This topic describes how to use IPsec-VPN to establish a secure connection between two virtual private clouds (VPCs). This way, the cloud resources in one VPC can access the cloud resources in the other VPC.

Scenarios

Note VPN gateways do not support inter-border connections. When you create an IPsec-VPN connection between two VPCs, both the VPCs must be in the Chinese mainland or outside the Chinese mainland. For more information about the regions that are in the Chinese mainland or outside the Chinese mainland, see Which regions are in the Chinese mainland and which regions are outside the Chinese mainland?

If you want to create connections between two VPCs when one of them is in the Chinese mainland and the other is outside the Chinese mainland, we recommend that you use the Cloud Enterprise Network (CEN) service. For more information, see What is CEN?

The following scenario is used as an example in this topic: An enterprise created a VPC named VPC 1 in the China (Hangzhou) region and another VPC named VPC 2 in the China (Qingdao) region. Elastic Compute Service (ECS) instances are deployed in the VPCs, and services are deployed on the ECS instances. Due to business development, the services in VPC 1 and VPC 2 need to communicate with each other.

To ensure network security, the enterprise decides to use VPN gateways to establish an IPsec-VPN connection between VPC 1 and VPC 2. This way, data transmission between the VPCs is encrypted and the cloud resources can communicate with each other in a secure manner.

Connect the VPCs

Prerequisites

  • A VPC named VPC 1 is created in the China (Hangzhou) region, and a VPC named VPC 2 is created in the China (Qingdao) region. ECS instances are deployed in the VPCs, and services are deployed on the ECS instances. For more information, see Create a VPC with an IPv4 CIDR block.
    The following table describes the configurations of VPC 1 and VPC 2 in this example.
    Note You can specify the CIDR blocks based on your business requirements. Make sure that the CIDR blocks that need to communicate do not overlap.
    VPC name Region VPC CIDR block VPC ID Name of ECS instance IP address of ECS instance
    VPC1 China (Hangzhou) 192.168.0.0/16 vpc-bp1e0yx3nsosmitth**** ECS1 192.168.20.161
    VPC2 China (Qingdao) 10.0.0.0/16 vpc-m5e83sapxp88cgp5f**** ECS2 10.0.1.110
  • You are aware of the security group rules that are applied to the ECS instances in the VPCs. Make sure that the security group rules allow the ECS instances to communicate with each other. For more information, see Query security group rules and Add a security group rule.

Procedure

Connect VPCs - Procedure

Step 1: Create a VPN gateway

  1. Log on to the VPN Gateway console.
  2. In the top navigation bar, select the region where you want to create the VPN gateway.
    In this example, the China (Hangzhou) region is selected.
    Note The VPN gateway must belong to the same region as the VPC that you want to associate with the VPN gateway.
  3. On the VPN Gateways page, click Create VPN Gateway.
  4. On the buy page, set the following parameters, click Buy Now, and then complete the payment.
    Parameter Description
    Name Enter a name for the VPN gateway. In this example, VPN Gateway 1 is entered.
    Region Select the region where you want to deploy the VPN gateway. In this example, the China (Hangzhou) region is selected.
    VPC Select the VPC with which you want to associate the VPN gateway. In this example, VPC 1 is selected.
    Specify VSwitch Specify whether to deploy the VPN gateway in a specified vSwitch of the VPC. In this example, No is selected.
    Maximum Bandwidth Specify a maximum bandwidth value for the VPN gateway. Unit: Mbit/s.
    Traffic Select a metering method for the VPN gateway. Default value: Pay-by-data-transfer.

    For more information, see Pay-as-you-go.

    IPsec-VPN Specify whether to enable IPsec-VPN. In this example, Enable is selected.
    SSL-VPN Specify whether to enable SSL-VPN. In this example, Disable is selected.
    Duration

    Specify the billing cycle. Default value: By Hour.

    Service-linked Role Click Create Service-linked Role and the system automatically creates the service-linked role AliyunServiceRoleForVpn.

    For more information about how a VPN gateway assumes the role to access other cloud resources, see AliyunServiceRoleForVpn.

    If Created is displayed, the service-linked role is created and you do not need to create it again.

    For more information, see Create a VPN gateway.
  5. Return to the VPN Gateways page to view the VPN gateway.
    After you create a VPN gateway, it is in the Preparing state. After 1 to 5 minutes, the VPN gateway changes to the Normal state. After the VPN gateway changes to the Normal state, the VPN gateway is ready for use.
  6. Repeat Substep 2 to Substep 4 of Step 1 to create a VPN gateway named VPN Gateway 2 in the China (Qingdao) region. Specify VPC 2 for the VPC parameter. Specify the same values as VPN Gateway 1 for the other parameters.
    The following table describes the information about the VPN gateways that are created in this example.
    Region VPN gateway name VPC name VPN gateway ID VPN gateway IP address
    China (Hangzhou) VPN Gateway 1 VPC1 vpn-bp1l5zihic47jprwa**** 120.XX.XX.40
    China (Qingdao) VPN Gateway 2 VPC2 vpn-m5eqjnr4ii6jajpms**** 118.XX.XX.20

