All Products
Search

This Product

    VPN Gateway:IPsec connection (VPN Gateway)

    Document Center

    VPN Gateway:IPsec connection (VPN Gateway)

    Last Updated:May 13, 2026

    After you create a VPN Gateway, you must configure an IPsec-VPN connection on Alibaba Cloud and in your on-premises data center to connect the data center to your VPC.

    How it works

    By default, Alibaba Cloud IPsec-VPN connections use dual-tunnel mode (an active tunnel and a standby tunnel) to provide link redundancy and ensure high availability.

    • Active tunnel (IPsec address 1): Carries all service traffic.

    • Standby tunnel (IPsec address 2): Remains on standby and automatically takes over if the active tunnel fails.

    • Fixed roles: The active and standby roles cannot be changed.

    • Health check: The system automatically checks the connectivity of the active tunnel, fails over when a fault is detected, and fails back after the tunnel recovers.

    • Availability zone disaster recovery: The two tunnels are deployed in different zones by default to provide cross-zone disaster recovery. For regions that support only one zone, both tunnels are deployed in the same zone. These deployments do not support zone-level disaster recovery but still provide link redundancy.

      Legacy single-tunnel VPN Gateways can create only single-tunnel IPsec-VPN connections. We strongly recommend that you upgrade to dual-tunnel mode.

    Create an IPsec-VPN connection

    Before you create an IPsec-VPN connection, ensure you have created a VPN Gateway and a customer gateway.

    Enhanced VPN gateway (console)

    Go to the IPsec Connections page in the VPN Gateway console, click Bind VPN Gateway, and then configure the following parameters:

    • Name: Enter a descriptive name, for example, dev-dc01-backup (environment-peer_identifier-purpose).

    • Region: Select the region where the VPN Gateway is deployed.

    • Gateway Type: Select Enhanced IPsec-VPN.

    • Billing: By default, BGP (Multi-ISP) lines are used, and billing is based on CDT. You receive a monthly free quota of 220 GB (20 GB/month in Chinese mainland regions and 200 GB/month in regions outside the Chinese mainland).

    • Bind VPN Gateway: Select the target VPN Gateway.

    • Routing Mode:

      • Destination Routing Mode (Default): Forwards traffic based on the destination IP address. This mode is suitable for simple scenarios.

      • Protected Data Flows: Forwards traffic based on both the source and destination IP addresses. The VPN tunnel transmits only traffic that matches the specified flows.

        If you select this mode, you must configure the Local Network (CIDR blocks in the VPC that need to communicate) and the Remote Network (CIDR blocks in the on-premises data center that need to communicate).

        After an IPsec connection is configured, the system automatically generates a destination route. The Destination CIDR Block of this route is the Remote Network of the IPsec connection, and the next hop points to the IPsec connection. This route can be published to a VPC route table, but is not published by default.

        • When you configure protected data flows on your on-premises gateway device, make sure the CIDR blocks are consistent with the settings on the Alibaba Cloud side, but with the local and remote networks swapped.

        • You can add multiple CIDR blocks by clicking the 添加 icon. If you configure multiple CIDR blocks, you must set the IKE version to IKEv2.

    • Effective Immediately: Select Yes for immediate activation or to prevent traffic delays. Select No to conserve resources if traffic is infrequent.

    • BGP Configuration: See Enable or disable BGP.

    • Tunnel Configuration: See Tunnel and encryption configuration for details on configuring parameters for Tunnel 1 (Primary) and Tunnel 1 (Backup).

    Traditional VPN gateway (console)

    Go to the IPsec Connections page in the VPN Gateway console, click Bind VPN Gateway, and then configure the following parameters:

    • Name: Enter a descriptive name, for example, dev-dc01-backup (environment-peer_identifier-purpose).

    • Region: Select the region where the VPN Gateway is deployed.

    • Gateway Type: Select Standard VPN Gateway.

    • Bind VPN Gateway: Select the target VPN Gateway.

    • Routing Mode:

      • Destination Routing Mode (Default): Forwards traffic based on the destination IP address. This mode is suitable for simple scenarios.

      • Protected Data Flows: Forwards traffic based on both the source and destination IP addresses. The VPN tunnel transmits only traffic that matches the specified flows.

