VPN Gateway:Encrypt private traffic over Express Connect with BGP

Deploy an Express Connect circuit

1. Apply for an Express Connect circuit in the China (Hangzhou) region. See Requesting Classic Mode or Overview of hosted connections. This example uses a dedicated connection.

2. Create a Virtual Border Router (VBR).

   1. Log on to the Express Connect console.

   2. In the left-side navigation pane, click Virtual Border Routers (VBRs).

   3. In the top navigation bar, select the China (Hangzhou) region. The VBR and Express Connect circuit must be in the same region.

   4. On the Virtual Border Routers (VBRs) page, click Create VBR.

   5. In the Create VBR panel, set the following parameters and click OK. For other parameters, use the defaults. For details, see Create and manage VBRs.

   Parameter	Value
   Name	VBR
   Physical Connection Information	Select Dedicated Physical Connection, then select your Express Connect circuit
   VLAN ID	0
   Alibaba Cloud Side IPv4 Address	10.0.0.1
   Data Center Side IPv4 Address	10.0.0.2
   IPv4 Subnet Mask	255.255.255.252

3. Configure a BGP group for the VBR.

   1. On the Virtual Border Routers (VBRs) page, click the VBR ID.

   2. On the details page, click the BGP Groups tab.

   3. Click Create BGP Group, set the following parameters, and click OK. For details, see Configure BGP.

      • Name: VBR-BGP

      • Peer ASN: 65530 (the ASN of the customer gateway device)

      • Local ASN: 65534 (the BGP ASN of the VBR)

4. Configure a BGP peer for the VBR.

   1. On the VBR details page, click the BGP Peers tab.

   2. Click Create BGP Peer.

   3. In the Create BGP Peer panel, set the following parameters and click OK:

      • BGP Group: VBR-BGP

      • BGP Peer IP Address: 10.0.0.1 (the IP address of the interface on the customer gateway device that connects to the Express Connect circuit)

5. Configure BGP routing on the customer gateway device. Log on to the Cisco ASA CLI and enter configuration mode:

   This example uses Cisco ASA software version 9.19.1. Commands may vary by software version. Consult your vendor documentation for your specific environment. For gateway configuration guidance, see Configure local gateways. The following configurations contain third-party product information provided for reference only. Alibaba Cloud makes no guarantees regarding third-party product performance, reliability, or the impact of operations performed using these products.

   Important

   Advertise the data center CIDR block to the VBR using a short subnet mask. This ensures that the more specific CIDR block advertised to the IPsec-VPN connection takes priority, routing traffic through the encrypted path.

   ciscoasa> enable
   Password: ********             # Enter the password for enable mode.
   ciscoasa# configure terminal   # Enter configuration mode.
   ciscoasa(config)#

   Verify interface configurations. This example uses the following:

   ciscoasa(config)# show running-config interface
   !
   interface GigabitEthernet0/0                # Connects to the VBR.
    nameif VBR
    security-level 0
    ip address 10.0.0.1 255.255.255.252        # IP address of GigabitEthernet0/0.
   !
   interface GigabitEthernet0/2                # Connects to the data center.
    nameif private
    security-level 100                         # Security level must be lower than the interface connecting to Alibaba Cloud.
    ip address 192.168.50.215 255.255.255.0    # IP address of GigabitEthernet0/2.
   !
   interface GigabitEthernet0/3                # Connects to private IPsec-VPN tunnel 1.
    nameif VPN-IP1
    security-level 0
    ip address 192.168.10.136 255.255.255.0    # Private IP address of GigabitEthernet0/3.
   !
   interface GigabitEthernet0/4                # Connects to private IPsec-VPN tunnel 2.
    nameif VPN-IP2
    security-level 0
    ip address 192.168.40.159  255.255.255.0   # Private IP address of GigabitEthernet0/4.
   !

   Configure prefix-list and route-map, then configure BGP routing:

   # Configure prefix-list and route-map.
   prefix-list VBR permit 192.168.0.0/16
   route-map VBR permit 10
    match ip address prefix-list VBR
   
   # Configure BGP routing.
   router bgp 65530                         # Enable BGP with the data center ASN.
   bgp router-id 10.0.0.1                   # BGP router ID.
   
   address-family ipv4 unicast
   neighbor 10.0.0.2 remote-as 65534        # Establish a peering connection to the VBR.
   neighbor 10.0.0.2 activate               # Activate the BGP peer.
   neighbor 10.0.0.2 route-map VBR out      # Advertise only large CIDR block routes to the VBR.
   network 192.168.0.0 mask 255.255.0.0     # Advertise the data center CIDR block with a short mask.
   exit-address-family
   !
   
