VPN Gateway:Encrypt private traffic over Express Connect with static routing

Step 1a: Deploy an Express Connect circuit

1. Apply for an Express Connect circuit in the China (Hangzhou) region. See Requesting Classic Mode or Overview of hosted connections. This example uses a dedicated physical connection.

2. Create a VBR.

   1. Log on to the Express Connect console.

   2. In the left navigation pane, click Virtual Border Routers (VBRs).

   3. In the top navigation bar, select China (Hangzhou). The VBR and Express Connect circuit must be in the same region.

   4. Click Create VBR.

   5. In the Create VBR panel, set the following parameters and click OK. For all other parameters, use the default values. See Create and manage VBRs.

   Parameter	Example value
   Name	VBR
   Physical connection information	Select Dedicated Physical Connection and choose the Express Connect circuit you deployed
   VLAN ID	0
   Alibaba Cloud side IPv4 address	10.0.0.1
   Data center side IPv4 address	10.0.0.2
   IPv4 subnet mask	255.255.255.252

3. Add a route pointing to the data center on the VBR.

   1. On the Virtual Border Routers (VBRs) page, click the VBR ID.

   2. Click the Routes tab, then the Custom route entry tab, and click Add route.

   3. In the Add route panel, configure the following parameters and click OK.

   Important

   Use a short mask (/16) here. This lets the more specific IPsec-VPN routes (/24) take priority over this route when the tunnel is active.

   Parameter	Example value
   Next hop type	Express Connect Circuit
   Destination CIDR block	192.168.0.0/16
   Next hop	The Express Connect circuit you deployed

4. Add a route pointing to the VPC on the customer gateway device. Verify that the interfaces are already configured on the Cisco firewall:

   Note

   This example uses Cisco Adaptive Security Appliance (ASA) software version 9.19.1. Commands may vary across versions — refer to your vendor's documentation for your environment. See Configure local gateways. The following Cisco configuration is provided for reference only. Alibaba Cloud makes no guarantees about the performance or reliability of third-party products.

   ciscoasa> enable
   Password: ********             # Enter the enable mode password.
   ciscoasa# configure terminal   # Enter configuration mode.
   ciscoasa(config)#
   
   ciscoasa(config)# show running-config interface
   !
   interface GigabitEthernet0/0                # Connects to the VBR.
    nameif VBR
    security-level 0
    ip address 10.0.0.1 255.255.255.252
   !
   interface GigabitEthernet0/2                # Connects to the data center.
    nameif private
    security-level 100                         # Must be lower than the interface connecting to Alibaba Cloud.
    ip address 192.168.50.215 255.255.255.0
   !
   interface GigabitEthernet0/3                # Connects to private IPsec-VPN tunnel 1.
    nameif VPN-IP1
    security-level 0
    ip address 192.168.10.136 255.255.255.0
   !
   interface GigabitEthernet0/4                # Connects to private IPsec-VPN tunnel 2.
    nameif VPN-IP2
    security-level 0
    ip address 192.168.40.159  255.255.255.0
   !
   
   # Static route to the VPC (172.16.0.0/16).
   route VBR 172.16.0.0 255.255.0.0 10.0.0.2
   
   # Route to the data center client subnet.
   route private 192.168.0.0 255.255.0.0 192.168.50.216

Step 1b: Configure a transit router

1. Create a Cloud Enterprise Network (CEN) instance. In the Create CEN instance dialog box, click Create CEN Only, enter a name, and keep the default settings.

2. Create an Enterprise Edition transit router in the China (Hangzhou) region to connect the VBR and VPC. Keep the default settings.

3. Create a VPC connection.

   1. Click Create More Connections to return to the Connection with peer network instance page.

   Parameter	Value
   Instance type	Virtual Private Cloud (VPC)
   Region	China (Hangzhou)
   Attachment name	VPC-Attachment
   Network instance	Your VPC
   vSwitch	vSwitch 2 and vSwitch 3. If the region has multiple zones, select at least two zones with one vSwitch each. Use idle vSwitches.
   Advanced settings	Default (all advanced features enabled)

4. Create a VBR connection on the same page. Configure the following parameters and click OK. See Connect a VBR to a transit router.

