Billing of SSL-VPN - VPN Gateway - Alibaba Cloud Documentation Center

When you enable the SSL-VPN feature for a VPN gateway, you are charged for using the VPN gateway. The billing rules vary based on the features that are enabled for the VPN gateway.

Billing rules

Feature enabled for a VPN gateway

Billable item

References

Billing cycle

SSL-VPN

SSL-VPN instance fee
Data transfer fee
SSL specification fee

Pay-as-you-go.

This billing method allows you to use resources and pay for them afterwards. You are billed based on the resources that are consumed.

One hour.

If the usage duration is less than 1 hour, it is rounded up to 1 hour.

SSL-VPN and IPsec-VPN

IPsec-VPN instance fee
SSL-VPN connection fee
Data transfer fee
SSL specification fee

Billable items

Important

The prices listed in the following table are for reference only. The prices displayed on the buy page prevail.
The maximum bandwidth supported by VPN gateways in the China (Nanjing - Local Region) region is 500 Mbit/s.
Click to view the regions in the Chinese mainland in the following table.
China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Nanjing - Local Region), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu)
In the following table, "Not supported" indicates that the bandwidth specification is not supported by VPN gateways in the corresponding region.

IPsec-VPN and SSL-VPN connection fees

VPN gateways provide different bandwidth specifications. If the same bandwidth specification is used in the same region, the unit prices for IPsec-VPN and SSL-VPN connections are the same. The following table lists the unit prices. Unit: USD per hour.

Region	10 Mbps	100 Mbps	200 Mbps	500 Mbps	1000 Mbps
The Chinese mainland	0.059	0.209	0.209	0.767	0.767
Hong Kong (China)	0.087	0.262	0.262	1.025	1.025
Singapore	0.087	0.262	0.262	1.025	1.025
Japan (Tokyo)	0.091	0.275	0.275	0.767	0.767
South Korea (Seoul)	0.091	0.275	0.275	0.767	0.767
Thailand (Bangkok)	0.087	0.262	0.262	1.025	1.025
Philippines (Manila)	0.087	0.262	0.262	1.025	1.025
Malaysia (Kuala Lumpur)	0.080	0.240	0.240	0.878	0.878
Indonesia (Jakarta)	0.086	0.262	0.262	0.734	0.734
US (Virginia)	0.066	0.295	0.295	0.826	0.826
US (Silicon Valley)	0.082	0.392	0.392	1.095	1.095
Germany (Frankfurt)	0.077	0.359	0.359	1.003	1.003
UK (London)	0.077	0.359	0.359	1.003	1.003
Mexico	0.066	0.295	0.295	0.826	0.826
UAE (Dubai)	0.090	0.420	0.420	1.231	Not supported
SAU (Riyadh - Partner Region) Important The SAU (Riyadh - Partner Region) region is operated by a partner.	0.104	0.314	0.314	1.230	Not supported

Data transfer fee

You are charged for data transfer from Alibaba Cloud to a data center over an IPsec-VPN connection. You are not charged for data transfer from a data center to Alibaba Cloud over an IPsec-VPN connection. Unit: USD per GB.

Region	Price
The Chinese mainland	0.125
Hong Kong (China)	0.153
Singapore	0.117
Japan (Tokyo)	0.120
South Korea (Seoul)	0.125
Thailand (Bangkok)	0.117
Philippines (Manila)	0.110
Malaysia (Kuala Lumpur)	0.125
Indonesia (Jakarta)	0.110
US (Virginia)	0.078
US (Silicon Valley)	0.078
Germany (Frankfurt)	0.070
UK (London)	0.070
Mexico	0.078
UAE (Dubai)	0.447
SAU (Riyadh - Partner Region) Important The SAU (Riyadh - Partner Region) region is operated by a partner.	0.140

SSL specification fee

After the SSL-VPN feature is enabled, you must select an SSL specification based on the number of clients that you want to connect at a time. The following table lists the unit prices for different SSL specifications. Unit: USD per hour.

Region	5	10	20	50	100	500	1000
The Chinese mainland	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Hong Kong (China)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Singapore	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Japan (Tokyo)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
South Korea (Seoul)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Thailand (Bangkok)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Philippines (Manila)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Malaysia (Kuala Lumpur)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Indonesia (Jakarta)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
US (Virginia)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
US (Silicon Valley)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Germany (Frankfurt)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
UK (London)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
Mexico	0.048	0.074	0.117	0.226	0.328	1.090	1.547
UAE (Dubai)	0.048	0.074	0.117	0.226	0.328	1.090	1.547
SAU (Riyadh - Partner Region) Important The SAU (Riyadh - Partner Region) region is operated by a partner.	0.058	0.089	0.14	0.271	0.394	1.308	1.856

Billing example

As shown in the preceding figure, the client of an enterprise in the Chinese mainland connects to a virtual private cloud (VPC) over an SSL-VPN connection. Only the SSL-VPN feature is enabled for the VPN gateway. The VPN gateway can connect to up to five clients. The bandwidth of the VPN gateway is 10 Mbit/s, and 10 GB of traffic is sent from the VPN gateway to the client from 00:00:00 on June 1, 2023 to 00:00:00 on June 02, 2023. In this case, the following fees are generated:

SSL-VPN connection fee = USD 0.059 per hour × 24 hours = USD 1.416
SSL specification fee = USD 0.048 per hour × 24 hours = USD 1.152
Data transfer fee = USD 0.125/GB × 10 GB = USD 1.25
Total fees = SSL-VPN connection fee + SSL specification fee + Data transfer fee = USD 3.818

Modify the configuration of a VPN gateway

If you need to modify the bandwidth or change the specifications of a VPN gateway, you can upgrade or downgrade the VPN gateway. This topic describes how to upgrade or downgrade a VPN gateway.

