VPN Gateway:Diagnose a VPN gateway

Category

Diagnostic item

Description

Configurations

Instance configurations

Checks whether a VPN gateway is being configured.

If the VPN gateway is being configured, wait until the VPN gateway enters the Active state before you perform an operation on the VPN gateway.

Version

Checks whether the VPN gateway is of the latest version.

We recommend that you upgrade your VPN gateway to the latest version. For more information, see Upgrade a VPN gateway.

IPsec negotiations

Checks the status of Phase 1 and Phase 2 negotiations for each IPsec-VPN connection on the VPN gateway.

If an exception occurs during the negotiations, see the solution displayed in the console or relevant topics for troubleshooting. For more information, see Troubleshoot IPsec-VPN connection issues.

VPN tunnel configurations

Checks whether the IPsec-VPN connections or SSL server that is used to create SSL-VPN connections are configured on the VPN gateway.

If required parameters are not configured, configure the parameters based on your network communication requirements.

• For more information about how to configure IPsec-VPN connections, see Create and manage IPsec-VPN connections in single-tunnel mode.

• For more information about how to configure an SSL server, see Create an SSL server.

CIDR block conflicts

Checks whether the destination CIDR blocks of the policy-based routes, destination-based routes, and Border Gateway Protocol (BGP) routes on the VPN gateway conflict with 100.64.0.0/10.

100.64.0.0/10 is reserved by Alibaba Cloud. Make sure that the destination CIDR blocks of the policy-based routes, destination-based routes, and BGP routes on the VPN gateway do not conflict with 100.64.0.0/10 or its subnets. Otherwise, the VPN gateway cannot work as expected.

If such conflicts exist, modify the conflicted CIDR blocks or use NAT Gateway for address translation. For more information, see Use a VPC NAT gateway and a VPN gateway to connect a data center and a VPC.

Unreliable SSL connections

Checks whether unreliable SSL-VPN connections exist on the VPN gateway.

If unreliable SSL-VPN connections that use the UDP protocol exist on an SSL server, we recommend that you set the Protocol parameter of the SSL server to TCP to resolve this issue. The TCP protocol is more reliable than the UDP protocol. For more information, see Modify an SSL server.

CIDR block conflicts within a virtual private cloud (VPC)

Checks whether the Local Network and Client CIDR Block configured for an SSL server conflict with the CIDR block of a vSwitch in the VPC.

If such conflicts exist, we recommend that you modify the CIDR block of the SSL server. For more information, see Modify an SSL server.

Insufficient IP addresses

Checks whether the Client CIDR Block configured for an SSL server contains sufficient IP addresses to meet the requirements of SSL-VPN connections.

If the IP addresses are insufficient, modify the client CIDR block. For more information, see Modify an SSL server.

Make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the VPN gateway.

For example, if you specify 192.168.0.0/24 as the client CIDR block, the system first divides a subnet CIDR block with a subnet mask of 30 from 192.168.0.0/24, such as 192.168.0.4/30. This subnet provides up to four IP addresses. Then, the system allocates an IP address from 192.168.0.4/30 to the client and uses the other three IP addresses to ensure network communication. In this case, one client consumes four IP addresses. Therefore, to ensure that an IP address can be allocated to your client, you must make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the associated VPN gateway.

Public CIDR block conflicts

Checks whether the public CIDR block that is configured as the Client CIDR Block of an SSL server is specified as the user CIDR block of the VPC.

If the client CIDR block of the SSL server is a public CIDR block, you must specify the public CIDR block as the user CIDR block of the VPC. For more information, see the What is a user CIDR block? and How do I configure a user CIDR block? sections of the "FAQ" topic.

BGP consistency

Checks whether Phase 2 negotiations succeed but BGP negotiations failed.

If Phase 2 negotiations succeed but BGP negotiations fail, check the BGP configurations and transmission of BGP packets. For more information, see the "What do I do if the system prompts that Phase 2 negotiations succeeded but the BGP negotiation is in the Abnormal state?" section of the FAQ about IPsec-VPN connections topic.

Shared Phase 1 IPsec negotiations

Checks whether the configurations of multiple IPsec-VPN connections are the same if the IPsec-VPN connections share Phase 1 negotiations.

If multiple IPsec-VPN connections are associated with the same VPN gateway and customer gateway, and use the same Internet Key Exchange (IKE) version, the IPsec-VPN connections share the same Phase 1 negotiation. In scenarios in which multiple IPsec-VPN connections share the same Phase 1 negotiation, the IPsec-VPN connections must have the same Pre-Shared Key and IKE settings, including the version, negotiation mode, encryption algorithm, authentication algorithm, DH group, and SA lifetime (in seconds). This ensures that the IKE settings of each IPsec-VPN connection can be shared during IPsec negotiations.