        If you select this mode, you must configure the Local Network (CIDR blocks in the VPC that need to communicate) and the Remote Network (CIDR blocks in the on-premises data center that need to communicate).

        After an IPsec connection is configured, the system automatically generates a policy-based route: the Source CIDR Block is the Local Network of the IPsec connection, the Destination CIDR Block is the Remote Network of the IPsec connection, and the next hop points to the IPsec connection. This route can be optionally published to a VPC route table, but is not published by default.

        • When you configure protected data flows on your on-premises gateway device, make sure the CIDR blocks are consistent with the settings on the Alibaba Cloud side, but with the local and remote networks swapped.

        • You can add multiple CIDR blocks by clicking the 添加 icon. If you configure multiple CIDR blocks, you must set the IKE version to IKEv2.

    • Effective Immediately: Select Yes for immediate activation or to prevent traffic delays. Select No to conserve resources if traffic is infrequent.

    • BGP Configuration: See Enable or disable BGP.

    • Tunnel Configuration: See Tunnel and encryption configuration for details on configuring parameters for Tunnel 1 (Primary) and Tunnel 1 (Backup).

    API

    Call the CreateVpnConnection operation to create an IPsec-VPN connection.

    Next steps

    To enable communication between your VPC and on-premises data center, complete the following steps after creating the IPsec-VPN connection:

    1. Configure routes.

    2. Configure your on-premises gateway device: Use the peer configuration that you downloaded to complete the IPsec and BGP (if enabled) configurations on your on-premises gateway device, such as a firewall or router.

    Enable or disable BGP

    Before you enable BGP for an IPsec-VPN connection, ensure that an Autonomous System Number (ASN) for your on-premises network is configured in the associated customer gateway.

    The following are BGP parameters for an IPsec-VPN connection:

    • Local ASN: The ASN for the Alibaba Cloud side after BGP is enabled. Both tunnels use the same ASN. Default value: 45104. Value range: 1 to 4294967295. We recommend using a private ASN when you configure the ASN for your on-premises device.

    • Tunnel CIDR Block: The interconnect address segment used for BGP peering. Each tunnel on a VPN Gateway must have a unique CIDR block. It must be a /30 subnet within 169.254.0.0/16 and cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, or 169.254.169.252/30.

    • Local BGP IP address: The BGP IP address for the Alibaba Cloud side, which must belong to the tunnel CIDR block. For example, if the CIDR block is 169.254.10.0/30, you can use 169.254.10.1.

    For information about BGP feature support, route advertisement principles, and limitations, see BGP routing for VPN Gateways.

    Console

    Enable BGP

    • When you create an IPsec-VPN connection, you can enable BGP Configuration and configure the Local ASN, Tunnel CIDR Block, and Local BGP IP address to enable the BGP feature.

    • For an existing IPsec-VPN connection, go to the instance details page and modify the BGP Configuration in the IPsec Connections section.

      Make sure that an ASN is configured for the customer gateway. Otherwise, you must delete and recreate the customer gateway and the IPsec-VPN connection.

    Disable BGP

    On the IPsec-VPN connection details page, disable BGP Configuration in the IPsec Connections section.

    API

    • When you create a new IPsec-VPN connection, set the EnableTunnelsBgp parameter of the CreateVpnConnection operation to enable BGP, and configure BGP options for each tunnel by setting the TunnelOptionsSpecification -> TunnelBgpConfig parameter.

    • For an existing IPsec-VPN connection, set the EnableTunnelsBgp parameter of the ModifyVpnConnectionAttribute operation to enable or disable BGP, and configure BGP options for each tunnel by setting the TunnelOptionsSpecification -> TunnelBgpConfig parameter.

    Tunnel and encryption

    Each tunnel configuration has three parts:

    1. Basic Settings:

      • Customer Gateway: Select the customer gateway that represents your on-premises gateway device. Both tunnels can be associated with the same customer gateway.

      • Pre-Shared Key: The key used for identity authentication. The keys for both tunnels must exactly match the configuration on your on-premises gateway device. If you leave this blank, the system automatically generates a random key.

