Multi-CIDR block communication - VPN Gateway - Alibaba Cloud Documentation Center

This topic describes the configuration recommendations for using IPsec-VPN connections to enable communication among multiple CIDR blocks and lists frequently asked questions (FAQ) about multi-CIDR block communication.

Multi-CIDR block configuration recommendations

We recommend that you use IKEv2 for the IPsec-VPN connection and the peer gateway device.
Note
If the peer gateway device does not support IKEv2, you can use IKEv1 for the IPsec-VPN connection and the peer gateway device. When IKEv1 is used, an IPsec-VPN connection supports only one local CIDR block and one peer CIDR block. You can refer to Recommended multi-CIDR block configuration solutions to configure the connection to enable multi-CIDR block communication.
If the peer of the IPsec-VPN connection is a device from a traditional vendor such as Cisco or H3C, the following configuration recommendations apply:
- On the Alibaba Cloud side, an IPsec-VPN connection allows you to specify only one value for each of Encryption Algorithm, Authentication Algorithm, and DH Group (Perfect Forward Secrecy) in the IKE Configurations phase and the IPsec Configurations phase. Therefore, when you add VPN configurations on the peer gateway device, you can specify only one value for each of Encryption Algorithm, Authentication Algorithm, and DH Group (Perfect Forward Secrecy) (PFS) in the IKE Configurations phase and the IPsec Configurations phase, and the values must be the same as those on the IPsec-VPN connection side.
- If DPD is enabled on the IPsec-VPN connection, configure standard DPD on the peer gateway device.
- The security association (SA) lifetime configured on the IPsec-VPN connection and the peer gateway device must be the same.
  If the peer gateway device supports a traffic-based SA lifetime, set the traffic-based SA lifetime on the peer gateway device to the maximum value. For some vendors, you can set the value to 0 bytes as the maximum value.

Recommended multi-CIDR block configuration solutions

When an on-premises data center and a Virtual Private Cloud (VPC) use an IPsec-VPN connection to enable multi-CIDR block communication, we recommend the following configuration solutions.

Solution	Supported IKE versions	Description	Advantages or limitations	Configuration example
Solution 1 (recommended)	IKEv1 IKEv2	We recommend that you use one IPsec-VPN connection to connect the on-premises data center and the VPC. Set the routing mode of the IPsec-VPN connection to Destination routing, and configure the peer gateway device with a protected data flow whose source CIDR block is `0.0.0.0/0` and destination CIDR block is `0.0.0.0/0`. Then, configure BGP dynamic routes or static routes on the VPN gateway and the on-premises data center to control traffic forwarding.	Advantages: If you need to add or remove CIDR blocks for communication, you only need to change the route configurations. You do not need to modify the configurations of the IPsec-VPN connection. When you add or remove CIDR blocks for communication, the IPsec-VPN connection is not interrupted and traffic on other routes is not affected.	Solution 1 configuration example
Solution 2 (alternative)	IKEv1 IKEv2	We recommend that you use one IPsec-VPN connection to connect the on-premises data center and the VPC. Aggregate the CIDR blocks that you want to communicate on the on-premises data center side and the VPC side into one CIDR block each, and then configure the aggregated CIDR blocks for the IPsec-VPN connection and the peer gateway device.	Limitations: If you add or remove CIDR blocks, you may need to re-specify the aggregated CIDR blocks and reconfigure the IPsec-VPN connection and the peer gateway device. This operation causes the IPsec-VPN connection to be re-negotiated and results in a brief traffic interruption.	Solution 2 configuration example
Solution 3	IKEv1 IKEv2	Create multiple IPsec-VPN connections between the on-premises data center and the VPC. Use one IPsec-VPN connection for each pair of CIDR blocks that you want to communicate. The multiple IPsec-VPN connections must meet the following conditions: The multiple IPsec-VPN connections must be associated with the same VPN gateway and the same customer gateway. All parameters in the Pre-Shared Key and IKE Configurations phases of the multiple IPsec-VPN connections (including Version, Negotiation Mode, Encryption Algorithm, Authentication Algorithm, DH Group (Perfect Forward Secrecy), and SA Life Cycle (seconds)) must be the same. The LocalId on each IPsec-VPN connection must be the same as the RemoteId on the peer gateway device, and the RemoteId on each IPsec-VPN connection must be the same as the LocalId on the peer gateway device. Note If multiple IPsec-VPN connections exist under a VPN gateway instance, the IPsec-VPN connections are associated with the same customer gateway, and the IPsec-VPN connections use the same IKE version, the IPsec-VPN connections share Phase 1. When Phase 1 is shared, all parameters in the Pre-Shared Key and IKE Configurations phases of all IPsec-VPN connections (including Version, Negotiation Mode, Encryption Algorithm, Authentication Algorithm, DH Group (Perfect Forward Secrecy), and SA Life Cycle (seconds)) must be the same. This ensures that the configuration of the IKE Configurations phase of any IPsec-VPN connection can be shared during IPsec negotiation.	Limitations: If you need to modify the CIDR blocks for communication, you must modify the configurations of the IPsec-VPN connections and the peer gateway device. This operation causes the IPsec-VPN connections to be re-negotiated and results in a brief traffic interruption.	Solution 3 configuration example

Multi-CIDR block configuration solution examples

Solution 1 configuration example

The following figure shows an example scenario. Multiple CIDR blocks (10.1.1.0/24 and 10.1.2.0/24) in a VPC need to communicate with multiple CIDR blocks (192.168.1.0/24 and 192.168.2.0/24) in an on-premises data center. The recommended configurations are as follows:

When you configure the IPsec-VPN connection on the Alibaba Cloud side, set the Routing Mode of the IPsec-VPN connection to Destination routing mode. For more information, see Create an IPsec-VPN connection.
When you add route configurations under the VPN gateway instance, we recommend that you use policy-based routes and add the relevant route configurations. For more information, see Configure policy-based routes.
On the on-premises gateway device, add a protected data flow whose source CIDR block is 0.0.0.0/0 and destination CIDR block is 0.0.0.0/0. For the specific commands, consult the vendor of the on-premises gateway device.

