VPN Gateway:Dual-tunnel mode with BGP

Prerequisites

• At least one public IP address assigned to the on-premises gateway device. Two public IP addresses are recommended -- either on one device or across two separate devices -- to support high availability.

• The on-premises gateway device supports the IKEv1 or IKEv2 protocol.

• The on-premises gateway device supports BGP dynamic routing.

• The CIDR block of the data center does not overlap with the CIDR block of the VPC.

Before you begin

Before you begin, make sure that you have:

• A VPC in the target region with workloads deployed on Elastic Compute Service (ECS) instances. For instructions, see VPCs and vSwitches

• Security group rules on the ECS instances and access control rules on the data center devices configured to allow traffic between the VPC and data center. For details, see Use security groups and Use security groups.

Example

An enterprise has a VPC in the China (Hohhot) region with a primary CIDR block of 192.168.0.0/16. The enterprise also has a data center in Hohhot with a CIDR block of 172.16.0.0/16. Devices in the data center need to access the VPC over an encrypted connection with high availability.

Network planning

Gather the following information before starting configuration. All IP addresses, autonomous system numbers (ASNs), and CIDR blocks in this section are used throughout the procedure.

Procedure

Step 1: Create a VPN gateway

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where the VPC is deployed. The VPN gateway must be in the same region as the VPC.

3. On the VPN Gateway page, click Create VPN Gateway.

4. On the buy page, configure the following parameters, click Buy Now, and complete the payment.

   Note

   • The system selects a default vSwitch. You can change the selection or keep the default.

   • After a VPN gateway is created, you cannot modify the associated vSwitches. View the vSwitch, zone, and ENI details on the VPN gateway details page.

   Parameter	Description	Example value
   Name	Enter a name for the VPN gateway.	VPNGW
   Resource Group	Select a resource group. If left blank, the VPN gateway belongs to the default resource group.	Default resource group
   Region	Select the region for the VPN gateway.	China (Hohhot)
   Gateway Type	Select a gateway type.	Standard
   Network Type	Select a network type. Public: establishes VPN connections over the internet. Private: establishes VPN connections over private networks.	Public
   Tunnels	Select a tunnel mode. Valid values: Dual-tunnel, Single-tunnel. For details, see Associate an IPsec-VPN connection with a VPN gateway.	Dual-tunnel (default)
   VPC	Select the VPC to associate with the VPN gateway.	VPC in China (Hohhot)
   VSwitch	Select a vSwitch from the VPC. For dual-tunnel mode, specify two vSwitches. The system creates an elastic network interface (ENI) in each vSwitch. Each ENI occupies one IP address in the vSwitch.	A vSwitch in the VPC
   vSwitch 2	Select a second vSwitch. Use vSwitches in different zones for cross-zone disaster recovery. In single-zone regions, select two vSwitches in the same zone, or select the same vSwitch as the first.	Another vSwitch in the VPC
   Peak Bandwidth	Select the maximum bandwidth (Mbit/s).	Default value
   Traffic	Select a metering method. Default: Pay-by-data-transfer. For details, see Billing overview.	Pay-by-data-transfer
   IPsec-VPN	Enable or disable IPsec-VPN. Default: Enable.	Enable
   SSL-VPN	Enable or disable SSL-VPN. Default: Disable.	Disable
   Duration	Select a billing cycle. Default: By Hour.	By Hour
   Service-linked Role	Click Create Service-linked Role. The system creates the AliyunServiceRoleForVpn role, which allows the VPN gateway to access other cloud resources. If Created is displayed, the role already exists.	As needed

5. On the VPN Gateway page, verify that the VPN gateway is created. The gateway starts in the Preparing state and transitions to Normal within 1 to 5 minutes. After the state changes to Normal, the gateway is ready. A public VPN gateway receives two public IP addresses -- one for each tunnel:

   Tunnel	IP address
   Tunnel 1 (active)	39.XX.XX.218
   Tunnel 2 (standby)	182.XX.XX.19

Step 2: Create customer gateways

Create two customer gateways -- one for each encrypted tunnel.

1. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

2. In the top navigation bar, select the same region as the VPN gateway. The customer gateway and VPN gateway must be in the same region.

3. On the Customer Gateways page, click Create Customer Gateway.

4. In the Create Customer Gateway panel, configure the following parameters and click OK. Repeat this step to create two customer gateways. For full parameter descriptions, see Customer gateway.