    2. Encryption Configuration:

      • Enhanced IPsec-VPN: Supports a multi-algorithm compatibility mode. The system selects multiple encryption configurations by default and automatically negotiates an algorithm with the on-premises gateway device if it also supports multi-algorithm compatibility.

      • Traditional VPN Gateway: You must specify a single algorithm configuration that matches the algorithms supported by your on-premises gateway device.

      Parameter

      Description

      IKE Configurations

      Version

      We recommend IKEv2. IKEv2 simplifies the SA negotiation process and provides better support for scenarios with multiple CIDR blocks.

      Negotiation Mode

      main (Default): Main mode. This mode encrypts identity information during negotiation, making it more secure than aggressive mode.

      aggressive: Aggressive mode. This mode negotiates faster and has a higher success rate.

      Both modes provide the same level of security for data transmission after successful negotiation.

      Encryption Algorithm

      The encryption algorithm used for Phase 1 negotiation.

      • Enhanced IPsec-VPN: Supports AES128, AES128-GCM-16, AES192, AES256, AES256-GCM-16, DES, and 3DES.

        • Recommended: AES128-GCM-16 and AES256-GCM-16 for higher performance and security.

        • Not recommended: DES, 3DES.

      • Traditional VPN Gateway:

        • Compared to Enhanced IPsec-VPN, AES128-GCM-16 and AES256-GCM-16 are not supported.

        • For instances with a bandwidth of 200 Mbps or higher, we recommend using the AES128, AES192, or AES256 encryption algorithm. We do not recommend using the 3DES encryption algorithm.

          • AES is a symmetric-key encryption algorithm that provides high-strength encryption and decryption with minimal impact on network latency, throughput, and forwarding performance.

          • 3DES is the Triple Data Encryption Algorithm. It is computationally intensive and has a longer encryption time, which reduces forwarding performance compared to AES.

      Authentication Algorithm

      The authentication algorithm used for Phase 1 negotiation.

      Supported algorithms: sha1 (default), md5, sha256, sha384, and sha512.

      When you add a VPN configuration on some on-premises gateway devices, you may need to specify a PRF algorithm. The PRF algorithm must be the same as the IKE phase authentication algorithm.

      DH Group (Perfect Forward Secrecy)

      The Diffie-Hellman key exchange algorithm for Phase 1 negotiation.

      • disabled: Does not use a DH key exchange algorithm.

        • Select disabled for clients that do not support PFS.

        • If you select any group other than disabled, Perfect Forward Secrecy (PFS) is enabled by default. This requires the key to be updated during each renegotiation, so the corresponding client must also have PFS enabled.

      • group1-group24: A higher DH group number provides greater security but has a greater performance cost. Confirm which DH groups your peer VPN device supports, and then prioritize ECDH groups (Group 19, 20, 21) from the list of commonly supported groups.

        Traditional VPN Gateways support only group1, group2, group5, and group14.

      SA Life Cycle (seconds)

      The lifetime of the Phase 1 Security Association (SA). Default: 86400. Range: 0 to 86400.

      LocalId

      The identifier for the local end of the tunnel. By default, the tunnel's IP address is used.

      This parameter serves only as an identifier for the Alibaba Cloud side during IPsec-VPN connection negotiation. It can be an IP address or a Fully Qualified Domain Name (FQDN) and must not contain spaces. We recommend using a private IP address as the local identifier.

      If you use an FQDN for LocalId, such as example.aliyun.com, the peer ID on the on-premises gateway device must match the LocalId value, and we recommend setting the negotiation mode to aggressive.

      RemoteId

      The identifier for the remote end of the tunnel. By default, the IP address of the associated customer gateway is used.

      This parameter serves only as an identifier for the on-premises gateway device during IPsec-VPN connection negotiation. It can be an IP address or an FQDN (Fully Qualified Domain Name) and must not contain spaces. We recommend using a private IP address as the remote identifier.

      If you use an FQDN for RemoteId, such as example.aliyun.com, the local ID on the on-premises gateway device must match the RemoteId value, and we recommend setting the negotiation mode to aggressive.

      IPsec Configurations

      Encryption Algorithm

      Configure the settings for Phase 2 negotiation. You can refer to the corresponding options in the Phase 1 IKE Configurations for descriptions.

