VPN Gateway:Express Connect and IPsec-VPN as primary and backup links

Example scenario

This topic describes a redundant network architecture that uses an Express Connect link and an IPsec connection as primary and backup links.

In this scenario, the Express Connect link uses Border Gateway Protocol (BGP), and the IPsec connection uses BGP or a static route.

Resource planning

Alibaba Cloud resource plan:

• VPC: A VPC with the CIDR block 10.0.0.0/16 in the Germany (Frankfurt) region.

  • vSwitch 1: 10.0.0.0/24, which contains an ECS instance with the IP address 10.0.0.1 for connectivity tests.

  • vSwitch 2: 10.0.1.0/24.

• TR: A CEN instance and a transit router (TR) with the CIDR block 10.3.0.0/24 are created in the Germany (Frankfurt) region.

• ECR: An Express Connect Router (ECR) with Autonomous System Number (ASN) 65001.

• VBR: A physical port is created to connect to the on-premises gateway device, and a Virtual Border Router (VBR) is created based on this port.

  • Alibaba Cloud Side IPv4 Address: 10.1.0.1.

  • Data Center Side IPv4 Address: 10.1.0.2.

  • IPv4 Subnet Mask: 255.255.255.252.

• IPsec connection:

  • If you use BGP, the BGP settings are as follows:

    • Tunnel 1: The tunnel CIDR block is 169.254.10.0/30, and the Alibaba Cloud-side BGP IP address is 169.254.10.1.

    • Tunnel 2: The tunnel CIDR block is 169.254.20.0/30, and the Alibaba Cloud-side BGP IP address is 169.254.20.1.

• Alibaba Cloud-side ASN: 65001.

On-premises IDC resource plan:

• On-premises network: 172.16.0.0/16, which contains a server with the IP address 172.16.0.1 for connectivity tests.

• On-premises gateway device:

  • Connects to Alibaba Cloud through an Express Connect link. The IP address of the network interface for the Express Connect link is 10.1.0.2.

  • Supports the IPsec-VPN feature. If you use BGP, the BGP settings are as follows:

    • Tunnel 1: The tunnel CIDR block is 169.254.10.0/30, and the on-premises BGP IP address is 169.254.10.2.

    • Tunnel 2: The tunnel CIDR block is 169.254.20.0/30, and the on-premises BGP IP address is 169.254.20.2.

    If the IPsec connection uses static routes, make sure your on-premises gateway device supports static Equal-Cost Multi-Path (ECMP) routing. When you associate the IPsec connection with a TR, the two tunnels automatically form an ECMP link for traffic from the cloud to your on-premises IDC. If your on-premises IDC does not support ECMP for traffic to the cloud, asymmetric routing occurs.

  • A single public IP address is used for outbound traffic: 3.3.XX.XX. This public IP address is used to establish the IPsec connection.

• On-premises ASN: 65002.

Step 1. Create resources

1. In the Germany (Frankfurt) region, create a dedicated or shared physical port and connect it to the on-premises gateway device.

2. Create the VPC and vSwitches, ECS instance, CEN instance, TR, ECR, and VBR as defined in the resource plan.

Step 2. Connect the Express Connect link

ping 172.16.0.1

Step 3. Connect the IPsec connection

Step 4. Configure the primary and backup links

• Primary/backup path selection for outbound traffic (Alibaba Cloud-side configuration)

  Per TR route priorities, routes from a VBR or ECR instance have higher priority than routes from an IPsec connection. Therefore, no additional configuration is required. Outbound traffic from the cloud automatically prefers the Express Connect link.

• Primary/backup path selection for inbound traffic (on-premises IDC-side configuration)

  Set the route priorities on your on-premises gateway device:

  • If the IPsec connection uses BGP routing, set the priority as follows: BGP routes learned over the Express Connect link > BGP routes learned over the IPsec connection.

  • If the IPsec connection uses static routing, set the priority as follows: BGP routes learned over the Express Connect link > static routes with the next hop pointing to the IPsec connection.

  The following example shows the configuration on a Cisco ASA firewall (software version 9.19.1) where the IPsec connection uses BGP routing.

  Important

  Configuration commands may vary based on the software version. When you perform the operations, refer to the documentation for your environment or consult the relevant vendors. The information about third-party products is for reference only. Alibaba Cloud does not make any warranties, express or implied, with respect to the performance and reliability of third-party products, nor does it assume any liability for any potential issues that may arise from using such products.

  router bgp 65002
   bgp router-id 10.1.0.2
   bgp log-neighbor-changes
  
   address-family ipv4 unicast
    network 172.16.0.0 mask 255.255.0.0
  
    neighbor 10.1.0.1 remote-as 65001
    neighbor 10.1.0.1 activate
    neighbor 10.1.0.1 weight 1000       #Set the weight of routes learned over the Express Connect link to 1000.
  
    neighbor 169.254.10.1 remote-as 65001
    neighbor 169.254.10.1 ebgp-multihop 255
    neighbor 169.254.10.1 activate
    neighbor 169.254.10.1 weight 500    #Set the weight of routes learned over the IPsec connection to 500. This weight is lower than that of routes learned over the Express Connect link to ensure that traffic from the on-premises IDC to the VPC is preferentially transmitted over the Express Connect link.
   exit-address-family

Step 5. Verify failover

After confirming the routes are correct, use the Express Connect fault drill feature to test the backup link's reliability.

1. Start a continuous ping test

   On the ECS instance, run a continuous ping test to the on-premises server. Do not close the terminal.

   On a Linux system, run: ping 172.16.0.1.

   On a Windows system, run: ping -t 172.16.0.1.

2. Start a fault drill

   Use the Express Connect fault drill feature to simulate an Express Connect link failure. For this example, the drill duration is 5 minutes.

   Warning

   A fault drill simulates a failure by shutting down the specified resource, which places the resource in an artificial fault state. Make sure that you have prepared for any potential service disruptions.

3. Observe the status changes during and after the drill

   • Continuous ping test results

     • When the drill starts: The ping is briefly interrupted and then resumes, but with a significantly higher latency than before the drill. This indicates that traffic has automatically failed over to the IPsec connection.

     • When the drill ends: The ping latency returns to its pre-drill level. This indicates that traffic has failed back to the Express Connect link.

   • Traffic trends on the network instance connections attached to the TR

     In the Monitoring column of the network instance connection, click the corresponding monitoring icon to observe the metric trends.

     • When the drill starts: Traffic on the ECR connection drops to zero, and traffic on the VPN connection increases. This indicates that traffic has automatically failed over from the Express Connect link to the VPN backup link.

     • When the drill ends: Traffic on the VPN connection drops to zero, and traffic on the ECR connection resumes. This indicates that traffic has automatically failed back from the VPN link to the Express Connect primary link.

   • TR route table entries

     • When the drill starts: The route to the ECR connection is withdrawn. The status of the route entry pointing to the VPN connection changes from Candidate to Available, and the next hop switches to the VPN backup link.

     • When the drill ends: The route to the ECR connection is re-advertised and becomes the active route due to its higher priority. The status of the route entry pointing to the VPN connection reverts to Candidate, and the next hop fails back to the Express Connect primary link.