Use BGP routes to encrypt private network traffic between the cloud and an IDC - Express Connect

To encrypt private traffic, you can create an express connect router (ECR) to connect a virtual border router (VBR) and your VPC. Then, create a vpn gateway and configure Border Gateway Protocol (BGP) dynamic routing for the vpn gateway and the VBR.

Use case

This topic uses the following scenario as an example: An enterprise has a data center in Hangzhou and a VPC in the Alibaba Cloud China (Hangzhou) region. Services are deployed on Elastic Compute Service (ECS) instances in the VPC. To meet business requirements, the enterprise plans to use an Express Connect circuit and an ECR to establish a connection between the data center and the VPC. For security reasons, the enterprise also wants to encrypt traffic between the data center and the VPC.

After a private connection is established between the data center and the VPC, the enterprise can create a private vpn gateway in the VPC, establish an IPsec connection to the on-premises gateway device, and configure BGP dynamic routing for the VBR and the vpn gateway. This setup encrypts the traffic over the private connection.

Before you begin

Private vpn gateways are available by invitation only. You must obtain access permissions from your account manager before you begin.

Plan non-overlapping CIDR blocks for your data center and VPC. This topic uses the following CIDR blocks as an example:

Target	CIDR block planning	IP address
VPC	Primary CIDR block: 10.0.0.0/16 CIDR block of vSwitch 1: 10.0.0.0/24 CIDR block of vSwitch 2: 10.0.1.0/24	ECS1: 10.0.1.1 ECS2: 10.0.1.2
VBR	10.0.0.0/30	VLAN ID: 201 Alibaba Cloud-side IPv4 interconnect IP: 10.0.0.2/30 Customer-side IPv4 interconnect IP: 10.0.0.1/30 In this example, the customer side refers to the on-premises gateway device.
ECR	-	ASN: 45104
Data center	10.0.0.0/30 192.168.0.0/16	VPN IP address: 192.168.0.251 The VPN IP address is the IP address of the interface on the on-premises gateway device that is used to establish the IPsec connection with the Alibaba Cloud vpn gateway. IP address of the interface connected to the Express Connect circuit: 10.0.0.1 ASN: 65530

You have a VPC in the China (Hangzhou) region with services deployed on ECS instances. For more information, see Create and manage a VPC.
In this example, the VPC contains two vSwitches. vSwitch 1 is in availability zone H, and vSwitch 2 is in availability zone I. ECS instances are deployed in vSwitch 2. vSwitch 1 is used only to associate with the vpn gateway.
Note
We recommend creating a dedicated vSwitch within the VPC to associate with the vpn gateway. This vSwitch allocates a private IP address to the vpn gateway.
Confirm that your on-premises gateway device supports the standard IKEv1 and IKEv2 protocols, which are required to connect to an Alibaba Cloud vpn gateway. Contact your device vendor for this information.
Review the security group rules for your ECS instances and the access control rules for your data center to ensure they allow communication between the data center and the VPC. For more information, see View security group rules and Add a security group rule.

Procedure

Step 1: Deploy an Express Connect circuit

Deploy an Express Connect circuit to connect your data center to Alibaba Cloud.

Create an Express Connect circuit.
You must apply for an Express Connect circuit in the China (Hangzhou) region. For more information, see Apply for Classic Mode or Shared circuit access.
This example uses a dedicated physical connection.

Create a VBR.

Log on to the Express Connect console.
In the left-side navigation pane, click Virtual Border Routers (VBRs).
In the top navigation bar, select the region where you want to create the VBR.
In this example, China (Hangzhou) is selected.
On the Virtual Border Routers (VBRs) page, click Create VBR.

In the Create VBR panel, set the following parameters and click OK.

The following table describes only the parameters relevant to this example. For more information, see Create and manage VBRs.