Step 2: Create a customer gateway

  1. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.
  2. In the top navigation bar, select the region where you want to create the customer gateway.
    Note Make sure that the customer gateway and the VPN gateway to be connected are deployed in the same region.
  3. On the User Gateway page, click Create Customer Gateway.
  4. In the Create Customer Gateway panel, set the following parameters and click OK.
    You must create a customer gateway in the China (Hangzhou) region and the China (Qingdao) region. The following table describes the parameters of the customer gateways.
    Parameter Description China (Hangzhou) China (Qingdao)
    Name Enter a name for the customer gateway. Customer1 Customer2
    IP Address Enter the public IP address of the customer gateway. In this example, the IP address of VPN Gateway 2, 118.XX.XX.XX. 20, is entered
    Note In this example, VPN Gateway 1 is the customer gateway of VPC 2, and VPN Gateway 2 is the customer gateway of VPC 1.
    		In this example, the IP address of VPN Gateway 1, 120.XX.XX.40, is entered

    For more information, see Create a customer gateway.

    The following table describes the information about the VPN gateway, customer gateway, and VPC in each region.
    Region VPC name VPN gateway name Customer gateway name Customer gateway ID Customer gateway IP address
    China (Hangzhou) VPC1 VPN Gateway 1 Customer1 cgw-bp1er5cw26c2b35vm**** 118.XX.XX.20
    China (Qingdao) VPC2 VPN Gateway 2 Customer2 cgw-m5e6qdvuxquse3fvm**** 120.XX.XX.40

Step 3: Create an IPsec-VPN connection

After you create the VPN gateways and customer gateways, you can create IPsec-VPN connections to connect the VPN gateways to the customer gateways.

  1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
  2. In the top navigation bar, select the region of the IPsec-VPN connection.
  3. On the IPsec Connections page, click Create IPsec Connection.
  4. On the Create IPsec Connection page, set the following parameters for the IPsec-VPN connection, and click OK.
    You must create an IPsec-VPN connection in the China (Hangzhou) region and another IPsec-VPN connection in the China (Qingdao) region. The following table describes the parameters of the IPsec-VPN connections.
    Item Description China (Hangzhou) China (Qingdao)
    Name Enter a name for the IPsec-VPN connection. IPsec-VPN Connection 1 IPsec-VPN Connection 2
    VPN Gateway Select the VPN gateway that you created. VPN Gateway 1 VPN Gateway 2
    Customer Gateway Select the customer gateway that you created. Customer1 Customer2
    Routing Mode Select a routing mode. Select Destination Routing Mode. Select Destination Routing Mode.
    Effective Immediately Specify whether to immediately start negotiations for the connection.
    • Yes: starts negotiations after the configuration is completed.
    • No: starts negotiations when traffic is detected.
    		No is selected in this example. No is selected in this example.
    Pre-Shared Key Enter a pre-shared key.

    If you do not specify a key, the system generates a random 16-character string as the pre-shared key.

    		fddsFF123****
    Important The IPsec-VPN connections must use the same pre-shared key.

    Use the default settings for the other parameters. For more information, see Create and manage IPsec-VPN connections.

  5. In the Established dialog box, click OK.

Step 4: Configure routes

  1. In the left-side navigation pane, choose Interconnections > VPN > VPN Gateways.
  2. In the top navigation bar, select the region of the VPN gateway.
  3. On the VPN Gateway page, find the VPN gateway that you want to manage and click its ID.
  4. On the Destination-based Routing tab, click Add Route Entry.
  5. In the Add Route Entry panel, set the following parameters and click OK.
    You must add a route to VPN Gateway 1 and VPN Gateway 2. The following table describes the parameters of routes.
    Parameter Description VPN Gateway 1 VPN Gateway 2
    Destination CIDR Block Enter the destination CIDR block to be connected. Enter 10.0.0.0/16, which is the private CIDR block of VPC 2. Enter 192.168.0.0/16, which is the private CIDR block of VPC 1.
    Next Hop Type Select the next hop type. In this example, IPsec Connection is selected. In this example, IPsec Connection is selected.
    Next Hop Select the next hop. Select IPsec-VPN Connection 1. Select IPsec-VPN Connection 2.
    Publish to VPC Specify whether to advertise the route to the VPC that is associated with the VPN gateway. Yes is selected in this example. Yes is selected in this example.
    Weight Specify a weight for the route.
    • 100: specifies a high priority for the route.
    • 0: specifies a low priority for the route.
    		The default value 100 is used in this example. The default value 100 is used in this example.
    For more information, see Create a destination-based route.

Step 5: Test network connectivity

  1. Log on to ECS 1 in VPC 1.
    For more information about how to log on to an ECS instance, see Methods used to connect to ECS instances.
  2. Run the ping command to ping the IP address of ECS 2 to test network connectivity. 
    ping <IP address of ECS 2>

    If you can receive echo reply packets as shown in the following figure, the connection is established.

    Test network connectivity between the VPCs