   # Add a static route to the client in the data center.
   route private 192.168.0.0 255.255.0.0 192.168.50.216

Configure a transit router

After the Express Connect circuit is up, configure a transit router to connect the data center and VPC.

1. Create a Cloud Enterprise Network (CEN) instance. In the Create CEN Instance dialog box, click Create CEN Only, enter a name, and use the default settings for other parameters.

2. Create an Enterprise Edition transit router in the China (Hangzhou) region.

3. Create a VPC connection.

   1. Click Create More Connections to return to the Connection with Peer Network Instance page.

   Parameter	Value
   Instance Type	Virtual Private Cloud (VPC)
   Region	China (Hangzhou)
   Attachment Name	VPC-Attachment
   Network Instance	Your VPC
   vSwitch	vSwitch 2 and vSwitch 3. Select at least two zones and one vSwitch per zone. Use idle vSwitches.
   Advanced Settings	Use the defaults. All advanced features are enabled.

4. Create a VBR connection. On the Connection with Peer Network Instance page, configure the following parameters and click OK. For details, see Connect a VBR to a transit router.

   Parameter	Value
   Instance Type	Virtual Border Router (VBR)
   Region	China (Hangzhou)
   Attachment Name	VBR-Attachment
   Network Instance	VBR
   Advanced Settings	Use the defaults. All advanced features are enabled.

Verify the connection

Make sure security group rules on the ECS instances allow ICMP traffic and access from the data center CIDR block. The data center access control rules must also allow ICMP traffic and access from the VPC. See View security group rules and Add a security group rule.

1. Connect to ECS 1 in the VPC. See Connection method overview.

2. Run the following command to ping a client in the data center:

   ping <the IP address of a client in the data center>

   If ECS 1 receives a response, the data center and VPC are connected.

   

Create the private IPsec-VPN connection

1. Add the CIDR block 10.10.10.0/24 to the transit router. For details, see Transit router CIDR blocks. Gateway IP addresses allocated from this CIDR block are used for the private IPsec-VPN endpoints. This CIDR block must not overlap with the data center or VPC CIDR blocks used for communication.

2. Create two customer gateways to register the VPN IP addresses and BGP ASN of the customer gateway device with Alibaba Cloud.

   1. Log on to the VPN gateway console.

   2. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

   3. On the Customer Gateway page, click Create Customer Gateway.

   4. Create the following two customer gateways. For other parameters, use the defaults. For details, see Customer gateway.

      • Customer Gateway 1

        • Name: Customer-Gateway1

        • IP Address: 192.168.10.136

        • ASN: 65530

      • Customer Gateway 2

        • Name: Customer-Gateway2

        • IP Address: 192.168.40.159

        • ASN: 65530

3. Create the IPsec-VPN connection. After the connection is created, the details page shows the gateway IP addresses used to create the private IPsec-VPN connections.

   1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

   2. On the IPsec Connections page, click Bind CEN.

   3. Configure the following parameters and click OK. For details, see Create and manage dual-tunnel connections.

   Important

   The pre-shared key on the IPsec-VPN connection must match the pre-shared key configured on the customer gateway device. A mismatch prevents the connection from being established.

   Select encryption parameters that match your on-premises gateway device to ensure IKE and IPsec configurations are consistent on both sides.

   Parameter	Value
   Name	IPsecConnection
   Region	The region of the transit router. The IPsec-VPN connection is created in the same region as the transit router.
   Gateway Type	Private
   Bind CEN	Same Account
   CEN Instance ID	Select the CEN instance that connects the data center and VPC. The system displays the transit router instance ID and CIDR block.
   Transit Router	Automatically populated by the system.
   Routing Mode	Destination Routing Mode
   Enable BGP	Enabled
   Local ASN	65534
   Tunnel 1 — Customer Gateway	Customer-Gateway1
   Tunnel 1 — Pre-Shared Key	fddsFF111****
   Tunnel 1 — Encryption Configuration	Use the defaults except: set DH Group to group14 in both the IKE and IPsec configurations. Match the on-premises gateway device settings.
   Tunnel 1 — BGP Configuration	Tunnel CIDR Block: 169.254.10.0/30; Local BGP IP address: 169.254.10.1
   Tunnel 2 — Customer Gateway	Customer-Gateway2
   Tunnel 2 — Pre-Shared Key	fddsFF222****
   Tunnel 2 — Encryption Configuration	Use the defaults except: set DH Group to group14 in both the IKE and IPsec configurations. Match the on-premises gateway device settings.
   Tunnel 2 — BGP Configuration	Tunnel CIDR Block: 169.254.20.0/30; Local BGP IP address: 169.254.20.1
   Advanced Configuration	Use the defaults. All advanced features are enabled.