Parameter	Description
Account	In this example, Current Account is selected.
Name	In this example, enter VBR.
Physical Connection Interfaces	In this example, select the Dedicated type, and then select the physical connection interface that you created in Step 1.
VLAN ID	In this example, enter 201.
VBR Bandwidth	Select the maximum bandwidth of the VBR.
Alibaba Cloud Side IPv4 Address	In this example, enter 10.0.0.2.
Data Center Side IPv4 Address	In this example, enter 10.0.0.1.
IPv4 Subnet Mask	In this example, enter 255.255.255.252.

Add a custom route entry to the VBR to advertise the CIDR block of the data center to Alibaba Cloud.

On the Virtual Border Routers (VBRs) page, click the ID of the VBR.
Click the Routes tab and then click Add Route Entry.

In the Add Route Entry panel, set the following parameters and click OK.

Parameter	Description
Next Hop Type	Select Physical Connection Interfaces.
Destination CIDR Block	Enter the CIDR block of the data center. In this example, enter 192.168.0.0/16.
Next Hop	Select the Express Connect circuit interface that you created in Step 1.

Configure the on-premises gateway device.
Add the following route entry to the on-premises gateway device to route traffic from the data center to the VPC through the Express Connect circuit.
The following sample command is for reference only. The commands may vary based on the network device vendor. For more information, contact the device vendor.
```
ip route 10.0.0.0 255.255.0.0 10.0.0.2
```

Step 2: Configure an ECR

Connect the VPC and VBR to an ECR. This enables private communication between the data center and the VPC.

Create an ECR.

Log on to the Express Connect Console.
In the left-side navigation pane, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, click Create ECR.

In the Create ECR dialog box, set the following parameters, select I have read and understand the billing rules, and then click OK.

Parameter	Description
Name	Enter a name for the express connect router. In this example, enter ECR.
ASN	Enter the ASN of the express connect router. In this example, enter 45104.
Description	Enter a description for the express connect router. In this example, enter ECR-for-test-private-VPN-Gateway.

Connect the ECR to the VPC.

Log on to the Express Connect console.
In the left navigation bar, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, click the express connect router instance that you created in Step 1.
Click the VPC tab and then click Associate VPC.

In the dialog box that appears, set the following parameters and click OK.

Parameter	Description
Resource Owner	Select the type of account to which the VPC belongs. In this example, Current Account is selected.
Region	Select the region where the destination VPC is deployed. In this example, China (Hangzhou) is selected.
VPC ID	Select the ID of the destination VPC. In this example, select the ID of the VPC.

Connect the ECR to the VBR.

Log on to the Express Connect console.
In the left navigation bar, click Express Connect Router (ECR), and then on the Express Connect Router (ECR) page, click the Express Connect Router instance that you created in Step 1.
On the VBR tab, click Associate VBR.

In the Associate VBR dialog box, set the following parameters and click OK.

Parameter	Description
Resource Owner	Select the type of account to which the VBR belongs. In this example, Current Account is selected.
Region	Select the region where the VBR resource is deployed. In this example, China (Hangzhou) is selected.
Network Instance	Select the destination VBR. In this example, select VBR.

Step 3: Deploy a vpn gateway

The previous steps establish a private connection, but the traffic is not encrypted. To encrypt the traffic, deploy a vpn gateway in the VPC and establish an IPsec connection to your on-premises gateway device.

Create a vpn gateway.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where you want to deploy the vpn gateway.
The vpn gateway must be deployed in the same region as the VPC with which you want to associate the vpn gateway. In this example, China (Hangzhou) is selected.
On the VPN Gateways page, click Create VPN Gateway.

On the buy page, configure the vpn gateway, click Calculating, and then complete the payment.