   Parameter	Value
   Instance type	Virtual Border Router (VBR)
   Region	China (Hangzhou)
   Attachment name	VBR-Attachment
   Network instance	VBR
   Advanced settings	Default (all advanced features enabled)

Step 1c: Verify connectivity

Before adding encryption, confirm that the data center and VPC can communicate.

1. Connect to ECS 1. See Connection method overview.

2. Ping a client in the data center:

   ping <the IP address of a client in the data center>

If ECS 1 receives replies, the data center and VPC are connected.

Step 2a: Create a private IPsec-VPN connection

1. Add the CIDR block 10.10.10.0/24 to the transit router. See Transit router CIDR blocks. The system allocates gateway IP addresses from this block for the IPsec tunnels. Make sure this block does not overlap with the data center or VPC CIDR blocks.

2. Register both VPN IP addresses of the customer gateway device as customer gateways.

   • Customer-Gateway1: IP address 192.168.10.136

   • Customer-Gateway2: IP address 192.168.40.159

   1. Log on to the VPN Gateway consoleVPN Gateway console.

   2. In the left navigation pane, choose Interconnections > VPN > Customer Gateways.

   3. On the Customer Gateway page, click Create Customer Gateway.

   4. Create two customer gateways with the following settings. For all other parameters, use the default values. See Customer gateway.

3. Create an IPsec-VPN connection. After the connection is created, the details page shows the gateway IP addresses allocated for the two tunnels.

   1. In the left navigation pane, choose Interconnections > VPN > IPsec Connections.

   2. On the IPsec Connections page, click Bind CEN.

   3. On the Create IPsec-VPN Connection page, configure the following parameters and click OK. For all other parameters, use the default values. See Create and manage dual-tunnel connections.

   Important

   The pre-shared key must match the pre-shared key configured on the customer gateway device. Mismatched keys prevent the tunnel from establishing.

   Note

   Select encryption parameters that match those on your customer gateway device. The IKE and IPsec phases must use identical algorithms on both sides.

   Parameter	Value
   Name	IPsecConnection
   Region	The region of the transit router to attach. The IPsec-VPN connection is created in the same region as the transit router.
   Gateway type	Private
   Bind CEN	Same Account
   CEN instance ID	The CEN instance created in step 1b. The system displays the transit router instance ID and CIDR block.
   Transit Router	Auto-populated from the CEN instance.
   Routing mode	Destination Routing Mode
   Tunnel 1 — Customer gateway	Customer-Gateway1
   Tunnel 1 — Pre-shared key	fddsFF111****
   Tunnel 1 — Encryption configuration	Default values, except: set DH group to group14 in both IKE and IPsec configurations.
   Tunnel 2 — Customer gateway	Customer-Gateway2
   Tunnel 2 — Pre-shared key	fddsFF222****
   Tunnel 2 — Encryption configuration	Default values, except: set DH group to group14 in both IKE and IPsec configurations.
   Advanced configuration	Default (all advanced features enabled)

   

4. On the IPsec Connections page, find the connection and click Generate Peer Configuration in the Actions column.

5. In the IPsec Connection Configuration dialog box, copy and save the configuration. You will need these values when configuring the customer gateway device.

