VPN Gateway:Upgrade an IPsec-VPN connection to dual-tunnel mode

Background

Before you upgrade an IPsec-VPN connection to dual-tunnel mode, we recommend that you understand the network topology and traffic paths of dual-tunnel mode. For more information, see [Deprecated] Associate a VPN gateway.

Bandwidth changes after the upgrade

• For single-tunnel VPN gateway instances with a bandwidth of 100 Mbps or less:

  IPsec-VPN tunnel mode	Outbound peak bandwidth	Inbound peak bandwidth
  Before upgrade	The bandwidth of the VPN gateway instance.	100 Mbps.
  After upgrade	The bandwidth of the VPN gateway instance.	The bandwidth of the VPN gateway instance.

• For single-tunnel VPN gateway instances with a bandwidth greater than 100 Mbps, the peak bandwidth is unchanged after the upgrade and matches the instance's bandwidth.

Supported regions and zones

You can upgrade an IPsec-VPN connection to dual-tunnel mode in the following regions and zones.

Prerequisites

Before you upgrade an IPsec-VPN connection to dual-tunnel mode, make sure that the following requirements are met:

• The AliyunServiceRoleForVpn service-linked role must be created for your Alibaba Cloud account.

  During the upgrade, the system needs to assume the AliyunServiceRoleForVpn service-linked role to deploy VPN Gateway resources. On the VPN Gateway purchase page, verify that the AliyunServiceRoleForVpn service-linked role is created for your Alibaba Cloud account:

  • If the status is Created, the role exists and no further action is required.

  • If Create Service-linked Role is displayed, click Create Service-linked Role. The system automatically creates the AliyunServiceRoleForVpn service-linked role. For more information, see AliyunServiceRoleForVpn.

  

• The VPN gateway instance must not have both the IPsec-VPN and SSL-VPN features enabled at the same time.

  If the IPsec-VPN and SSL-VPN features are enabled for the VPN gateway instance at the same time, you can downgrade the instance to disable the IPsec-VPN or SSL-VPN feature. For more information, see Downgrade a VPN gateway.

  Before you disable a feature, make sure that no IPsec-VPN connections or SSL servers exist on the VPN gateway instance. For more information, see Delete an IPsec-VPN connection or Delete an SSL server.

• The policy-based or destination-based route table of the VPN gateway instance does not contain conflicting routes that point to different IPsec-VPN connections.

  The following table describes scenarios and provides solutions.

  Route table	Source CIDR block	Destination CIDR block	Next hop	Upgradable	Solution
  Policy-based route table	10.10.10.0/24	172.16.10.0/24	IPsec-VPN connection 1	No The policy-based route table contains two routes that have the same source and destination CIDR blocks but point to different IPsec-VPN connections.	Delete one of the routes, or modify the source or destination CIDR block of one of the routes. For more information, see [Deprecated] Policy-based routes (for traditional VPN gateways only).
  	10.10.10.0/24	172.16.10.0/24	IPsec-VPN connection 2
  Destination-based route table	Not applicable	192.168.10.0/24	IPsec-VPN connection 3	No The destination-based route table contains two routes that have the same destination CIDR block but point to different IPsec-VPN connections.	Delete one of the routes, or modify the destination CIDR block of one of the routes. For more information, see Route configurations (associate a VPN gateway).
  	Not applicable	192.168.10.0/24	IPsec-VPN connection 4

• The route table of the VPC associated with the VPN gateway instance must not contain a route whose destination CIDR block is a subnet of the Client CIDR Block of the SSL server or a subnet of the Client CIDR Block of the IPsec server, and whose next hop is the VPN gateway instance.

  For example, the Client CIDR Block of an SSL server is 192.168.10.0/24. In this case, the route table of the VPC that is associated with the VPN gateway cannot contain a route whose destination CIDR block is a subnet such as 192.168.10.0/25 or 192.168.10.0/26 and whose next hop is the VPN gateway instance.

  You can manage custom routes in the route table of the VPC. For more information, see Create and manage a route table.