Parameter	Description
Instance Name	Enter a name for the vpn gateway. In this example, enter `VPN Gateway 1`.
Region	Select the region where the vpn gateway is deployed. In this example, China (Hangzhou) is selected.
Gateway Type	Select the type of the vpn gateway. In this example, Standard is selected.
Network Type	Select the network type of the vpn gateway. In this example, Private is selected.
VPC	Select the VPC with which you want to associate the vpn gateway. In this example, select VPC.
vSwitch 1	Select a vSwitch from the VPC. If you select Single-tunnel, you need to specify only one vSwitch. If you select Dual-tunnel, you need to specify two vSwitches. After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) for each of the two vSwitches as an interface to communicate with the VPC over an IPsec-VPN connection. Each ENI occupies one IP address in the vSwitch. Note The system selects a vSwitch by default. You can change or use the default vSwitch. After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.
vSwitch 2	Select the second vSwitch from the VPC. This parameter is required only when the tunnel mode of the IPsec connection is dual-tunnel.
Maximum bandwidth	Select a maximum bandwidth for the vpn gateway. Unit: Mbit/s.
Traffic	The billing method of the vpn gateway. Default value: Pay By Traffic. For more information, see Billing.
IPsec-VPN	Private vpn gateways support only the IPsec-VPN feature. In this example, the default value is used to Enable the IPsec-VPN feature.
Duration	Select a subscription duration. The billing cycle of the vpn gateway. Default value: By Hour.
Service-linked Role	Click Create Service-Linked Role. The system automatically creates the service-linked role AliyunServiceRoleForVpn. This role allows the vpn gateway to access resources in other Alibaba Cloud services. For more information, see AliyunServiceRoleForVpn. If Created is displayed, the role already exists for your account and you do not need to create it again.

Return to the VPN Gateways page and record the private IP address of the new vpn gateway. You will need this IP address to configure the IPsec connection.
The status of a newly created vpn gateway is Preparing. After 1 to 5 minutes, the status changes to Normal. A status of Normal indicates that the vpn gateway is initialized and ready for use.

Create a customer gateway.
1. In the navigation pane on the left, choose Interconnections > VPN > Customer Gateways.
2. On the Customer Gateway page, click Create Customer Gateway.
3. In the Create Customer Gateway panel, set the following parameters and click OK.
  The following content describes only the key parameters and their sample values for this example.
  - Name: Enter a name for the customer gateway.
    In this example, enter Customer-Gateway.
  - IP Address: Enter the VPN IP address of the on-premises gateway device to connect to the vpn gateway.
    In this example, enter 192.168.0.251.
  - ASN: Enter the ASN of the on-premises gateway device.
    In this example, enter 65530.

Create an IPsec connection.

In the navigation pane on the left, go to Interconnections > VPN > IPsec Connections.
On the IPsec-VPN connection page, click Create IPsec-VPN Connection.

On the Create IPsec-VPN Connection page, configure the IPsec connection and click OK.

This topic describes only the key parameters and their sample values for this example. For more information, see IPsec connections (single-tunnel mode).

Parameter	Description
Name	Enter a name for the IPsec connection. In this example, enter `IPsec-Connection-1`.
VPN Gateways	Select the vpn gateway that you created. In this example, select VPN Gateway 1.
Customer Gateway	Select the customer gateway that you created. In this example, select Customer-Gateway.
Routing Mode	Select a routing mode. In this example, Destination Routing Mode is selected.
Effective Immediately	Select whether to establish the connection immediately. Yes: Negotiations start immediately after the configuration is complete. No: Negotiations start when traffic is detected. In this example, Yes is selected.
Pre-Shared Key	Enter a pre-shared key. If you do not specify a value, the system generates a random 16-character string. Important The pre-shared key must match the key configured on your on-premises gateway device. In this example, enter `fddsFF123****`.
Encryption Configuration	For IKE Configurations, set Version to ikev2 and keep the default settings for the other parameters.
BGP Configuration	Enable BGP and configure the following parameters: Tunnel CIDR Block: Enter the CIDR block for the IPsec tunnel. This must be a /30 CIDR block from within the 169.254.0.0/16 range. In this example, enter `169.254.10.0/30`. Local BGP IP address: Enter the BGP IP address on the vpn gateway side. This address must be an IP address within the tunnel CIDR block. In this example, enter `169.254.10.1`. Then, the BGP IP address on the data center side is `169.254.10.2`. Local ASN: Enter the ASN for the vpn gateway side. The default value is 45104. In this example, the default value 45104 is used. Important If you use BGP dynamic routing for both the VBR and the vpn gateway, their ASNs must be the same to simplify route management.
Health Check	In this example, the default settings are used.

