All Products
Search

This Product

    :Connect a data center to Alibaba Cloud via VPN gateway

    Document Center

    :Connect a data center to Alibaba Cloud via VPN gateway

    Last Updated:Jun 20, 2026

    VPN Gateway is an Internet-based service that establishes secure and reliable connections between enterprise data centers, corporate office networks, or Internet terminals and an Alibaba Cloud VPC through encrypted tunnels. You can use a VPN Gateway to create an IPsec connection that connects your data center to an Alibaba Cloud VPC, enabling data communication between your data center and the VPC.

    Prerequisites

    • Make sure that the gateway device in your data center meets the requirements.

      Alibaba Cloud VPN Gateway supports the standard IKEv1 and IKEv2 protocols. Configuring multiple CIDR blocks, as described in this topic, requires IKEv2. Supported devices are from vendors such as Hillstone, Sangfor, Cisco ASA, Juniper, SonicWall, Nokia, IBM, and Ixia.

    • The gateway in your data center has a static public IP address.
    • The CIDR block of your data center does not overlap with the CIDR block of the VPC.

    Background information

    示例图

    After you connect your data center to an Alibaba Cloud VPC by using an IPsec connection, you can use DTS to configure data migration, data synchronization, or data subscription in a more secure, high-speed, and stable network environment. To do this, specify the self-managed database in your data center as a self-managed database connected over Express Connect, VPN Gateway, or Smart Access Gateway.

    Notes

    If your data center is already connected to an Alibaba Cloud VPC, you can skip the procedures in this topic and perform only the following operations:

    1. Add the IP addresses of the DTS servers to the IPsec connection. For more information, see Modify an IPsec connection.
      Important When you click + Add Local Network, enter the IP addresses of the DTS servers in the corresponding region. For more information, see Add the IP addresses of DTS servers to a whitelist.
    2. Configure an IPsec connection and static routes on your on-premises gateway.

    Billing

    You are charged when you create a VPN Gateway. For more information, see Billing overview.

    Step 1: Create a VPN gateway

    1. Log on to the VPC console.
    2. In the top navigation bar, select a region.
    3. In the left-side navigation pane, choose VPN > VPN Gateways.
    4. On the VPN Gateways page, click Create VPN Gateway.
    5. Configure the VPN gateway based on your business requirements.
      Parameter Description
      Region The region where the VPN gateway is deployed.
      Important Make sure that the VPN gateway and the VPC are in the same region.
      Proprietary Network Select the VPC that you want to connect.
      Specify VSwitch This parameter is optional. You can specify a vSwitch in which the VPN gateway is created.
      Peak Bandwidth The peak bandwidth of the VPN gateway. The peak bandwidth is the maximum public bandwidth of the VPN gateway.
      IPsec-VPN

      Select Open.

      Note IPsec-VPN provides site-to-site connections. You can create an IPsec tunnel to securely connect a data center to a VPC, or to connect two VPCs.
      SSL-VPN

      Select Close.

      Note SSL-VPN provides point-to-site connections. This allows clients to directly connect to the VPN gateway without the need to configure a customer gateway.
      Billing Cycle

      The billing cycle is fixed as Pay-As-You-Go and cannot be changed.
    6. Click Buy Now and complete the payment.

    Step 2: Create a customer gateway

    1. Log on to the VPC console.
    2. In the top navigation bar, select the region where the VPN gateway is deployed.
    3. In the left-side navigation pane, choose VPN > Customer Gateways.
    4. Click Create Customer Gateway.
    5. In the Create Customer Gateway dialog box, configure the customer gateway.
      Parameter Description
      Name Enter a name for the customer gateway. We recommend that you use a name that is easy to identify.
      Important
      • The name must be 2 to 128 characters in length.
      • The name must start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-).
      IP address The static public IP address of the on-premises gateway.
      Description The description must be 2 to 256 characters in length and cannot start with http:// or https://.
    6. Click OK.

