IPsec-VPN establishes an encrypted tunnel between your on-premises network—such as a data center or office—and an Alibaba Cloud VPC, enabling both sides to communicate as if they were on the same private network.
Alibaba Cloud VPN Gateway provides services within the scope of China's relevant national policies and regulations, and only supports establishing non-cross-border connections. If you have cross-border requirements, please Transit Router.
Two binding modes
IPsec-VPN offers two connection methods. Choose one based on the number of VPCs you need to connect:
Bind to a VPN Gateway (connect a single VPC)
Bind the IPsec connection to a VPN gateway instance. This is applicable to scenarios where an on-premises data center and a single VPC communicate with each other.
How it works: On-premises gateway device ↔ IPsec-VPN tunnel ↔ VPN gateway ↔ VPC
Applicable scenarios:
Connect to a single VPC
Use SSL-VPN for remote access at the same time (standard VPN gateways only)
Bind to a Transit Router (connect multiple VPCs)
Bind the IPsec connection directly to a transit router of a Cloud Enterprise Network (CEN) instance. This is applicable to scenarios where an on-premises data center and multiple VPCs communicate with each other.
How it works: On-premises gateway device ↔ IPsec-VPN tunnel ↔ Transit Router ↔ Multiple VPCs
Use cases::
Connect to multiple VPCs in the same or different regions
ECMP load balancing is required for high availability
Require more than 1 Gbps bandwidth per connection (up to 2 Gbps)
Core components
Component | Description |
A gateway device deployed on the Alibaba Cloud side that serves as the cloud-side endpoint of the encrypted tunnel. It is available in enhanced and standard two forms. | |
A core component of Cloud Enterprise Network (CEN) that is responsible for forwarding traffic across VPCs and regions. In multi-VPC scenarios, it replaces the VPN Gateway as the cloud-side endpoint. | |
A logical object on the Alibaba Cloud side that records the public IP address of the on-premises gateway device. It must be referenced when you create an IPsec connection. | |
Defines the parameters of the encrypted tunnel from the cloud to the on-premises gateway device, including the encryption algorithm, authentication algorithm, and pre-shared key (PSK). | |
A physical device or software in the on-premises data center that supports IPsec VPN (such as strongSwan, Cisco, H3C), responsible for negotiating with the cloud to establish the tunnel. |
For ease of description, this document collectively refers to networks that need to establish an IPsec-VPN connection with Alibaba Cloud, such as enterprise on-premises data centers and enterprise office networks, as the on-premises data center.
Dual-tunnel mode
By default, each IPsec connection contains two encrypted tunnels. In regions that support multiple zones, the two tunnels are deployed in different zones to provide zone-level disaster recovery. In regions that support only one zone (for example, China Central 1 (Wuhan - Local Region)), the two tunnels are deployed in the same zone. In this case, zone-level disaster recovery is not supported, but link redundancy is still available.
Bind to a VPN Gateway: active/standby mode
The two tunnels work as active/standby links for each other:
Under normal conditions, traffic flows only through the active tunnel.
If the active tunnel fails, traffic automatically switches to the standby tunnel.
When the active tunnel recovers, traffic automatically switches back.
Bind to a Transit Router: ECMP mode
The two tunnels form equal-cost multi-path (ECMP) links:
Both tunnels transmit traffic simultaneously to achieve load sharing
If either tunnel fails, traffic automatically converges to the remaining tunnel.
When the failed tunnel recovers, it automatically resumes sharing traffic.
When you create an IPsec-VPN connection, make sure that both tunnels are configured to be available. If you configure or use only one tunnel, you cannot obtain link redundancy and zone-level disaster recovery capabilities, and the VPN Gateway does not guarantee the SLA.
Application scenarios
Scenarios for binding to a VPN Gateway
VPC to data center: The most common scenario. Connect an on-premises data center and an Alibaba Cloud VPC through IPsec-VPN to build a hybrid cloud network.
VPC to VPC: Quickly connect two VPCs through IPsec-VPN to enable resource sharing across VPCs.
Multicloud connection: Connect an Alibaba Cloud VPC to a VPC on another cloud platform, such as AWS or Azure.
Multi-site connection: Connect multiple office networks to a single VPN gateway and use the hub-and-spoke feature to enable private communication among sites.
Scenarios for binding to a Transit Router
VPC to data center: The on-premises data center connects to any VPC through IPsec-VPN and a Transit Router. Suitable for scenarios that require access to multiple VPCs.
High-availability ECMP connection: Attach multiple IPsec-VPN connections to the same Transit Router to form an ECMP link, where all connections carry traffic simultaneously.
Express Connect circuit encryption: On the basis of an established private network connection over a physical Express Connect circuit, encrypt the circuit traffic through IPsec-VPN and connect multiple VPCs through a Transit Router.
Global multi-site full-mesh connection: Connect multiple on-premises sites to the nearest Transit Routers using IPsec-VPN and use CEN to achieve a full-mesh topology.
Scenario selection recommendations
For a full comparison including encryption algorithms and performance specifications, see Choose a binding mode.
Product billing
See Billing of IPsec-VPN.