Modify the IPsec-VPN connection configurations based on your business requirements to ensure that the IPsec-VPN connections use the same configurations. For more information, see the "Modify an IPsec-VPN connection" section of the Create and manage IPsec-VPN connections in single-tunnel mode topic.

Quotas

VPN gateway bandwidth usage

Checks whether the bandwidth usage of the VPN gateway reaches 80% of the upper limit.

VPN connections

Checks whether the number of SSL-VPN connections on the VPN gateway reaches 80% of the upper limit.

If the number of SSL-VPN connections on the VPN gateway reaches 80% of the upper limit, you can request a quota increase based on your network requirements. For more information, see Modify the maximum number of concurrent SSL connections.

Certificates

SSL client certificate expiration

Checks whether the SSL client certificate has expired.

The default validity period of an SSL client certificate is three years. If the SSL client certificate has expired, delete the SSL client certificate, create a new SSL client certificate, and then install the new certificate on the client. For more information, see Create an SSL client certificate and the "Step 4: Configure the client" section of the Connect a client to a VPC topic.

SSL client certificate pre-expiration

Checks whether the SSL client certificate expires within 60 days.

If the SSL client certificate expires within 60 days, we recommend that you delete it and create a new SSL client certificate. Then, install the new certificate on the client. For more information, see Create an SSL client certificate and the "Step 4: Configure the client" section of the Connect a client to a VPC topic.

Fees

Overdue payments

Checks whether the VPN gateway has overdue payments.

If the VPN gateway has overdue payments, add funds to your account.

Overdue payment alert

Checks whether the VPN gateway expires within seven days.

Routes

Unadvertised routes

Checks whether the VPN gateway has unadvertised policy-based or destination-based routes.

If unadvertised policy-based or destination-based routes exist, delete or advertise the routes based on your network communication requirements. For more information, see the Advertise a policy-based route and Delete a policy-based route sections in the "Manage policy-based routes" topic or the Advertise a destination-based route and Delete a destination-based route sections in the "Manage destination-based routes" topic.

Improper BGP configurations

Checks whether the VPN gateway uses proper BGP configurations if an IPsec-VPN connection uses BGP.

• If an IPsec-VPN connection uses BGP, we recommend that you do not configure policy-based or destination-based routes. We recommend that you use BGP for networking.

• If an IPsec-VPN connection uses BGP, we recommend that you disable the health check feature.

• If an IPsec-VPN connection uses BGP, we recommend that you set the Routing Mode parameter of the IPsec-VPN connection to Destination Routing Mode.

VPN route configurations

• Checks whether required route configurations are missing for the VPN gateway when you use an IPsec-VPN connection.

  For more information about how to add destination-based routes, policy-based routes, or BGP configurations for the VPN gateway, see Manage policy-based routes, Manage destination-based routes, or Create and manage IPsec-VPN connections in single-tunnel mode.

• Checks whether automatic BGP route propagation is enabled for the VPN gateway if an IPsec-VPN connection uses BGP.

  For more information, see the "Step 2: Enable BGP dynamic routing" section of the Connect a VPC to a data center by using an IPsec-VPN connection in single-tunnel mode and enable BGP routing topic.

Destination-based route conflicts

Checks whether the destination CIDR blocks of destination-based routes on the VPN gateway overlap with each other.

If such conflicts exist, delete the conflicted destination-based routes and create new ones. Make sure that the destination CIDR blocks of destination-based routes do not overlap with each other. For more information, see Manage destination-based routes.

You can also use BGP for networking. For more information, see Connect a VPC to a data center by using an IPsec-VPN connection in single-tunnel mode and enable BGP routing.

Policy-based route conflicts

Checks whether the destination CIDR blocks of policy-based routes on the VPN gateway overlap with each other.

If such conflicts exist, delete the conflicted policy-based routes and create new ones. Make sure that the destination CIDR blocks of policy-based routes do not overlap with each other. For more information, see Manage policy-based routes.

You can also use BGP for networking. For more information, see Connect a VPC to a data center by using an IPsec-VPN connection in single-tunnel mode and enable BGP routing.

BGP route conflicts

• Checks whether the destination CIDR blocks of BGP routes overlap with each other.

• Checks whether the destination CIDR blocks of BGP routes and destination-based routes overlap.

• Checks whether the destination CIDR blocks of BGP routes and policy-based routes overlap.

If such conflicts exist, troubleshoot the issues by following the on-screen instructions displayed in the console.

Match between VPC routes and VPN routes

Checks whether the destination CIDR block of the route in a VPC route table that points to the VPN gateway overlaps with the destination CIDR block of the policy-based route on the VPN gateway.

Make sure that the destination CIDR block of the policy-based route contains the destination CIDR block of the route in the VPC route table that points to the VPN gateway.

If the preceding condition is not met, you need to modify the destination CIDR block of the policy-based route. You must delete the policy-based route and create a new one that meets the condition. For more information, see Manage policy-based routes.