    Step 3: Create an IPsec connection and publish a route

    1. Log on to the VPC console.
    2. In the top navigation bar, select the region where the VPN gateway is deployed.
    3. In the left-side navigation pane, choose VPN > IPsec Connections.
    4. Click Create IPsec Connection.
    5. In the Create IPsec Connection dialog box, configure the IPsec connection.
      In this example, set Name to Connect to data center, set Remote Network to 192.168.10.0/24, and set Effective Immediately to No.
      Parameter Description
      Name The name of the IPsec connection.
      Note The name must be 2 to 128 characters in length. It must start with a letter or a Chinese character, and can contain digits, hyphens (-), and underscores (_).
      VPN Gateway Select the VPN gateway to be connected. In this example, select the VPN gateway that you created in Step 1.
      Customer Gateway Select the customer gateway to be connected. In this example, select the customer gateway that you created in Step 2.
      Local Network Enter the CIDR block on the VPC side to connect to the data center. This CIDR block is used in Phase 2 negotiation.
      Important
      • You can enter the CIDR block of the entire VPC or a vSwitch in the VPC. In this example, enter the CIDR block of a vSwitch: 172.16.88.0/24.
      • The local network cannot overlap with the remote network.
      + Add Local Network Add more VPC-side CIDR blocks to connect to the data center. In this example, enter the IP addresses of the DTS servers. For more information, see Add the IP addresses of DTS servers to a whitelist.
      Important If you add multiple local networks, you must set the Advanced Settings parameter to ikev2 in the advanced settings.
      Remote Network Enter the CIDR block on the data center side to connect to the VPC. This CIDR block is used in Phase 2 negotiation.
      Important The remote network cannot overlap with the local network.
      + Add Remote Network Add more data center-side CIDR blocks to connect to the VPC.
      Important If you add multiple remote networks, you must set the Advanced Settings parameter to ikev2 in the advanced settings.
      Effective Immediately Determines whether to start negotiations immediately.
      • Yes: Negotiations start immediately after the configuration is complete.
      • No: Negotiations are initiated when traffic is detected.
      Advanced Settings For more information about the parameters, see Create an IPsec connection.
      Health Check
    6. Click OK.
    7. In the Created dialog box, click OK to configure routes for the VPN gateway.
    8. VPN GatewayOn the details page of the VPN gateway, click the Destination-based Routing tab and click Add Route Entry.
    9. In the Add Route Entry dialog box, configure the route entry.
      Parameter Description
      Destination CIDR Block Enter the private CIDR block of the data center. In this example, enter 192.168.10.0/24.
      Next Hop Type Select IPsec Connection.
      Next Hop Select the IPsec connection that you just created.
      Publish to VPC Determines whether to publish the new route to the VPC route table.
      • Yes (Recommended): Publishes the new route to the VPC route table.
      • No: Does not publish the new route to the VPC route table.
        Important If you select No, you must manually publish the route on the Destination-based Routing tab after you add the route entry.
      Weight Select a weight value:
      • 100: High priority.
      • 0: Low priority.
      Important For routes with the same destination CIDR block, you cannot set the weight to 100 for more than one route.

    Step 4: Configure the on-premises gateway

    1. Log on to the VPC console.
    2. In the top navigation bar, select the region where the VPN gateway is deployed.
    3. In the left-side navigation pane, choose VPN > IPsec Connections.
    4. Find the IPsec connection that you want to manage. In the Actions column, choose ... > Download Peer Configuration.
    5. In the IPsec Connection Configuration dialog box, view the peer configuration.
      The configuration is provided in JSON format. It contains the following key parameters: LocalSubnet is 192.168.10.0/24, and RemoteSubnet includes 172.16.88.0/24 and 100.104.52.0/24. IPsec parameters include an encryption algorithm (IpsecEncAlg) of aes, an authentication algorithm (IpsecAuthAlg) of sha1, a lifetime (IpsecLifetime) of 86400, and PFS (IpsecPfs) of group2. IKE parameters include a version (IkeVersion) of ikev2, a mode (IkeMode) of main, an encryption algorithm (IkeEncAlg) of aes, an authentication algorithm (IkeAuthAlg) of sha1, a lifetime (IkeLifetime) of 86400, PFS (IkePfs) of group2, and a user-defined pre-shared key (Psk).
    6. Add the downloaded peer configuration to your on-premises gateway.
    7. On your on-premises gateway, add a static route entry. Set the destination to the IP addresses of the DTS servers and the next hop to the newly created IPsec tunnel interface. For the IP addresses of DTS servers, see Add the IP addresses of DTS servers to a whitelist.

    References

    If the IPsec connection fails or the network is unreachable, see IPsec-VPN connection FAQ for troubleshooting.