.1.0 255.255.255.0 192.168.50.217 route private 192.168.2.0 255.255.255.0 192.168.50.217 router bgp 65530 address-family ipv4 unicast neighbor 169.254.11.1 remote-as 65531 #Specify the BGP neighbor, that is, the BGP IP address of IPsec connection 2 on the Alibaba Cloud side. neighbor 169.254.11.1 ebgp-multihop 255 neighbor 169.254.11.1 activate #Activate the BGP neighbor. network 192.168.0.0 mask 255.255.255.0 #Advertise the CIDR block of the data center. network 192.168.1.0 mask 255.255.255.0 network 192.168.2.0 mask 255.255.255.0 exit-address-family
Configuration example of on-premises gateway device 3
Log on to the CLI of the Cisco firewall and enter the configuration mode.
ciscoasa> enable Password: ******** # Enter the password for entering the enable mode. ciscoasa# configure terminal # Enter the configuration mode. ciscoasa(config)#Verify the interface configuration.
Make sure that the interface configuration on the Cisco firewall is complete and that the interfaces are enabled. The following is an interface configuration example in this topic.
# View the interface configuration of on-premises gateway device 3. ciscoasa(config)# show running-config interface ! interface GigabitEthernet0/0 nameif outside1 security-level 0 ip address 11.XX.XX.3 255.255.255.255 ! interface GigabitEthernet0/1 nameif private security-level 100 ip address 192.168.50.213 255.255.255.0 !Enable IKEv2 on the public interface.
#Add the following configuration on on-premises gateway device 3 crypto ikev2 enable outside1 #Enable the IKEv2 feature for the outside1 interface (public-facing interface) of on-premises gateway device 3.Create an IKEv2 Policy and specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must be consistent with those on the Alibaba Cloud side.
#Add the following configuration on on-premises gateway device 3 crypto ikev2 policy 10 encryption aes #Specify the encryption algorithm. integrity sha #Specify the authentication algorithm. group 14 #Specify the DH group. prf sha #Keep prf consistent with integrity. On the Alibaba Cloud side, prf is consistent with the authentication algorithm by default. lifetime seconds 86400 #Specify the SA lifetime.Create an IPsec proposal and profile, and specify the IPsec phase encryption algorithm, authentication algorithm, DH group, and SA lifetime on the Cisco firewall side. These must be consistent with the Alibaba Cloud side.
#Add the following configuration on on-premises gateway device 3 crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL #Create an ipsec proposal. protocol esp encryption aes #Specify the encryption algorithm. The protocol uses ESP, and the Alibaba Cloud side always uses the ESP protocol. protocol esp integrity sha-1 #Specify the authentication algorithm. The protocol uses ESP, and the Alibaba Cloud side always uses the ESP protocol. crypto ipsec profile ALIYUN-PROFILE set ikev2 ipsec-proposal ALIYUN-PROPOSAL #Create an ipsec profile and apply the created proposal. set ikev2 local-identity address #Specify that the local ID uses the IP address format, which must be consistent with the RemoteId format on the Alibaba Cloud side. set pfs group14 #Specify pfs and the DH group. set security-association lifetime seconds 86400 #Specify the time-based SA lifetime. set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.Create a tunnel group and specify the pre-shared key of the tunnel. This must be consistent with the Alibaba Cloud side.
#Add the following configuration on on-premises gateway device 3 tunnel-group 47.XX.XX.161 type ipsec-l2l #Specify the tunnel encapsulation mode as l2l. tunnel-group 47.XX.XX.161 ipsec-attributes ikev2 remote-authentication pre-shared-key fddsFF789**** #Specify the pre-shared key of the tunnel peer, which is the pre-shared key on the Alibaba Cloud side. ikev2 local-authentication pre-shared-key fddsFF789**** #Specify the pre-shared key of the local end of the tunnel, which must be consistent with that on the Alibaba Cloud side. !Create the tunnel interface.
#Add the following configuration on on-premises gateway device 3 interface Tunnel1 #Create a tunnel interface. nameif ALIYUN1 ip address 169.254.12.2 255.255.255.252 #Specify the IP address of the interface. tunnel source interface outside1 #Specify the tunnel source address as public-facing interface GigabitEthernet0/0. tunnel destination 47.XX.XX.161 #Specify the tunnel destination address as the public IP address of IPsec connection 3 on the Alibaba Cloud side. tunnel mode ipsec ipv4 tunnel protection ipsec profile ALIYUN-PROFILE #Specify that the tunnel applies ipsec profile ALIYUN-PROFILE. no shutdown #Enable the tunnel interface. !Configure routes.