6. Configure the customer gateway device.

   1. Log on to the Cisco ASA CLI and enter configuration mode:

      ciscoasa> enable
      Password: ********             # Enter the enable mode password.
      ciscoasa# configure terminal   # Enter configuration mode.
      ciscoasa(config)#

   2. Verify the interface and route configurations. The tunnel interfaces should already be in place from step 1a:

      ciscoasa(config)# show running-config interface
      !
      interface GigabitEthernet0/3                # Connects to private IPsec-VPN tunnel 1.
       nameif VPN-IP1
       security-level 0
       ip address 192.168.10.136 255.255.255.0
      !
      interface GigabitEthernet0/4                # Connects to private IPsec-VPN tunnel 2.
       nameif VPN-IP2
       security-level 0
       ip address 192.168.40.159  255.255.255.0
      !
      # Routes to the transit router gateway IPs — required to establish the private IPsec-VPN connections.
      route VBR 10.10.10.49 255.255.255.255 10.0.0.2   # Route to tunnel 1 gateway IP on the Alibaba Cloud side.
      route VBR 10.10.10.50 255.255.255.255 10.0.0.2   # Route to tunnel 2 gateway IP on the Alibaba Cloud side.

   3. Enable IKEv2 on the VPN interfaces:

      crypto ikev2 enable VPN-IP1
      crypto ikev2 enable VPN-IP2

   4. Create an IKEv2 policy. The values must match the IKE phase configuration on Alibaba Cloud.

      Important

      Alibaba Cloud accepts only one value each for the encryption algorithm, authentication algorithm, and DH group in the IKE phase. Configure exactly one value on the Cisco firewall to match.

      crypto ikev2 policy 10
       encryption aes         # Encryption algorithm.
       integrity sha          # Authentication algorithm.
       group 14               # DH group.
       prf sha                # Must match the integrity value (sha). This is the default on Alibaba Cloud.
       lifetime seconds 86400 # SA lifetime.

   5. Create an IPsec proposal and profile. The values must match the IPsec phase configuration on Alibaba Cloud.

      Important

      Alibaba Cloud accepts only one value each for the encryption algorithm, authentication algorithm, and DH group in the IPsec phase. Configure exactly one value on the Cisco firewall to match.

      crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL
       protocol esp encryption aes      # Encryption algorithm. Alibaba Cloud uses ESP, so use ESP here.
       protocol esp integrity sha-1     # Authentication algorithm. Alibaba Cloud uses ESP, so use ESP here.
      crypto ipsec profile ALIYUN-PROFILE
       set ikev2 ipsec-proposal ALIYUN-PROPOSAL
       set ikev2 local-identity address              # Local ID format: IP address (matches Alibaba Cloud remote ID format).
       set pfs group14                               # Perfect Forward Secrecy (PFS) DH group.
       set security-association lifetime seconds 86400
       set security-association lifetime kilobytes unlimited  # Disable traffic-based SA lifetime.

   6. Create tunnel groups and set pre-shared keys. The keys must match those configured on Alibaba Cloud.

      tunnel-group 10.10.10.49 type ipsec-l2l                   # Tunnel 1: l2l (LAN-to-LAN) mode.
      tunnel-group 10.10.10.49 ipsec-attributes
       ikev2 remote-authentication pre-shared-key fddsFF111****  # Alibaba Cloud side pre-shared key.
       ikev2 local-authentication pre-shared-key fddsFF111****   # Must match the Alibaba Cloud key.
      !
      tunnel-group 10.10.10.50 type ipsec-l2l                   # Tunnel 2: l2l mode.
      tunnel-group 10.10.10.50 ipsec-attributes
       ikev2 remote-authentication pre-shared-key fddsFF222****  # Alibaba Cloud side pre-shared key.
       ikev2 local-authentication pre-shared-key fddsFF222****   # Must match the Alibaba Cloud key.
      !

   7. Create the tunnel interfaces:

      interface Tunnel1
       nameif ALIYUN1
       ip address 169.254.10.2 255.255.255.252
       tunnel source interface VPN-IP1              # Source: GigabitEthernet0/3 IP address.
       tunnel destination 10.10.10.49               # Destination: tunnel 1 gateway IP on the Alibaba Cloud side.
       tunnel mode ipsec ipv4
       tunnel protection ipsec profile ALIYUN-PROFILE
       no shutdown
      !
      interface Tunnel2
       nameif ALIYUN2
       ip address 169.254.20.2 255.255.255.252
       tunnel source interface VPN-IP2              # Source: GigabitEthernet0/4 IP address.
       tunnel destination 10.10.10.50               # Destination: tunnel 2 gateway IP on the Alibaba Cloud side.
       tunnel mode ipsec ipv4
       tunnel protection ipsec profile ALIYUN-PROFILE
       no shutdown
      !

