Enterprises with strict security compliance requirements, such as those in finance and healthcare, may need to use leased lines to connect to the cloud, encrypt sensitive data in transit, or avoid using public IP addresses for IPsec-VPN connections. Private IPsec-VPN connections allow these enterprises to connect to VPCs on Alibaba Cloud through Express Connect circuits and transit routers, using private IP addresses to encrypt traffic between a customer gateway device and a transit router.
How it works
Private IPsec-VPN connections are based on Express Connect circuits and transit routers. To connect a data center to the cloud, deploy an Express Connect circuit and a transit router to connect the data center to a VPC. Then, assign one or two private IP addresses to the customer gateway device, specify the transit router CIDR block, and specify the VPN gateway IP address for creating IPsec-VPN connections. Ensure that the private IP addresses support private communication between the customer gateway device and the transit router. Each private IPsec-VPN connection between the customer gateway device and the transit router has two tunnels. In a multi-zone region, the two tunnels are deployed in different zones to ensure high availability. After a private IPsec-VPN connection is created, configure routes to direct private traffic between the data center and VPC over the connection. This encrypts private traffic transmitted over the Express Connect circuit to meet security compliance requirements.
The second figure shows how a client in the data center accesses an ECS instance in the VPC, with private traffic encrypted and transmitted over the Express Connect circuit.
Use scenarios
Combine private IPsec-VPN connections with the routing control features of transit routers to control which private traffic is encrypted and transmitted.
Encrypt and transmit all private traffic
Encrypt and transmit private traffic from different environments
Encrypt and transmit partial private traffic
References
If your customer gateway device supports BGP dynamic routing, we recommend that you use BGP dynamic routing to encrypt and transmit data over Express Connect circuits.
-
For more information about BGP dynamic routing, see the following topics:
-
If your customer gateway device does not support BGP dynamic routing, see Encrypt private traffic over Express Connect with static routing.