   Parameter	Customer gateway 1	Customer gateway 2
   Name	CustomerGW1	CustomerGW2
   IP Address	211.XX.XX.36	211.XX.XX.71
   ASN	65500	65500

Step 3: Create an IPsec-VPN connection

1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

2. On the IPsec Connections page, click Bind VPN Gateway.

3. On the Create Ipsec-vpn Connection (VPN) page, configure the following parameters and click OK. Tunnel 1 (active tunnel) By default, Tunnel 1 is the active tunnel and Tunnel 2 is the standby tunnel. You cannot change this assignment. Tags: Optionally add tags to the IPsec-VPN connection.

   Note

   If BGP is used, we recommend that you set Routing Mode to Destination Routing Mode.

   Important

   - The pre-shared key must match on both the IPsec-VPN connection and the on-premises gateway device. Mismatched keys prevent the tunnel from being established. - Each tunnel on a VPN gateway must use a unique tunnel CIDR block. - The tunnel CIDR block cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, 169.254.6.0/30, or 169.254.169.252/30. - Match the encryption parameters to your on-premises gateway device. The IKE and IPsec configurations must be identical on both sides.

   Basic settings

   Parameter	Description	Example value
   Name	Enter a name for the IPsec-VPN connection.	IPsec-Connection
   Region	Select the region of the VPN gateway. The IPsec-VPN connection is created in the same region.	China (Hohhot)
   Resource Group	The resource group of the VPN gateway.	Default resource group
   Bind VPN Gateway	Select the VPN gateway.	VPNGW
   Routing Mode	Select a routing mode. Destination Routing Mode: forwards traffic based on destination IP. Protected Data Flows: forwards traffic based on source and destination IP.	Destination Routing Mode
   Effective Immediately	Yes: starts negotiation immediately. No: starts negotiation when inbound traffic is detected.	Yes
   Enable BGP	Turn on to enable BGP dynamic routing for this connection. Disabled by default.	Enabled
   Local ASN	The ASN on the VPC side. Default: 45104. Valid range: 1 to 4294967295.	65530

   Parameter	Description	Example value
   Customer Gateway	Select the customer gateway for the active tunnel.	CustomerGW1
   Pre-Shared Key	Enter a pre-shared key for identity verification. Must be 1 to 100 characters. Allowed characters: digits, letters (upper and lowercase), and ~!@#$%^&*()_-+={}[]|;:',.<>/? . Spaces are not allowed. If omitted, the system generates a 16-character key. After the IPsec-VPN connection is created, you can click Edit for the tunnel to view the system-generated key. For more information, see IPsec-VPN connections (VPN Gateway).	**fddsFF123\*\*\*\*\*\***
   Encryption Configuration	Configure IKE, IPsec, Dead Peer Detection (DPD), and NAT traversal parameters. For full details, see Create and manage an IPsec-VPN connection in dual-tunnel mode.	Set DH Group to group14 in both the IKE Configurations and IPsec Configurations sections. Use defaults for other parameters.
   Tunnel CIDR Block	The CIDR block for the BGP session on the active tunnel. Must fall within 169.254.0.0/16 with a /30 subnet mask.	169.254.10.0/30
   Local BGP IP address	The BGP IP address within the tunnel CIDR block.	169.254.10.1

   Tunnel 2 (standby tunnel)

   Parameter	Description	Example value
   Customer Gateway	Select the customer gateway for the standby tunnel.	CustomerGW2
   Pre-Shared Key	Enter a pre-shared key for the standby tunnel.	**fddsFF456\*\*\*\*\*\***
   Encryption Configuration	Same as Tunnel 1.	Set DH Group to group14 in both the IKE Configurations and IPsec Configurations sections. Use defaults for other parameters.
   Tunnel CIDR Block	The CIDR block for the BGP session on the standby tunnel.	169.254.20.0/30
   Local BGP IP address	The BGP IP address within the tunnel CIDR block.	169.254.20.1

4. In the Created message, click Cancel.

5. On the IPsec Connections page, find the IPsec-VPN connection and click Generate Peer Configuration in the Actions column. The peer configuration contains the VPN settings you need to apply to the on-premises gateway devices.

6. In the IPsec-VPN Connection Configuration dialog box, copy and save the configuration to a local machine. You will use this information in Step 5.

Step 4: Enable BGP dynamic routing

Enable automatic route advertisement so the VPN gateway can learn routes from the data center and advertise them to the VPC.

1. In the left-side navigation pane, choose Cross-network Interconnection > VPN > VPN Gateways.

2. In the top navigation bar, select the region of the VPN gateway.

3. On the VPN Gateways page, find the VPN gateway and turn on the Enable Automatic Route Advertisement switch.

Step 5: Configure the on-premises gateway devices

Add VPN, IPsec, and BGP configurations to the on-premises gateway devices so they can connect to the IPsec-VPN connection. Traffic flows through the active tunnel by default. If the active tunnel fails, the standby tunnel takes over automatically.

Step 6: Test network connectivity