4. On the IPsec Connections page, find the IPsec-VPN connection and click Generate Peer Configuration in the Actions column.

5. In the IPsec Connection Configuration dialog box, copy and save the peer configurations. You need these when configuring the customer gateway device.

6. Configure the customer gateway device. After this configuration, the customer gateway device establishes private IPsec-VPN connections to Alibaba Cloud, but BGP peers are not yet configured. Check the connection status on the IPsec-VPN connection details page. If connections are not established, see Self-service diagnostics.

   1. Log on to the CLI of the Cisco firewall and enter configuration mode: ciscoasa> enable Password: ******** # Enter the password for enable mode. ciscoasa# configure terminal # Enter configuration mode. ciscoasa(config)#

   2. View interface and route configurations. Verify that the tunnel interfaces are configured and enabled:

      ciscoasa(config)# show running-config interface ! interface GigabitEthernet0/3                # Connects to private IPsec-VPN tunnel 1. nameif VPN-IP1 security-level 0 ip address 192.168.10.136 255.255.255.0    # Private IP address of GigabitEthernet0/3. ! interface GigabitEthernet0/4                # Connects to private IPsec-VPN tunnel 2. nameif VPN-IP2 security-level 0 ip address 192.168.40.159  255.255.255.0   # Private IP address of GigabitEthernet0/4. !

   3. Enable IKEv2 on both interfaces: crypto ikev2 enable VPN-IP1 crypto ikev2 enable VPN-IP2

   4. Create an IKEv2 policy. The values must match those configured on Alibaba Cloud.

      Important

      Specify only one value for each of the encryption algorithm, authentication algorithm, and DH group in the IKE phase. Use the same values as configured on Alibaba Cloud.

      crypto ikev2 policy 10 encryption aes             # Encryption algorithm. integrity sha              # Authentication algorithm. group 14                   # DH group. prf sha                    # Must match the integrity value. lifetime seconds 86400     # SA lifetime.

   5. Create an IPsec proposal and profile. The values must match those configured on Alibaba Cloud.

      Important

      Specify only one value for each of the encryption algorithm, authentication algorithm, and DH group in the IPsec phase. Use the same values as configured on Alibaba Cloud.

      crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL protocol esp encryption aes                         # Encryption algorithm. Alibaba Cloud uses ESP. protocol esp integrity sha-1                        # Authentication algorithm. Alibaba Cloud uses ESP. crypto ipsec profile ALIYUN-PROFILE set ikev2 ipsec-proposal ALIYUN-PROPOSAL set ikev2 local-identity address                    # Set local ID format to IP address, matching Alibaba Cloud. set pfs group14                                     # PFS and DH group. set security-association lifetime seconds 86400     # Time-based SA lifetime. set security-association lifetime kilobytes unlimited # Disable traffic-based SA lifetime.

   6. Create tunnel groups and specify pre-shared keys. The keys must match those on Alibaba Cloud.

      tunnel-group 10.10.10.49 type ipsec-l2l                    # Tunnel 1: set encryption mode to l2l. tunnel-group 10.10.10.49 ipsec-attributes ikev2 remote-authentication pre-shared-key fddsFF111**  # Peer pre-shared key for Tunnel 1. ikev2 local-authentication pre-shared-key fddsFF111   # Local pre-shared key for Tunnel 1. ! tunnel-group 10.10.10.50 type ipsec-l2l                    # Tunnel 2: set encryption mode to l2l. tunnel-group 10.10.10.50 ipsec-attributes ikev2 remote-authentication pre-shared-key fddsFF222  # Peer pre-shared key for Tunnel 2. ikev2 local-authentication pre-shared-key fddsFF222**   # Local pre-shared key for Tunnel 2. !

   7. Create tunnel interfaces:

      interface Tunnel1                                  # Tunnel 1 interface. nameif ALIYUN1 ip address 169.254.10.2 255.255.255.252           # Interface IP address. tunnel source interface VPN-IP1                   # Source: GigabitEthernet0/3. tunnel destination 10.10.10.49                    # Destination: Alibaba Cloud Tunnel 1 private IP. tunnel mode ipsec ipv4 tunnel protection ipsec profile ALIYUN-PROFILE no shutdown                                       # Enable the interface. ! interface Tunnel2                                  # Tunnel 2 interface. nameif ALIYUN2 ip address 169.254.20.2 255.255.255.252           # Interface IP address. tunnel source interface VPN-IP2                   # Source: GigabitEthernet0/4. tunnel destination 10.10.10.50                    # Destination: Alibaba Cloud Tunnel 2 private IP. tunnel mode ipsec ipv4 tunnel protection ipsec profile ALIYUN-PROFILE no shutdown                                       # Enable the interface. !

