VPN Gateway:Connect an Alibaba Cloud VPC to an AWS VPC

VPC CIDR blocks

BGP CIDR block planning

Skip this section if you plan to use static routing only.

Both tunnels on the Alibaba Cloud side must use the same Local ASN. The peer BGP ASNs for the two tunnels can differ, but using the same peer BGP ASN for both is recommended.

Each BGP tunnel CIDR block must be unique within a VPN Gateway instance.

Create customer gateways

1. Log on to the VPN Gateway console.

2. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

3. In the top navigation bar, select Germany (Frankfurt). The customer gateway and the VPN Gateway must be in the same region.

4. On the Customer Gateways page, click Create Customer Gateway.

5. In the Create Customer Gateway panel, configure the following settings and click OK. Create two customer gateways using the outside IP addresses of Tunnel 1 from each AWS site-to-site VPN connection. For parameters not listed here, keep the default values. See Customer gateways.

   Important

   Use only the outside IP address of Tunnel 1 from each AWS site-to-site VPN connection. The outside IP address of Tunnel 2 is not used. After the IPsec-VPN connection is created, Tunnel 2 of each AWS site-to-site VPN connection remains disconnected by default.

   Parameter	Description	Customer Gateway 1	Customer Gateway 2
   Name	Name for the customer gateway.	Customer Gateway 1	Customer Gateway 2
   IP Address	Outside IP address of the AWS tunnel.	3.XX.XX.52	3.XX.XX.56
   ASN	BGP ASN of the AWS virtual private gateway. Required for BGP dynamic routing.	64512	64512

Create an IPsec-VPN connection

1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

2. On the IPsec Connections page, click Bind VPN Gateway.

3. On the Create IPsec-VPN Connection page, configure the following settings and click OK.

   Parameter	Description	Example value
   IPsec-VPN Connection Name	Name for the IPsec-VPN connection.	IPsec-VPN connection
   Region	Region where the VPN Gateway is deployed.	Germany (Frankfurt)
   Attach a VPN Gateway	VPN Gateway instance to associate with the IPsec-VPN connection.	VPN Gateway (created in Step 1)
   Routing Mode	How traffic is routed through the tunnel. Destination-based Routing routes by destination IP. Traffic Of Interest Pattern routes by source and destination IP pair.	Static routing: select Traffic Of Interest Pattern (Recommended). Set Local Network to 10.0.0.0/16 and Remote Network to 192.168.0.0/16. BGP dynamic routing: select Destination-based Routing (recommended).
   Effective Immediately	Whether to start IKE negotiation immediately after configuration. Yes: negotiation starts immediately. No: negotiation is triggered by traffic.	Yes
   Enable BGP	Whether to use BGP dynamic routing. Disabled by default. To use BGP, enable it after the connection is created and add BGP configurations separately.	Disabled (static routing). Enable after creation for BGP.
   Tunnel 1 – Customer Gateway	Customer gateway for the active tunnel.	Customer Gateway 1
   Tunnel 1 – Pre-Shared Key	Authentication key for the active tunnel. 1–100 characters: digits, letters, and special characters ` ~!@#$%^&*()_-+={}[]|;:',.<>/?``. Must match the key configured on the connected AWS tunnel.	Same as the AWS tunnel pre-shared key
   Tunnel 1 – Encryption Configurations	IKE, IPsec, DPD, and NAT traversal settings.	Under IKE Configurations, set SA Life Cycle (seconds) to 28800. Under IPsec Configurations, set SA Life Cycle (seconds) to 3600. Keep all other values at their defaults. See Configure IPsec-VPN connections.
   Tunnel 2 – Customer Gateway	Customer gateway for the standby tunnel.	Customer Gateway 2
   Tunnel 2 – Pre-Shared Key	Authentication key for the standby tunnel. Must match the key on the connected AWS tunnel.	Same as the AWS tunnel pre-shared key
   Tunnel 2 – Encryption Configurations	IKE, IPsec, DPD, and NAT traversal settings.	Same as Tunnel 1: IKE SA Life Cycle 28800 s, IPsec SA Life Cycle 3600 s.

4. In the Created message, click Cancel.

Configure VPN Gateway routes

Check the VPN connection status

Before running end-to-end tests, confirm that the IPsec-VPN connection is established:

1. In the VPN Gateway console, go to Interconnections > VPN > IPsec Connections.

2. Find the IPsec-VPN connection you created. Confirm that the tunnel status shows Connected.

If the status is not Connected, check:

• That the pre-shared keys on both sides match.

• That the IKE SA Life Cycle and IPsec SA Life Cycle values match on both sides (28800 s and 3600 s respectively).

• That security group rules and network ACLs on both the Alibaba Cloud and AWS sides allow traffic between the two VPC CIDR blocks.

Test end-to-end connectivity

Before testing, verify that the network ACLs and security group rules on both platforms allow traffic between the two VPCs.

1. Log on to an ECS instance in the Alibaba Cloud VPC. See Select a remote connection method for an ECS instance.

2. Run ping to reach the AWS EC2 instance:

   ping <private IP address of the AWS EC2 instance>

   If the ECS instance receives replies, the two VPCs can communicate.

   

Test high-availability failover

A dual-tunnel IPsec-VPN connection provides automatic failover: if the active tunnel fails, traffic switches to the standby tunnel.

1. Stay logged on to the ECS instance and run a continuous ping:

   ping <private IP address of the AWS EC2 instance> -c 10000

2. Interrupt the active tunnel by changing its pre-shared key on the Alibaba Cloud side. A key mismatch causes the tunnel to drop.

3. Watch the ping output. After a brief interruption, traffic automatically resumes through the standby tunnel.

To monitor tunnel traffic, go to the Monitoring tab of the IPsec-VPN connection in the Alibaba Cloud console. See Monitor an IPsec-VPN connection.