      Authentication Algorithm

      DH Group (Perfect Forward Secrecy)

      SA Life Cycle (seconds)

      DPD

      DPD (Dead Peer Detection). We recommend that you always enable this feature (default). It promptly detects peer failures and triggers failovers, which is key to ensuring high availability.

      After DPD is enabled, the IPsec-VPN connection sends DPD packets to check if the peer device is active. If no valid response is received within a specified time, the peer is considered disconnected. The system deletes the ISAKMP SA and corresponding IPsec SA, and also removes the security tunnel. After a DPD timeout, the IPsec-VPN connection automatically re-initiates tunnel negotiation. The DPD packet timeout period is 30 seconds.

      For some existing VPN Gateway instances that use IKEv2 for IPsec-VPN connections, the DPD timeout period might be 130 seconds or 3600 seconds. In this case, you can upgrade the VPN Gateway instance to the latest version.

      NAT Traversal

      We recommend that you keep this feature enabled (default). When enabled, the IKE negotiation process skips UDP port number verification and can detect NAT gateway devices in the encrypted communication channel.

    3. BGP Configuration: This option is available only after BGP is enabled. For more information, see Enable or disable BGP.

    Console

    • When you create an IPsec-VPN connection, you can configure tunnel-related parameters directly.

    • For an existing IPsec-VPN connection, click the Instance ID of the target IPsec-VPN connection to go to the details page. In the Actions column of the target tunnel, click Edit to modify the tunnel configuration.

    Important

    When you create a dual-tunnel mode IPsec-VPN connection, make sure that both tunnels are configured and available. If you configure or use only one tunnel, you cannot benefit from the active-standby link redundancy and zone-level disaster recovery capabilities of the IPsec-VPN connection.

    API

    Call the ModifyTunnelAttribute operation to modify a tunnel configuration.

    Modify an IPsec-VPN connection

    If an IPsec-VPN connection is already associated with a VPN Gateway instance, you cannot change the associated instance. You can only modify the Routing Mode and Effective Immediately settings of the IPsec-VPN connection.

    Console

    1. Go to the IPsec Connections page in the VPC console, switch to the target region, and click Edit in the Actions column of the target IPsec-VPN connection.

    2. On the Modify IPsec-VPN Connection page, modify settings such as the connection name and network segments, and then click OK.

      For detailed descriptions of the parameters, see Create an IPsec-VPN connection.

    API

    Call the ModifyVpnConnectionAttribute operation to modify the configuration of an IPsec-VPN connection.

    Delete an IPsec-VPN connection

    Console

    1. Go to the IPsec Connections page in the VPC console, switch to the target region, and click Delete in the Actions column of the target IPsec-VPN connection.

    2. In the dialog box that appears, confirm the information, and then click OK.

    API

    Call the DeleteVpnConnection operation to delete an IPsec-VPN connection.

    Billing

    FAQ

    Phase 1 negotiation failed

    If you have completed the IPsec configuration on both Alibaba Cloud and your on-premises data center, check for these common issues:

    1. Pre-shared key mismatch: Verify the pre-shared keys on both the Alibaba Cloud and on-premises gateways. They must be identical, including case and special characters.

    2. IKE parameter mismatch: Ensure all IKE parameters (Version, Negotiation Mode, Encryption Algorithm, Authentication Algorithm, DH Group) match exactly on both sides.

    3. Network connectivity: Confirm that the public IP address of your on-premises gateway is reachable. Ensure no firewall or ISP policies are blocking UDP ports 500 and 4500.

    Tunnel is up but no connectivity

    Successful tunnel negotiation only confirms that the encrypted channel is established. Data transmission depends on the following:

    1. Route configuration: Verify that the route tables in your Alibaba Cloud VPC and on-premises data center correctly direct traffic to the IPsec-VPN connection.

    2. Security groups and network ACLs: Ensure that the security group rules for your ECS instance allow ICMP or other service traffic from the on-premises network.

    3. On-premises firewall policy: Check whether your on-premises firewall allows traffic from the VPC CIDR block.

    Why can't I enable BGP?

    This occurs because the customer gateway that you associated with the IPsec-VPN connection does not have an Autonomous System Number (ASN) configured. You must delete the current IPsec-VPN connection, create a new customer gateway that has an ASN configured, and then use the new customer gateway to create the IPsec-VPN connection.

