SSL-VPN billing - VPN Gateway - Alibaba Cloud Documentation Center

Using SSL-VPN incurs charges for the VPN gateway instance. Billing rules vary depending on the features enabled.

Billing

Features

Billable item

Billing method

Billing cycle

SSL-VPN feature only

SSL-VPN instance fee
Data transfer fee
SSL specification fee

Pay-as-you-go

You are charged for your actual resource usage. You use resources first and pay later.

1 hour

Usage for a partial hour is billed as a full hour.

SSL-VPN and IPsec-VPN features

IPsec-VPN instance fee
SSL-VPN instance fee
Data transfer fee
SSL specification fee

Billable items

Important

The prices in the following tables are for reference only. If these prices differ from those on the purchase page, the prices on the purchase page prevail.
In the Chinese mainland, the maximum bandwidth specification for VPN Gateway instances in the China (Nanjing) region is 500 Mbps.
Click to view the regions in the Chinese mainland.
China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing - Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), and China (Chengdu)
In the following tables, "Not supported" indicates that the corresponding bandwidth specification is unavailable for VPN Gateway instances in that region.

IPsec-VPN and SSL-VPN fees

VPN Gateway offers various bandwidth specifications. For each specification, the IPsec-VPN and SSL-VPN connection fees are the same. The following table lists the prices in USD/hour.

Region	10 Mbps	100 Mbps	200 Mbps	500 Mbps	1000 Mbps
The Chinese mainland	0.059	0.209	0.209	0.767	0.767
China (Hong Kong)	0.087	0.262	0.262	1.025	1.025
Singapore	0.087	0.262	0.262	1.025	1.025
Japan (Tokyo)	0.091	0.275	0.275	0.767	0.767
South Korea (Seoul)	0.091	0.275	0.275	0.767	0.767
Thailand (Bangkok)	0.087	0.262	0.262	1.025	1.025
Philippines (Manila)	0.087	0.262	0.262	1.025	1.025
Malaysia (Kuala Lumpur)	0.080	0.240	0.240	0.878	0.878
Indonesia (Jakarta)	0.086	0.262	0.262	0.734	0.734
US (Virginia)	0.066	0.295	0.295	0.826	0.826
US (Silicon Valley)	0.082	0.392	0.392	1.095	1.095
Germany (Frankfurt)	0.077	0.359	0.359	1.003	1.003
UK (London)	0.077	0.359	0.359	1.003	1.003
Mexico	0.066	0.295	0.295	0.826	0.826
UAE (Dubai)	0.090	0.420	0.420	1.231	Not supported
SAU (Riyadh - Partner Region)	0.104	0.314	0.314	1.230	Not supported

Data transfer fee

You are charged a data transfer fee for data transferred from an IPsec-VPN connection to a data center. Data transfer from a data center to an IPsec-VPN connection is free. Unit: USD/GB.

Region	Unit price
The Chinese mainland	0.125
China (Hong Kong)	0.153
Singapore	0.117
Japan (Tokyo)	0.120
South Korea (Seoul)	0.125
Thailand (Bangkok)	0.117
Philippines (Manila)	0.110
Malaysia (Kuala Lumpur)	0.125
Indonesia (Jakarta)	0.110
US (Virginia)	0.078
US (Silicon Valley)	0.078
Germany (Frankfurt)	0.070
UK (London)	0.070
Mexico	0.078
UAE (Dubai)	0.447
SAU (Riyadh - Partner Region)	0.140

SSL specification fee

After you enable the SSL-VPN feature, select a specification based on the maximum number of concurrent clients. The following table lists the hourly prices for each specification in USD/hour.

Region	5	10	20	50	100	500	1000
The Chinese mainland	0.048	0.074	0.117	0.226	0.328	1.090	1.547
China (Hong Kong)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Singapore	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Japan (Tokyo)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
South Korea (Seoul)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Thailand (Bangkok)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Philippines (Manila)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Malaysia (Kuala Lumpur)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Indonesia (Jakarta)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
US (Virginia)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
US (Silicon Valley)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Germany (Frankfurt)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
UK (London)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Mexico	0.048	0.074	0.117	0.226	0.328	1.090	1.547
UAE (Dubai)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
SAU (Riyadh - Partner Region)	0.058	0.089	0.14	0.271	0.394	1.308	1.856

Billing example

As shown in the preceding figure, an enterprise client in the Chinese mainland connects to a VPC via SSL-VPN. Suppose you have a VPN Gateway with only the SSL-VPN feature enabled, a bandwidth of 10 Mbps, and support for a maximum of 5 SSL connections. Over a 24-hour period from 00:00:00, June 01, 2023 to 00:00:00, June 02, 2023, 10 GB of data is transferred from the VPN Gateway to the client. The fees are calculated as follows:

SSL-VPN connection fee = USD 0.059/hour × 24 hours = USD 1.416
SSL specification fee = USD 0.048/hour × 24 hours = USD 1.152
Data transfer fee = USD 0.125/GB × 10 GB = USD 1.25
Total fees = SSL-VPN connection fee + SSL specification fee + Data transfer fee = USD 3.818

Modify a VPN gateway instance

To modify the bandwidth or features of a VPN gateway instance, you can upgrade or downgrade the VPN gateway instance.

