All Products
Search

This Product

    VPN Gateway:Choose a binding mode: VPN Gateway or Transit Router

    Document Center

    VPN Gateway:Choose a binding mode: VPN Gateway or Transit Router

    Last Updated:May 13, 2026

    IPsec-VPN offers two binding modes, VPN Gateway and Transit Router, each suited for network architectures with different scale and availability requirements.

    Quick guide

    1. How many VPCs do you need to connect?

      • One VPC → Choose VPN Gateway

      • Multiple VPCs (in the same region or across regions) → Choose Transit Router

    2. Do you need ECMP load balancing?

      • No (active-standby disaster recovery is sufficient) → VPN Gateway meets this need

      • Yes (multiple links carry traffic simultaneously) → Choose Transit Router

    3. What is the bandwidth requirement for a single IPsec connection?

      • 1 Gbps or less → Both modes are suitable

      • 1 to 2 Gbps → Choose Transit Router (supports up to 2 Gbps per connection)

      • More than 2 Gbps → Choose Transit Router and use multiple connections with ECMP to scale bandwidth

    4. Do you need the SSL-VPN?

      • Need SSL-VPN remote access → Choose Standard VPN Gateway

      • No → Decide based on the preceding criteria

    Feature comparison

    Feature

    VPN Gateway

    Transit Router

    Use cases

    Connect an on-premises data center to a single VPC

    Connect an on-premises data center to multiple VPCs

    Supported encryption algorithms

    • IKE/IPsec encryption: AES128, AES192, AES256, DES, 3DES, AES128-GCM-16 (Enhanced VPN Gateway only), AES256-GCM-16 (Enhanced VPN Gateway only)

    • IKE/IPsec authentication: SHA1, MD5, SHA256, SHA384, SHA512

    • IKE/IPsec encryption: AES128, AES192, AES256, DES, 3DES

    • IKE/IPsec authentication: SHA1, MD5, SHA256, SHA384, SHA512

    Tunnel mode

    Dual-tunnel (active-standby)

    Some legacy VPN Gateway instances support only single-tunnel IPsec-VPN connections. Upgrade to dual-tunnel mode.

    Dual-tunnel (ECMP)

    Legacy single-tunnel IPsec connections do not provide high availability. Delete and recreate the IPsec connection at a time that does not impact network connectivity. New IPsec connections use the dual-tunnel mode by default.

    High availability mechanism

    Active-standby failover: Traffic is routed through the active tunnel by default and automatically fails over to the standby tunnel if the active tunnel fails.

    ECMP load balancing: Both tunnels transmit traffic simultaneously and provide redundancy for each other.

    Maximum bandwidth per IPsec connection

    Enhanced: 1 Gbps (dedicated per connection)

    Standard: All connections share the bandwidth of the VPN Gateway, with a maximum of 1,000 Mbps (or 500 Mbps in some regions).

    2 Gbps (up to 1 Gbps per tunnel)

    Legacy single-tunnel mode supports a maximum of 1 Gbps.

    Bandwidth scaling

    Standard: Not supported.
    Enhanced: You can scale bandwidth by creating multiple IPsec connections.

    Supports ECMP over multiple connections, with load balancing across a maximum of 32 tunnels (16 IPsec connections).

    pps

    120,000 pps per VPN Gateway instance (shared by all connections)

    120,000 pps per tunnel (in dual-tunnel mode)

    Legacy single-tunnel mode supports 120,000 pps per connection.

    SSL-VPN

    Supported on Standard VPN Gateways

    Not supported

    BGP dynamic routing

    Enhanced: 200 routes by default

    Standard: 50 routes by default

    1,000 routes per tunnel, for a total of 2,000 routes
    Important

    Differences between Enhanced and Standard VPN Gateways:

    • Enhanced: Billed on a basis, provides 1 Gbps of dedicated bandwidth per IPsec connection, and does not support the SM algorithm.

    • Standard: Billed on a basis, all IPsec connections share the VPN Gateway's bandwidth, and supports policy-based routing and the SM algorithm.