• If multiple IPsec-VPN connections with BGP are created on the VPN gateway instance, their BGP tunnel CIDR blocks must be unique.

  You can modify the CIDR block of a BGP tunnel. For more information, see Modify an IPsec-VPN connection.

• You must select two VSwitches from the VPC that is associated with the VPN gateway instance and ensure the VSwitches have enough available IP addresses.

  • The zones to which the VSwitches belong must support dual-tunnel mode for IPsec-VPN connections. For information about the supported zones, see Supported regions and zones.

  • If multiple zones in the current region support dual-tunnel mode for IPsec-VPN connections, the two VSwitches that you select must belong to different zones to implement zone-level disaster recovery for the IPsec-VPN connection. Each VSwitch must have at least two available IP addresses.

  • If only one zone in the current region supports dual-tunnel mode for IPsec-VPN connections, you must select two VSwitches from this zone:

    • If you select the same VSwitch, make sure that the VSwitch has at least four available IP addresses.

    • If you select two different VSwitches, make sure that each VSwitch has at least two available IP addresses.

Upgrade impact

• The upgrade takes about 10 minutes, during which the VPN gateway instance cannot forward traffic.

• You cannot perform operations on the VPN gateway instance during the upgrade.

Procedure

1. Log on to the VPN gateway console.

2. In the top navigation bar, select the region where the VPN gateway instance resides.

3. On the VPN Gateways page, find the target VPN gateway instance and click the instance ID.

4. In the upper-right corner of the instance details page, click Enable Zone Redundancy.

5. In the Enable Zone Redundancy dialog box, select the VSwitches and run a precheck. After you confirm that the environment meets the prerequisites and you understand the upgrade risks, click Enable.

   • If the precheck fails, troubleshoot the issue based on the prerequisites. For more information, see Prerequisites.

   • After you click Enable, the system immediately starts the upgrade. Wait for the upgrade to complete.

Next steps

• If the VPC that is associated with a VPN gateway instance is connected to a Cloud Enterprise Network (CEN), and the VPC's route table contains a custom route entry that points to the VPN gateway instance and has been published to CEN, the status of the route entry changes to unpublished after the upgrade is complete. You need to republish the route entry to CEN. For more information, see Publish a route to a transit router.

• If the IPsec-VPN feature is retained for the VPN gateway instance, after the upgrade, the standby tunnel is unavailable by default. You must configure the peer gateway device to enable it. For more information, see Get started with traditional VPN gateways and Connect a VPC to a data center (dual-tunnel mode and BGP routing).

  • After the upgrade, the VPN gateway instance has two IPsec addresses: its original address and a new one allocated by the system. These two IP addresses are used to create two encrypted tunnels. In the instance list of the VPN Gateway console, the IP Address column displays two public IP addresses, IPsec Address 1 and IPsec Address 2, which correspond to the active and standby tunnels.

  • After the upgrade, an IPsec-VPN connection has an active and a standby tunnel. By default, the two tunnels are associated with the same customer gateway. The active tunnel is the tunnel that exists before the upgrade, and its configuration remains unchanged. The standby tunnel is unavailable by default. On the Tunnel tab of the IPsec-VPN connection details page, the connection status of both Tunnel 1 (active) and Tunnel 2 (standby) is Phase 1 IKE-SA negotiation failed.

• If the SSL-VPN feature is retained for the VPN gateway instance, the SSL-VPN configurations remain unchanged after the upgrade. You can enable the IPsec-VPN feature for the VPN gateway instance and create an IPsec-VPN connection in dual-tunnel mode. For more information, see Procedure and IPsec-VPN connections (associate a VPN gateway).

  After the upgrade, the VPN gateway IP address is repurposed as the SSL address and is used exclusively for the SSL-VPN feature. After you enable the IPsec-VPN feature, the system reallocates two IPsec addresses to the VPN gateway instance to create an IPsec-VPN connection in dual-tunnel mode. In the VPN gateway instance list, you can view the SSL Address field to confirm that the SSL-VPN connection address is retained.