After the IPsec connection is created, click OK in the Created dialog box.

Enable automatic BGP route propagation for the vpn gateway.
Once a BGP session is established, enabling automatic route propagation allows the vpn gateway to learn and propagate the data center's CIDR block to the VPC. The vpn gateway also advertises VPC system routes to the on-premises gateway device.
1. In the left-side navigation pane, choose Interconnections > VPN > VPN Gateways.
2. On the VPN Gateways page, find VPN Gateway 1 and in the Actions column, choose Enable Automatic BGP Propagation.
3. In the Enable Automatic BGP Propagation dialog box, click OK.
Download the IPsec connection configuration for the on-premises gateway device.
1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
2. On the IPsec Connections page, find IPsec-Connection-1 and click Download Peer Configuration in the Actions column.
  Save the downloaded IPsec connection configuration on your local client.

Add VPN, BGP, and static route configurations to the on-premises gateway device.

Use the downloaded IPsec configuration to configure your on-premises gateway device, then add the required BGP and static route settings.

The following sample commands are for reference only. Commands may vary by device vendor. For specific commands, contact your vendor.

Log on to the command-line interface (CLI) of the on-premises gateway device.

Run the following commands to configure an IKEv2 proposal and policy.

crypto ikev2 proposal alicloud  
encryption aes-cbc-128          // Set the encryption algorithm. In this example, aes-cbc-128 is used.
integrity sha1                  // Set the authentication algorithm. In this example, sha1 is used.
group 2                         // Set the DH group. In this example, group2 is used.
exit
!
crypto ikev2 policy Pureport_Pol_ikev2
proposal alicloud
exit
!

Run the following command to configure an IKEv2 keyring.

crypto ikev2 keyring alicloud
peer alicloud
address 10.0.0.167               // Set the private IP address of the cloud-side vpn gateway. In this example, 10.0.0.167 is used.
pre-shared-key fddsFF123****     // Set the pre-shared key. In this example, fddsFF123**** is used.
exit
!

Run the following command to configure an IKEv2 profile.

crypto ikev2 profile alicloud
match identity remote address 10.0.0.167 255.255.255.255    // Match the private IP address of the cloud-side vpn gateway. In this example, 10.0.0.167 is used.
identity local address 192.168.0.251    // The VPN IP address of the data center. In this example, 192.168.0.251 is used.
authentication remote pre-share   // The remote authentication method is pre-shared key (PSK).
authentication local pre-share    // The local authentication method is PSK.
keyring local alicloud            // Call the keyring.
exit
!

Run the following command to configure the transform set.

crypto ipsec transform-set TSET esp-aes esp-sha-hmac
mode tunnel
exit
!

Run the following command to configure the IPsec profile and apply the transform set, PFS, and IKEv2 profile.
```
crypto ipsec profile alicloud
set transform-set TSET
set pfs group2
set ikev2-profile alicloud
exit
!
```

Run the following commands to configure the IPsec tunnel.

interface Tunnel100
ip address 169.254.10.2 255.255.255.252    // Set the tunnel IP address for the data center. In this example, 169.254.10.2 is used.
tunnel source GigabitEthernet1
tunnel mode ipsec ipv4
tunnel destination 10.0.0.167              // The private IP address of the remote cloud-side vpn gateway. In this example, 10.0.0.167 is used.
tunnel protection ipsec profile alicloud
no shutdown
exit
!
interface GigabitEthernet1                 // Configure the IP address of the interface used to establish the IPsec connection to the vpn gateway.
ip address 192.168.0.251 255.255.255.0
negotiation auto
!