#Add the following configuration to on-premises gateway device 3 route outside1 47.XX.XX.161 255.255.255.255 192.XX.XX.174 #Configure a route to access the public IP address of IPsec connection 3 on the Alibaba Cloud side, with the next hop being the public network address. route private 192.168.0.0 255.255.255.0 192.168.50.214 #Configure a route to the data center. route private 192.168.1.0 255.255.255.0 192.168.50.214 route private 192.168.2.0 255.255.255.0 192.168.50.214 router bgp 65530 address-family ipv4 unicast neighbor 169.254.12.1 remote-as 65531 #Specify the BGP neighbor, which is the BGP IP address of IPsec connection 3 on the Alibaba Cloud side. neighbor 169.254.12.1 ebgp-multihop 255 neighbor 169.254.12.1 activate #Activate the BGP neighbor. network 192.168.0.0 mask 255.255.255.0 #Advertise the CIDR block of the data center. network 192.168.1.0 mask 255.255.255.0 network 192.168.2.0 mask 255.255.255.0 exit-address-family
After you complete the preceding configuration, an IPsec-VPN connection can be successfully established between the data center and Alibaba Cloud, and the routes of the data center are advertised to the BGP Route Table of the IPsec connection through the BGP dynamic routing protocol.
Add route configurations in the data center as needed based on your actual network environment, so that traffic from data center clients to the VPC can be transmitted through on-premises gateway device 1, on-premises gateway device 2, and on-premises gateway device 3 simultaneously. For specific commands, consult the relevant device vendor.
Step 4: Create a VPC connection
After you create the IPsec connection, the IPsec connection is automatically associated with the transit router instance. You need to create a VPC connection in the Cloud Enterprise Network console to associate the VPC instance with the transit router instance as well, so as to enable mutual communication between the data center and the VPC.
Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
On the tab, find the transit router instance in the China (Shanghai) region and click Create Connection in the Actions column.
On the Connection with Peer Network Instance page, configure the parameters based on the following information, and then click OK.
Connect the VPC instance in China (Shanghai) to the transit router based on the following information, and keep the other configuration items at their default settings. For more information, see Create a VPC connection.
Configuration item
Description
VPC connection
Network Type
Select the network instance type.
In this example, VPC is selected.
Region
Select the region to which the network instance belongs.
In this example, China (Shanghai) is selected.
Transit Router
The system automatically displays the ID of the transit router instance that is created in the current region.
Account
Select whether the Alibaba Cloud account to which the network instance belongs is the same as the account that you use to log on.
In this example, Your Account is selected.
Billing Method
The billing method of the VPC connection. The default value is Pay-As-You-Go. For more information about the billing rules of transit routers, see Billing overview.
Attachment Name
Enter the name of the VPC connection.
In this example, enter VPC connection.
Network Instance
Select a network instance.
In this example, the VPC instance in China (Shanghai) is selected.
vSwitch
Select vSwitch instances in the zones supported by the transit router.
If the transit router supports only one zone in the current region, you must select a vSwitch in that zone.
If the transit router supports multiple zones in the current region, you must select vSwitches in at least two different zones. This provides disaster recovery across zones for traffic between the VPC and the transit router.
Select a vSwitch in each zone to reduce traffic detours and transmission delays, and to improve performance.
Make sure that each selected vSwitch has an idle IP address. If the VPC does not have a vSwitch in the zones supported by the transit router, or if the vSwitches do not have idle IP addresses, you must create a vSwitch. For more information, see Create and manage vSwitches.
In this example, vSwitch 1 is selected in Zone F and vSwitch 2 is selected in Zone G.
Advanced Settings
Specify whether to enable all advanced settings. By default, all advanced settings are enabled.
Retain the default settings to enable all advanced settings.
Step 5: Create an inter-region connection
Because the transit router instance to which the IPsec connection is attached and the transit router instance to which the VPC instance is attached are located in different regions, the data center and the VPC instance cannot communicate with each other by default. You must create an inter-region connection between the transit router instances in the China (Hangzhou) and China (Shanghai) regions to enable cross-region communication between the data center and the VPC instance.
On the CEN Instance page, find the Cloud Enterprise Network instance that you want to manage and click its ID.
On the tab, click Set Inter-region Bandwidth.
On the Connection with Peer Network Instance page, configure the inter-region connection based on the following information, and then click OK.
Create an inter-region connection based on the following information and keep the default settings for the other configuration items. For more information, see Create an inter-region connection.
Configuration item
Description
Network Type
Select Inter-region Connection.
Region
Select the regions that you want to connect.
In this example, China (Hangzhou) is selected.
Transit Router
The system automatically displays the instance ID of the transit router in the current region.
Attachment Name
Enter a name for the inter-region connection.
In this example, inter-region connection is entered.
Peer Region
Select the peer region that you want to connect.
In this example, China (Shanghai) is selected.
Transit Router
The system automatically displays the instance ID of the transit router in the current region.
Bandwidth Allocation Mode
An inter-region connection supports the following bandwidth allocation methods:
Allocate from Bandwidth Plan: allocates bandwidth from a purchased bandwidth plan.
Pay-By-Data-Transfer: charges based on the actual traffic used by the inter-region connection.
In this example, Pay-By-Data-Transfer is selected.
Bandwidth
Enter the bandwidth value of the inter-region connection. Unit: Mbps.
