IPsec-VPN establishes an encrypted tunnel between your on-premises network—such as a data center or office—and an Alibaba Cloud VPC, enabling both sides to communicate as if they were on the same private network.
The Alibaba Cloud VPN Gateway service complies with relevant Chinese national policies and regulations and supports only non-cross-border connections. For cross-border connectivity, use Transit Router instead.
Two association modes
IPsec-VPN supports two modes depending on how many VPCs you want to connect:
| Attach to a VPN gateway | Attach to a Transit Router | |
|---|---|---|
| Best for | Single VPC | Multiple VPCs |
| Max bandwidth per connection | Up to 1 Gbps | Up to 2 Gbps |
| High availability | Active-passive (failover) | Equal-cost multi-path (ECMP, load balancing) |
| Combine with SSL-VPN | Yes (standard VPN gateway only) | — |
| Multi-region VPC access | — | Yes |
For a full comparison including encryption algorithms and performance specifications, see Choose an association mode.
Attach to a VPN gateway
Attach an IPsec-VPN connection to a VPN gateway instance. Best for connecting an on-premises data center to a single VPC.
How it works: On-premises gateway device ↔ IPsec-VPN tunnel ↔ VPN gateway ↔ VPC
Use cases:
-
Connect to a single VPC
-
Use SSL-VPN for remote access at the same time (standard VPN gateways only)
Attach to a Transit Router
Attach an IPsec-VPN connection directly to a Transit Router in Cloud Enterprise Network (CEN). Best for connecting an on-premises data center to multiple VPCs.
How it works: On-premises gateway device ↔ IPsec-VPN tunnel ↔ Transit Router ↔ Multiple VPCs
Use cases:
-
Connect to multiple VPCs in the same or different regions
-
Use ECMP load balancing for high availability
-
Require more than 1 Gbps bandwidth per connection (up to 2 Gbps)
Key concepts
| Component | Description |
|---|---|
| VPN Gateway instance | A gateway deployed on Alibaba Cloud that serves as the cloud-side endpoint of the encrypted tunnel. Available in two types: enhanced and standard. |
| Transit Router | A core component of CEN that forwards traffic across VPCs and regions. In multi-VPC scenarios, it acts as the cloud-side endpoint instead of a VPN gateway. |
| Customer gateway | A logical object in Alibaba Cloud that records the public IP address of your on-premises gateway device. Required to create an IPsec-VPN connection. |
| IPsec-VPN connection | Defines the encrypted tunnel parameters between the cloud and your on-premises gateway device, including the encryption algorithm, authentication algorithm, and pre-shared key (PSK). |
| On-premises gateway device | A physical device or software in your on-premises data center that supports IPsec VPN—for example, strongSwan, Cisco, or H3C. It negotiates with the cloud-side endpoint to establish the tunnel. |
"On-premises data center" in this context refers to any on-premises network that establishes an IPsec-VPN connection with Alibaba Cloud, including corporate data centers and office networks.
Dual-tunnel mode
Each IPsec-VPN connection includes two encrypted tunnels by default for redundancy—if one tunnel goes down, traffic automatically switches to the other without manual intervention.
In multi-zone regions, the two tunnels are deployed in different zones for zone-level disaster recovery. In single-zone regions (such as China (Wuhan - Local Region)), both tunnels share the same zone, providing link redundancy only.
Attach to a VPN gateway: Active-passive mode
The two tunnels work as active/standby links:
-
Under normal conditions, traffic flows only through the active tunnel.
-
If the active tunnel fails, traffic automatically switches to the standby tunnel.
-
When the active tunnel recovers, traffic automatically switches back.
Attach to a Transit Router: ECMP mode
The two tunnels form an ECMP link:
-
Both tunnels carry traffic simultaneously for load balancing.
-
If either tunnel fails, traffic automatically converges to the remaining tunnel.
-
When the failed tunnel recovers, it automatically resumes sharing traffic.
Limits
| Constraint | Detail |
|---|---|
| Cross-border connections | Not supported. IPsec-VPN supports non-cross-border connections only. For cross-border connectivity, use Transit Router. |
| Max bandwidth (Transit Router) | Up to 2 Gbps per connection (supports more than 1 Gbps) |
| SLA applicability | Both tunnels must be configured and active. Single-tunnel deployments are not covered by the VPN Gateway SLA. |
| SSL-VPN coexistence | Supported only with standard VPN gateways. |
Use cases
Attach to a VPN gateway
-
VPC to data center: Connect an on-premises data center to an Alibaba Cloud VPC to build a hybrid cloud. This is the most common scenario.
-
VPC to VPC: Connect two VPCs for resource sharing across VPCs.
-
Multicloud connection: Connect an Alibaba Cloud VPC to a VPC on another cloud platform, such as AWS or Azure.
-
Multi-site connection: Connect multiple office networks to a single VPN gateway and use the hub-and-spoke feature to enable private communication among sites.
Attach to a Transit Router
-
VPC to data center: Connect an on-premises data center to multiple VPCs across regions through an IPsec-VPN connection and a Transit Router.
-
High-availability ECMP connection: Attach multiple IPsec-VPN connections to the same Transit Router to form an ECMP link, where all connections carry traffic simultaneously.
-
Express Connect circuit encryption: Encrypt an existing Express Connect circuit and use a Transit Router to connect to multiple VPCs.
-
Global multi-site full-mesh connection: Connect multiple on-premises sites to the nearest Transit Routers using IPsec-VPN and use CEN to achieve a full-mesh topology.
Billing
See Billing of IPsec-VPN.
For pricing details, see Billing of IPsec-VPN.