Upgrade a VPN gateway

Item	Description
Upgrade	You can upgrade the bandwidth of a VPN gateway. Note You can enable IPsec-VPN and SSL-VPN or increase the maximum number of concurrent SSL connections for a VPN gateway based on your business requirements. For more information, see the following topics: Enable IPsec-VPN Enable SSL-VPN Modify the maximum number of concurrent SSL connections
Upgrade limits	If the bandwidth of your VPN gateway is smaller than or equal to 200 Mbit/s, you cannot upgrade the bandwidth to 500 Mbit/s or 1000 Mbit/s. If the bandwidth of your VPN gateway is 500 Mbit/s, you can upgrade the bandwidth to only 1000 Mbit/s. Your services are not affected during the upgrade process.
Validity period	After you upgrade a VPN gateway, the upgrade immediately takes effect. However, you may need to wait a few minutes due to network latency.
Impacts on billing	After you modify a VPN gateway and submit the order, the system bills the VPN gateway based on the new configuration.
Applicable scenarios	You can upgrade a VPN gateway based on your business requirements.

Log on to the VPN Gateway console.
In the top menu bar, select the region of the VPN gateway.
On the VPN Gateways page, find the VPN gateway that you want to upgrade and click Upgrade in the Bandwidth column.
On the VPN Gateway | Upgrade/Downgrade page, modify the maximum bandwidth of the VPN gateway.
In the Service Agreement section, read and select the service agreement, and then click Buy Now and complete the payment.

Downgrade a VPN gateway

Item	Description
Downgrade	You can downgrade the bandwidth of a VPN gateway. You can disable IPsec-VPN and SSL-VPN for a VPN gateway. You can decrease the maximum number of concurrent SSL connections for a VPN gateway.
Downgrade limits	If you want to disable IPsec-VPN for a VPN gateway, make sure that all IPsec-VPN connections created for the VPN gateway are deleted. For more information, see the Delete an IPsec-VPN connection section of the "Create and manage IPsec-VPN connections in dual-tunnel mode" topic. If you want to disable SSL-VPN for a VPN gateway, make sure that all SSL and IPsec servers associated with the VPN gateway are deleted. For more information, see the Delete an SSL server section of the "Create and manage an SSL server" topic and the Delete an IPsec server section of the "Create and manage IPsec servers" topic. If the bandwidth of your VPN gateway is 1,000 Mbit/s, you can downgrade the bandwidth only to 500 Mbit/s. If the bandwidth of your VPN gateway is 500 Mbit/s, you cannot downgrade the bandwidth. Note If you use a VPN gateway that supports dual-tunnel IPsec-VPN connections, you can contact your account manager to remove downgrade limits on bandwidth. If the transmitted traffic of a VPN gateway exceeds the maximum bandwidth during the bandwidth downgrade process, connections may be interrupted. Therefore, we recommend that you enable automatic reconnection for your services. If you decrease the maximum number of concurrent SSL connections for a VPN gateway and the number of existing clients connected to the VPN gateway exceeds the new limit, some connections may be interrupted. Therefore, we recommend that you enable automatic reconnection for your services.
Validity period	After you downgrade a VPN gateway, the downgrade immediately takes effect. However, you may need to wait a few minutes due to network latency.
Impacts on billing	After you downgrade a VPN gateway and submit the order, the system bills the VPN gateway based on the new configuration.
Applicable scenarios	You can downgrade a VPN gateway based on your business requirements.

Log on to the VPN Gateway console.
In the top menu bar, select the region of the VPN gateway.
On the VPN Gateways page, find the VPN gateway that you want to downgrade and click Downgrade in the Bandwidth column.
On the VPN Gateway | Downgrade page, modify the configuration of the VPN gateway.
You can downgrade the maximum bandwidth, disable IPsec-VPN or SSL-VPN, or downgrade the SSL specification for a VPN gateway.
In the Service Agreement section, read and select the service agreement, and then click Buy Now and complete the payment.

View bills

Log on to the Expenses and Costs console. In the left-side navigation pane, choose Bills > Bill Details. Then, refer to Bill Management to view billing details.

Handling of overdue payments

If the available balance of your Alibaba Cloud account, including vouchers and coupons within your account, is less than the payable amount, an overdue payment occurs in your account. The following rules apply to your VPN gateway if an overdue payment occurs:

The VPN gateway can continue to provide services within 15 days after the payment becomes overdue. To ensure that your services run as expected, add funds to your account at the earliest opportunity.
If you do not complete the payment within 15 days after the payment becomes overdue, the VPN gateway is suspended.
If you add funds to your account after the VPN gateway is suspended, the system automatically pays the outstanding amount. Then, the VPN gateway immediately starts to provide services.
If you do not complete the payment within 15 days after the VPN gateway is suspended, the system automatically releases the VPN gateway.
You are notified by text message and email one day before the system releases the VPN gateway. After the VPN gateway is released, the configurations and related data are deleted and cannot be restored.