    Can Tunnel 2 be the active tunnel?

    No. Tunnel 1 (using VPN Gateway IP address 1) is fixed as the active tunnel, and Tunnel 2 (using VPN Gateway IP address 2) is fixed as the standby tunnel. These roles cannot be changed.

    Can I create a single-tunnel IPsec-VPN connection?

    Single-tunnel mode is a legacy feature. Newly created IPsec-VPN connections no longer support single-tunnel mode.

    For existing single-tunnel Traditional VPN Gateways, we strongly recommend that you upgrade the IPsec-VPN connection to dual-tunnel mode.

    The following steps describe how to create an IPsec-VPN connection for a legacy single-tunnel instance (not recommended):

    Creating an IPsec-VPN connection for a single-tunnel VPN Gateway instance

    1. Configure the IPsec connection

    Before you create an IPsec-VPN connection, ensure you have created a customer gateway.

    Console

    Go to the IPsec Connections page in the VPN Gateway console, click Bind VPN Gateway, and then configure the following parameters:

    IPsec Settings

    • Select the Region where the VPN Gateway is deployed and select the corresponding instance.

    • Routing Mode:

      • Destination Routing Mode (Default): Forwards traffic based on the destination IP address. This mode is suitable for scenarios where routes are learned dynamically through BGP or configured statically on the VPN Gateway. This mode is simple to configure.

      • Protected Data Flows: Forwards traffic based on source and destination IP addresses. This mode is suitable for complex network scenarios where you want to allow communication only between specific network segments. If you select this mode, you must configure the Local Network (CIDR blocks in the VPC that need to communicate) and the Remote Network (CIDR blocks in the on-premises data center that need to communicate).

        After an IPsec connection is configured, the system automatically generates a policy-based route: the Source CIDR Block is the Local Network of the IPsec connection, the Destination CIDR Block is the Remote Network of the IPsec connection, and the next hop points to the IPsec connection. You can optionally publish the route to a VPC route table (it is not published by default).

        • When you configure protected data flows on your on-premises gateway device, make sure the CIDR blocks are consistent with the settings on the Alibaba Cloud side, but with the local and remote networks swapped.

        • You can add multiple CIDR blocks by clicking the 添加 icon. If you configure multiple CIDR blocks, you must set the IKE version to IKEv2.

    • Effective Immediately: Select Yes for immediate activation or to prevent traffic delays. Select No to conserve resources if traffic is infrequent.

    Basic Settings

    • Customer Gateway: Select the customer gateway that represents your on-premises gateway device. Both tunnels can be associated with the same customer gateway.

    • Pre-Shared Key: The key used for identity authentication. The keys for both tunnels must exactly match the configuration on your on-premises gateway device. If you leave this blank, the system automatically generates a random key.

    • BGP Configuration: Determines whether to use BGP dynamic routing.

      • Disabled (Default): Uses static routing. This mode is suitable for simple network topologies.

      • Enabled: This mode is suitable for complex network topologies that require automatic route advertisement and learning. Prerequisite: An ASN must be configured for the associated customer gateway.

    • Local ASN: The ASN for the Alibaba Cloud side after BGP is enabled. The default value is 45104. The value can be an integer from 1 to 4294967295. We recommend using a private ASN when you configure the ASN for your on-premises device.

    • Encryption Configuration: See Tunnel and encryption configuration.

    • Health Check: This feature is disabled by default. For IPsec-VPN connections that are not in an active-standby configuration, we do not recommend configuring a health check. If you configure a health check, ensure the Destination IP Address supports ICMP replies and add a route entry in your on-premises data center. The destination of this route must be the Source IP Address with a 32-bit subnet mask, and the next hop must point to the IPsec-VPN connection to ensure that the health check feature works as expected.

    API

    Call the CreateVpnConnection operation to create an IPsec-VPN connection.

    2. Configure VPN gateway and VPC routes

    Configure the routes as described in Configure routes.

    3. Configure the on-premises gateway

    Complete the IPsec and BGP (if enabled) configurations on your on-premises gateway device based on the peer configuration that you downloaded. For detailed instructions, refer to your device's documentation. For an example, see Configure an on-premises gateway device.