Default Line Type
Use the default link type.
Advanced Settings
Keep the default settings, which means all advanced settings options are selected.
After you create the inter-region connection, the system automatically completes route distribution and learning. The IPsec connection advertises the routes of the VPC instance to the data center through the BGP dynamic routing protocol, and also advertises the routes of the data center to the transit router, so that the data center and the VPC instance can communicate with each other. For more information about the routes, see Route description at the end of this topic.
Step 6: Verify connectivity
After you create the inter-region connection, the data center and the VPC instance can implement traffic load balancing through three IPsec-VPN connections. The following section describes how to test network connectivity and how to verify that traffic is load balanced across the three IPsec-VPN connections.
Test network connectivity.
Log on to an ECS instance in the VPC instance. For more information, see Connect to an ECS instance.
Run the ping command on the ECS instance to attempt to access the client in the data center.
ping <IP address of the client in the data center>If a response packet is received, the network between the data center and the VPC instance is connected, and the resources can access each other.
Verify traffic load balancing.
Continuously send access requests from multiple clients in the data center to the ECS instance. If you can view traffic monitoring data on the details pages of IPsec connection 1, IPsec connection 2, and IPsec connection 3 respectively, it proves that the traffic between the data center and the VPC instance has achieved load balancing through the three IPsec-VPN connections.
Log on to the VPN Gateway console.
In the top status bar, select the region to which the IPsec connection belongs.
In the left-side navigation pane, choose Interconnections - VPN - IPsec Connections.
On the IPsec Connections page, find the target IPsec connection and click the IPsec connection ID.
Go to the IPsec connection details page and view the traffic monitoring data under the Monitor tab.
Route description
In this topic, the default route configuration is used when you create an IPsec connection, a VPC connection, and an inter-region connection. Under the default route configuration, Cloud Enterprise Network automatically completes route advertisement and learning to enable mutual communication between the data center and VPC instances. The default route configuration is described as follows:
IPsec connection
When you create an IPsec connection, if you directly bind it to a transit router instance and enable all advanced settings, the system automatically performs the following route configuration for the IPsec connection:
By default, the IPsec connection is associated with the default route table of the transit router instance. The transit router instance forwards traffic from the IPsec connection by querying the default route table.
The destination-based routes that you add for the IPsec connection or the on-premises routes that the IPsec connection learns through the BGP dynamic routing protocol are automatically advertised to the default route table of the transit router instance.
The transit router automatically propagates other routes in its default route table to the BGP route table of the IPsec-VPN connection.
The IPsec connection automatically advertises the cloud routes that it learns to the data center through the BGP dynamic routing protocol.
VPC instance
When you create a VPC connection, if you enable all advanced settings, the system automatically performs the following route configuration for the VPC instance:
Associate with Default Route Table of Transit Router
After this feature is enabled, the VPC connection is automatically associated with the default route table of the transit router. The transit router forwards traffic of the VPC instance by querying the default route table.
Propagate system routes to transit router route table
After this feature is enabled, the VPC instance advertises its own system routes to the default route table of the transit router to enable communication between network instances.
Auto-add transit router routes to all VPC route tables
After this feature is enabled, the system automatically configures three route entries 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 in all route tables of the VPC instance, whose next hops all point to the VPC connection.
ImportantIf a route entry with a destination CIDR block of 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 already exists in the route table of the VPC, the system cannot automatically add the route entry. In this case, you must manually add a route entry that points to the VPC connection in the VPC route table to enable traffic to be forwarded between the VPC and the transit router.
You can click Check Route to check whether the preceding routes exist in the network instance.
inter-region connection
If you enable all advanced settings when you create an inter-region connection, the system automatically performs the following route configurations for the inter-region connection:
Associate with Default Route Table of Transit Router
Associates the inter-region connection with the system route tables of the transit routers in both regions. Inter-region traffic is forwarded based on these system route tables.
Propagate system routes to transit router route table
Establishes a route learning relationship between the inter-region connection and the system route tables of the transit routers in both regions.
Automatically Advertise Routes to Peer Region
Advertises routes from the local transit router's route table to the peer transit router's route table, enabling inter-region connectivity for network instances.
Route entry display
The following content shows the route entry information of the transit router instance, IPsec connection, VPC instance, and on-premises gateway device described in this topic. You can view the route entry information of the corresponding instance in the Alibaba Cloud console:
To view the route entry information of the transit router instance, see View route entries (Enterprise Edition).
To view the route entry information of the VPC instance, see Create and manage a route table.
To view the route entry information of the IPsec connection, go to the IPsec connection details page:
Log on to the VPN Gateway console.
In the top navigation bar, select the region where the IPsec connection is deployed.
In the left-side navigation pane, choose Interconnections - VPN - IPsec Connections.
On the IPsec Connections page, find the target IPsec connection and click the IPsec connection ID.
On the IPsec connection details page, view the route entry information of the IPsec connection under the BGP Route Table tab.