After completing these steps, check the connection status on the IPsec-VPN connection details page. If the tunnels are not established, run self-service diagnostics. See Self-service diagnostics.

Step 2b: Configure routes

The IPsec-VPN connection is now established, but traffic still flows over the bare Express Connect circuit. Add the following routes to redirect traffic through the encrypted tunnels.

1. Modify routes on the customer gateway device to prefer the IPsec tunnels over the Express Connect circuit:

   Important

   With this configuration, traffic from the data center to the VPC prefers tunnel 1 (metric 4). When tunnel 1 is down, traffic switches to tunnel 2 (metric 5). The Express Connect circuit (metric 10) serves as an unencrypted fallback.

   # Routes to the VPC via the private IPsec-VPN tunnels (lower metric = higher priority).
   route ALIYUN1 172.16.0.0 255.255.0.0 10.10.10.49 4
   route ALIYUN2 172.16.0.0 255.255.0.0 10.10.10.50 5
   
   # Lower the priority of the Express Connect route so it serves as a fallback.
   route VBR 172.16.0.0 255.255.0.0 10.0.0.2  10

2. Add destination routes on the IPsec-VPN connection pointing to the data center.

   1. Log on to the VPN Gateway consoleVPN Gateway console.

   2. In the left navigation pane, choose Interconnections > VPN > IPsec Connections.

   3. In the top navigation bar, select China (Hangzhou).

   4. On the IPsec Connections page, click the ID of the IPsec-VPN connection.

   5. On the Destination-based Route Table tab, click Add Route Entry.

   6. In the Add Route Entry panel, add the following three routes and click OK for each.

   Important

   These routes must use longer prefixes than the VBR route (192.168.0.0/16). The transit router then prefers the IPsec-VPN connection routes for traffic destined to the data center.

   Parameter	CIDR block 1	CIDR block 2	CIDR block 3
   Destination CIDR block	192.168.10.0/24	192.168.20.0/24	192.168.40.0/24
   Next hop type	IPsec-VPN connection	IPsec-VPN connection	IPsec-VPN connection
   Next hop	The IPsec-VPN connection you created	The IPsec-VPN connection you created	The IPsec-VPN connection you created

3. Add custom routes to the transit router route table. Adding the IPsec destination routes in the previous step interrupts the private IPsec-VPN connection because the transit router no longer has a path to the VPN IP addresses of the customer gateway device. Restore connectivity by adding specific host routes through the VBR.

   1. On the Route Table tab in the CEN console, click the Route Entry tab and click Add Route Entry.

   2. In the Add Route Entry dialog box, add the following two routes and click OK for each.

   Parameter	CIDR block 1	CIDR block 2
   Destination CIDR	192.168.10.136/32	192.168.40.159/32
   Whether it is a black hole route	No	No
   Next hop connection	VBR-Attachment	VBR-Attachment

Step 2c: Verify encryption

After completing the configuration, confirm that traffic is flowing through the encrypted tunnel.

1. Connect to ECS 1 and send sustained traffic to a client in the data center:

   • -s 1000: Send 1,000 bytes per packet.

   • -c 10000: Send 10,000 requests.

   ping <IP address of a client in the data center> -s 1000 -c 10000

2. Log on to the VPN Gateway consoleVPN Gateway console.

3. In the top navigation bar, select China (Hangzhou).

4. In the left navigation pane, choose Interconnections > VPN > IPsec Connections.

5. On the IPsec Connections page, click the ID of the IPsec-VPN connection.

If the details page shows data transfer activity, traffic is encrypted and flowing through the private IPsec-VPN connection.