Configure routes

At this point, traffic still flows unencrypted over the Express Connect circuit. Configure BGP routing and transit router routes to shift traffic to the encrypted VPN path.

1. Add BGP routing configuration on the customer gateway device. Advertise more specific routes to the IPsec-VPN tunnels than to the VBR.

   Important

   The CIDR blocks advertised to the IPsec-VPN connection must be more specific than those advertised to the VBR. This ensures the transit router prefers the VPN path for traffic destined for the data center.

   # Configure prefix-list and route-map.
   prefix-list VPN permit 192.168.10.0/16
   prefix-list VPN permit 192.168.20.0/16
   prefix-list VPN permit 192.168.40.0/16
   
   route-map VPN permit 10
    match ip address prefix-list VPN
   
   # Configure BGP peers between the customer gateway device and the IPsec-VPN connection.
   router bgp 65530
    address-family ipv4 unicast
     neighbor 169.254.10.1 remote-as 65534       # BGP peer: Tunnel 1 IP on the Alibaba Cloud side.
     neighbor 169.254.10.1 activate
     neighbor 169.254.10.1 route-map VPN out     # Advertise specific routes to Tunnel 1.
     neighbor 169.254.20.1 remote-as 65534       # BGP peer: Tunnel 2 IP on the Alibaba Cloud side.
     neighbor 169.254.20.1 activate
     neighbor 169.254.20.1 route-map VPN out     # Advertise specific routes to Tunnel 2.
     maximum-paths 5                             # Increase ECMP route entries.
     network 192.168.10.0 mask 255.255.255.0     # Data center CIDR block — more specific than the route advertised to the VBR.
     network 192.168.20.0 mask 255.255.255.0
     network 192.168.40.0 mask 255.255.255.0
    exit-address-family

2. Add custom routes in the transit router route table. After the BGP configuration above takes effect, the IPsec-VPN connections may be interrupted because routes to the VPN IP addresses (192.168.10.136 and 192.168.40.159) no longer exist in the transit router route table. Add host routes pointing to these IPs with the VBR as the next hop to restore connectivity.

   1. On the Route Table tab of the CEN console, click the Route Entry tab and click Add Route Entry.

   2. In the Add Route Entry dialog box, create the following two route entries and click OK:

   Parameter	CIDR block 1	CIDR block 2
   Destination CIDR	192.168.10.136/32	192.168.40.159/32
   Whether it is a black hole route	No	No
   Next Hop Connection	VBR-Attachment	VBR-Attachment

3. Create routing policies on the transit router to lower the priority of VPC routes advertised by the VBR. This ensures data center traffic to the VPC prefers the IPsec-VPN path. Routing policy 1 — Lower the priority of VPC routes advertised by the VBR to the data center: Routing policy 2 — Prevent VPN IP addresses from being propagated to the data center via the VBR, which would create a routing loop:

   1. Log on to the CEN console.

   2. On the Instances page, click the CEN instance ID.

   3. On the details page, find the transit router in the China (Hangzhou) region and click its ID.

   4. On the transit router details page, click the Route Table tab, then click Route Maps.

   5. On the Route Maps tab, click Add Route Map and create the following two routing policies. For details, see Route map overview.

   Parameter	Value
   Policy Priority	30
   Associated Route Table	Use the default
   Direction	Egress Regional Gateway
   Match Conditions	Destination Instance IDs: select the VBR ID Route Prefix: 172.16.10.0/24 and 172.16.20.0/24, Exact Match
   Policy Action	Allow
   Add Action Object	Prepend AS Path: 65525, 65526, 65527

   Parameter	Value
   Policy Priority	40
   Associated Route Table	Use the default
   Direction	Egress Regional Gateway
   Match Conditions	Destination Instance IDs: select the VBR ID Route Prefix: 192.168.10.136/32 and 192.168.40.159/32, Exact Match
   Policy Action	Reject

   

Verify encryption

After completing the configuration, verify that traffic is flowing through the encrypted IPsec-VPN path by checking the data transfer statistics on the IPsec-VPN connection details page.

1. Connect to ECS 1 in the VPC and run the following command to generate traffic:

   • -s 1000: Send packets of 1,000 bytes.

   • -c 10000: Send 10,000 packets.

   ping <IP address of a client in the data center> -s 1000 -c 10000

2. Log on to the VPN Gateway console.

3. In the top navigation bar, select the China (Hangzhou) region.

4. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

5. Find the IPsec-VPN connection and click its ID to open the details page. If data transfer statistics are visible on the details page, traffic is encrypted.