Run the following commands to configure BGP routing.

Important

To route traffic from the VPC to the on-premises network through the encrypted tunnel of the vpn gateway, you must advertise a more specific route (a smaller CIDR block) than the data center's CIDR block in the BGP configuration of the on-premises gateway device.

For example, the CIDR block of the data center is 192.168.0.0/16. The CIDR block advertised in the BGP configuration of the on-premises gateway device must be more specific than /16. In this example, 192.168.1.0/24 is advertised.

router bgp 65530                         // Enable BGP routing and set the ASN for the data center. In this example, 65530 is used.
neighbor 169.254.10.1 remote-as 45104    // Set the ASN of the BGP peer. In this example, the ASN of the cloud-side vpn gateway (45104) is used.
neighbor 169.254.10.1 ebgp-multihop 10   // Set the EBGP multi-hop count to 10.  
!
address-family ipv4
network 192.168.1.0 mask 255.255.255.0   // Advertise the CIDR block of the data center. In this example, 192.168.1.0/24 is advertised.
neighbor 169.254.10.1 activate           // Activate the BGP peer.
exit-address-family
!

Run the following command to configure a static route.

ip route 10.0.0.167 255.255.255.255 10.0.0.2  // Route traffic from the data center to the vpn gateway through the Express Connect circuit.

Step 4: Configure routes and policies

Now that the encrypted tunnel is established, you must configure routes in the VPC and VBR to direct traffic through it.

Add a custom route entry to the VPC.

Log on to the VPC console.
In the left-side navigation pane, click Route Tables.
In the top navigation bar, select the region to which the route table belongs.
In this example, China (Hangzhou) is selected.
On the Route Tables page, find the target route table and click its ID.
In this example, find the system route table of the VPC.
On the Route Entry List tab, click the Custom Route tab and then click Add Route Entry.

In the Add Route Entry panel, set the following parameters and click OK.

Parameter	Description
Name	Enter a name for the custom route entry.
Destination CIDR Block	Enter the destination CIDR block of the custom route entry. In this example, select IPv4 CIDR Block and enter the VPN IP address of the on-premises gateway device, `192.168.0.251/32`.
Next Hop Type	Select the type of the next hop. In this example, select Express Connect Router (ECR).
Express Connect Router (ECR)	Select the next hop for the custom route entry. In this example, select the ECR.

Add a custom route entry to the VBR.

Log on to the Express Connect console.
In the left-side navigation pane, click Virtual Border Routers (VBRs).
In the top navigation bar, select the region where the VBR is deployed.
In this example, China (Hangzhou) is selected.
On the Virtual Border Routers (VBRs) page, click the ID of the target VBR.
Click the Routes tab and then click Add Route Entry.

In the Add Route Entry panel, set the following parameters and click OK.

Parameter	Description
Next Hop Type	Select Physical Connection Interfaces.
Destination CIDR Block	Enter the VPN IP address of the on-premises gateway device. In this example, enter `192.168.0.251/32`.
Next Hop	Select the physical connection interface that you created in Step 1.

Step 5: Test the connection

Now that your data center and VPC are connected over an encrypted private connection, you can test the connectivity and verify that the traffic is encrypted.

Test the private connectivity.
1. Log on to the ECS1 instance. For more information, see Connection methods.
2. From an ECS instance, ping a client in your data center to test the private connectivity.
```
ping 
```
  A successful reply indicates that the data center and VPC are connected.
Verify that traffic is encrypted.
1. Log on to the VPN Gateway console.
2. In the top navigation bar, select the region where the vpn gateway is deployed.
  In this example, China (Hangzhou) is selected.
3. In the navigation pane on the left, go to Interconnections > VPN > IPsec Connections.
4. On the IPsec Connections page, find the IPsec connection that you created in Step 3 and click its ID.
5. Click the Monitor tab to view the traffic monitoring data.