Solution 1 example for multi-CIDR block communication

Solution 2 configuration example

Example 1

When you configure the IPsec-VPN connection on the Alibaba Cloud side, set the Routing Mode of the IPsec-VPN connection to Protected data flows mode. Set Local Network of the IPsec-VPN connection to the aggregated CIDR block 10.1.0.0/16 of the VPC, and set Remote Network to the aggregated CIDR block 192.168.0.0/16 of the on-premises data center. For more information, see Create an IPsec-VPN connection.
When the Routing Mode of the IPsec-VPN connection is set to Protected data flows mode, the system automatically adds a policy-based route under the Policy-based Route Table of the VPN gateway instance. The Source CIDR Block of the route is the Local Network of the IPsec-VPN connection, and the Destination CIDR Block is the Remote Network of the IPsec-VPN connection. The next hop is the IPsec-VPN connection. By default, this policy-based route is not published to the VPC.
If you want to use the default policy-based route, you must publish the policy-based route to the VPC. If you want to use a custom policy-based route, delete the policy-based route that is automatically added by the system and then reconfigure the route based on your needs. For more information, see Configure policy-based routes.

Solution 2 example 1 for multi-CIDR block communication

Example 2

The following figure shows an example scenario. Multiple CIDR blocks (10.1.1.0/24 and 10.1.2.0/24) in a VPC need to communicate with multiple CIDR blocks (192.168.1.0/24 and 172.16.1.0/24) in an on-premises data center. The recommended configurations are as follows:

When you configure the IPsec-VPN connection on the Alibaba Cloud side, set the Routing Mode of the IPsec-VPN connection to Protected data flows mode. Set Local Network of the IPsec-VPN connection to the aggregated CIDR block 10.1.0.0/16 of the VPC, and set Remote Network to 0.0.0.0/0. For more information, see Create an IPsec-VPN connection.
Note
The two CIDR blocks of the on-premises data center are not adjacent and cannot be aggregated. In this scenario, we recommend that you set Remote Network of the IPsec-VPN connection to 0.0.0.0/0.
When the Routing Mode of the IPsec-VPN connection is set to Protected data flows mode, the system automatically adds a policy-based route under the Policy-based Route Table of the VPN gateway instance. The Source CIDR Block of the route is the Local Network of the IPsec-VPN connection, and the Destination CIDR Block is the Remote Network of the IPsec-VPN connection. The next hop is the IPsec-VPN connection. By default, this policy-based route is not published to the VPC.
We do not recommend that you configure a route for the 0.0.0.0/0 CIDR block in Policy-based Route Table. Therefore, we recommend that you delete the policy-based route that is automatically added by the system and then add more specific policy-based routes. For more information, see Configure policy-based routes.

Solution 2 example 2 for multi-CIDR block communication

Solution 3 configuration example

The following figure shows an example scenario. Multiple CIDR blocks (10.1.1.0/24 and 10.1.2.0/24) in a VPC need to communicate with multiple CIDR blocks (192.168.1.0/24 and 172.16.1.0/24) in an on-premises data center. The recommended configurations are as follows:

Create multiple IPsec-VPN connections on the Alibaba Cloud side. Set the Routing Mode of each IPsec-VPN connection to Protected data flows mode, and configure one Local Network and one Remote Network for each IPsec-VPN connection. For more information, see Create an IPsec-VPN connection.
When the Routing Mode of the IPsec-VPN connection is set to Protected data flows mode, the system automatically adds a policy-based route under the Policy-based Route Table of the VPN gateway instance. The Source CIDR Block of the route is the Local Network of the IPsec-VPN connection, and the Destination CIDR Block is the Remote Network of the IPsec-VPN connection. The next hop is the IPsec-VPN connection. By default, this policy-based route is not published to the VPC.
You must publish the four policy-based routes that are automatically added by the system to the VPC. For more information, see Configure policy-based routes.

Solution 3 example for multi-CIDR block communication

FAQ

Why does the IPsec-VPN connection status show "Phase 2 negotiation succeeded", but in a multi-CIDR block scenario only some CIDR blocks can communicate while others cannot?

Cause

When you use an IPsec-VPN connection to enable communication between an on-premises data center and a VPC, if the VPN gateway is connected to a device from a traditional vendor such as Cisco or H3C, and the IPsec-VPN connection uses the Protected data flows routing mode with multiple CIDR blocks configured, only one CIDR block can communicate and the other CIDR blocks cannot communicate.

This issue is caused by incompatibility between the IPsec protocols on the two ends when an Alibaba Cloud VPN gateway is connected to a device from a traditional vendor such as Cisco or H3C. When multiple CIDR blocks are configured for an IPsec-VPN connection, the Alibaba Cloud VPN gateway uses one SA to negotiate with the peer gateway device, whereas the peer gateway device uses multiple SAs to negotiate with the VPN gateway when multiple CIDR blocks are configured.

Solution

For more information, see Recommended multi-CIDR block configuration solutions.

How do I enable multi-CIDR block communication when the on-premises gateway device does not support IKEv2?

If the on-premises gateway device does not support IKEv2, you can use IKEv1 for the IPsec-VPN connection and the on-premises gateway device.

When IKEv1 is used for an IPsec-VPN connection, the IPsec-VPN connection supports only one local CIDR block and one peer CIDR block. Refer to Multi-CIDR block configuration solutions to configure the connection to enable multi-CIDR block communication.