Upgrade

Item	Description
Upgrade capabilities	Increase the bandwidth specification of a VPN gateway instance. Note To enable IPsec-VPN or SSL-VPN, or to increase the SSL connection limit, see: Enable the IPsec-VPN feature Enable the SSL-VPN feature Modify the SSL connection limit
Upgrade limitations	If the bandwidth of a VPN gateway instance is 200 Mbps or less, you cannot upgrade it to 500 Mbps or 1000 Mbps. If the bandwidth is 500 Mbps, you can only upgrade it to 1000 Mbps. The upgrade process does not interrupt your services.
Effective time	The new configuration takes effect immediately after the upgrade, although network latency might cause a short delay.
Billing impact	After you submit the order, you are billed based on the new configuration.
Scenarios	If the current specifications of the VPN gateway instance no longer meet your business needs, you can upgrade the instance.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateways page, find the target VPN gateway instance and click Upgrade in the Bandwidth column.
On the VPN Gateway | Change Specification page, adjust the Maximum Bandwidth of the VPN gateway instance.
In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

Downgrade

Item	Description
Downgrade capabilities	Decrease the bandwidth specification of a VPN gateway instance. Disable IPsec-VPN and SSL-VPN features for a VPN gateway instance. Decrease the SSL connection limit of a VPN gateway instance.
Downgrade limitations	To disable IPsec-VPN during a downgrade, ensure no IPsec-VPN connections exist under the instance. To delete an IPsec connection, see IPsec connections (attached to a VPN gateway). To disable SSL-VPN during a downgrade, ensure no SSL servers or IPsec servers exist for the instance. To delete SSL and IPsec servers, see Delete an SSL server and Delete an IPsec server. Bandwidth limits: VPN gateway instances in dual-tunnel mode have no bandwidth downgrade restrictions. For VPN gateway instances in single-tunnel mode: if the bandwidth is 1000 Mbps, you can only downgrade to 500 Mbps. If the bandwidth is 500 Mbps, you cannot downgrade it. During a bandwidth downgrade, if traffic exceeds the new bandwidth limit, connections may break. Ensure your backend applications support reconnection. When decreasing the SSL connection limit, if connected clients exceed the new limit, connections may break. Ensure your backend applications support reconnection.
Effective time	The new configuration takes effect immediately after the downgrade, although network latency might cause a short delay.
Billing impact	After you submit the order, you are billed based on the new configuration.
Scenarios	If the current specifications of the VPN gateway instance exceed your business needs, you can downgrade the instance.

Log on to the VPN Gateway console.
In the top navigation bar, select the region where the VPN gateway instance resides.
On the VPN Gateways page, find the target VPN gateway instance and click Downgrade in the Bandwidth column.
On the page that opens, change the configuration of the VPN gateway instance.
You can decrease the maximum bandwidth, disable IPsec-VPN or SSL-VPN, or decrease the SSL connection limit as needed.
In the Terms of Service section, read and select the terms of service. Then, click Buy Now and complete the payment.

Bills

Log in to the Alibaba Cloud Expenses and Costs console. In the left-side navigation pane, choose Bill > Bill Details to view bill details.

Overdue payments

If the available balance in your account, including your Alibaba Cloud account balance, vouchers, and coupons, is insufficient to cover an outstanding bill, your account is considered overdue. When your account becomes overdue, the status of your VPN Gateway instance changes as follows:

For 15 days after your account becomes overdue, your VPN Gateway instance continues to run normally. To avoid service interruptions, add funds to your account promptly.
If you do not settle the bill within 15 days, the VPN Gateway instance is suspended.
If you add funds to your account during the suspension, the system automatically settles the outstanding bill. Upon successful payment, the instance immediately resumes service.
If the bill remains unpaid for 15 days after the service suspension begins, the instance is automatically released.
The system sends a reminder via text message and email one day before the release. After the instance is released, its configuration and data are permanently deleted and unrecoverable.