    • For a detailed comparison, see Enhanced vs. Standard VPN Gateways.

    Tunnel modes

    Dual-tunnel mode

    The dual-tunnel mode is the default for new IPsec connections.

    • Each IPsec connection includes two tunnels deployed in different availability zones.

    • Provides zone-level disaster recovery and link redundancy.

    • When bound to a VPN Gateway, it operates in active-standby mode. When bound to a Transit Router, it operates in ECMP mode.

    Important

    Ensure both tunnels are configured and available. If you configure only one tunnel, redundancy is lost, and the connection is not covered by the SLA.

    Single-tunnel mode

    Single-tunnel is a legacy mode and is not supported for new IPsec connections.

    • Single-tunnel IPsec connections are found only on some legacy VPN Gateway instances.

    • Does not provide zone-level disaster recovery.

    • Upgrade to dual-tunnel mode as soon as possible.

    Network types

    When creating an IPsec connection bound to a Transit Router, you can choose one of the following network types:

    Network type

    Description

    Use cases

    Internet

    Establishes an IPsec tunnel over the Internet.

    Scenarios without a physical connection, or where a VPN is used as a standby for a physical connection.

    Private network

    Establishes an IPsec tunnel over an existing physical connection to encrypt its traffic.

    Scenarios with an existing physical connection or where compliance requires encrypted transmission.

    Routing modes

    IPsec-VPN supports three routing modes that determine how traffic is routed from the cloud to your on-premises data center:

    BGP dynamic routing

    This is the most flexible mode. The cloud and your on-premises gateway use the Border Gateway Protocol (BGP) to automatically learn and advertise routes. Routes are automatically updated when your network changes.

    Benefits:

    • Automatic route learning and convergence, eliminating the need for manual route table maintenance.

    • Automatic adaptation to network topology changes, such as adding or removing subnets.

    • Automatic route failover for faster recovery.

    • Ideal for medium-to-large networks and multi-site scenarios.

    Requirements:

    • Your on-premises gateway must support BGP.

    • You must configure a BGP Autonomous System Number (ASN) and BGP peer IP addresses for the tunnels.

    Static destination route

    Manually configure static routes that point to your on-premises CIDR blocks. This mode is simple and direct, making it suitable for scenarios with a stable network topology and a small number of subnets.

    Benefits:

    • Simple configuration with no BGP dependency.

    • Suitable for small-scale networks and proofs of concept (PoCs).

    Limitations:

    • Requires manual route updates when the on-premises data center changes.

    • A limit of 50 routes for Enhanced VPN Gateway and 30 for Standard VPN Gateway.

    Policy-based routing

    Applies policies based on source and destination CIDR blocks to direct traffic to specific IPsec connections, offering granular control.

    Benefits:

    • Granular routing control based on source and destination addresses.

    • Suitable for traffic distribution across multiple connections.

    Limitations:

    • Supported only by Standard VPN Gateway.

    • A default limit of 20 policy-based routes.

    • More complex configuration and maintenance.

    Routing mode comparison

    Feature

    BGP dynamic routing

    Static destination route

    Policy-based routing

    Route configuration

    Automatic learning

    Manual configuration

    Manual configuration

    Applicable binding modes

    VPN Gateway, Transit Router

    VPN Gateway, Transit Router

    Standard VPN Gateway only

    Recommendation

    Highly recommended

    Suitable for simple scenarios

    For specific needs, such as granular routing control based on source and destination addresses.

    Decision summary

    VPN Gateway

    • Connect to a single VPC.

    • Provide client-to-site remote access with SSL-VPN (requires a Standard VPN Gateway).

    • Meet availability requirements with active-standby disaster recovery.

    Transit Router

    • Connect multiple VPCs, in the same region or across regions.

    • Achieve high availability and load balancing with ECMP.

    • Encrypt traffic over a physical connection.

    • Require more than 1 Gbps of bandwidth for a single connection.

    • Build a full-mesh network for large-scale, multi-site connectivity.

    • Support a large number of BGP routes (up to 2,000).