All Products
Search

This Product

    VPN Gateway:IPsec-VPN and CEN: High-speed global network

    Document Center

    VPN Gateway:IPsec-VPN and CEN: High-speed global network

    Last Updated:Jun 20, 2026

    This article describes how to use IPsec-VPN (an IPsec connection on a VPN gateway instance) and CEN (Cloud Enterprise Network) to build a high-quality, cost-effective global enterprise network that enables any-to-any communication between on-premises data centers (IDCs) and VPCs across multiple regions.

    Scenario

    Note

    • If you do not have a public VPN Gateway instance in your Alibaba Cloud account, we recommend associating IPsec-VPN connections with a Transit Router for global any-to-any connectivity.

    • If you already have a public VPN Gateway instance, this topic explains how to achieve global any-to-any connectivity by using IPsec-VPN connections associated with the gateway.

    An enterprise deploys multiple data centers and VPCs across the globe. After the data centers are connected to VPCs through IPsec-VPN connections that are associated with VPN Gateway instances, each data center can communicate only with its associated VPC. By default, VPCs and data centers in different regions cannot communicate with each other. In this scenario, site connectivity is as follows:

    image

    • VPC1 and VPC2 cannot communicate with each other.

    • data center 1 can communicate with VPC1. It can also communicate with data center 2 because they are both connected to the same VPN Gateway instance through an IPsec-VPN connection. However, data center 1 cannot communicate with data center 3, data center 4, or VPC2.

    • data center 2 can communicate with VPC1. It can also communicate with data center 1 because they are both connected to the same VPN Gateway instance through an IPsec-VPN connection. However, data center 2 cannot communicate with data center 3, data center 4, or VPC2.

    • data center 3 can communicate with VPC2. It can also communicate with data center 4 because they are both connected to the same VPN Gateway instance through an IPsec-VPN connection. However, data center 3 cannot communicate with data center 1, data center 2, or VPC1.

    • data center 4 can communicate with VPC2. It can also communicate with data center 3 because they are both connected to the same VPN Gateway instance through an IPsec-VPN connection. However, data center 4 cannot communicate with data center 1, data center 2, or VPC1.

    To enable any-to-any communication across all your global sites, you can use CEN. CEN establishes high-quality, low-latency private connections between VPCs and supports automatic route propagation and learning. This simplifies routing configurations and enables rapid connectivity for VPCs across different regions. This architecture connects data centers in different regions through the interconnected VPCs, creating a fully connected global network.

    image
    Important

    We recommend using static routing when establishing IPsec-VPN connections between data centers and VPN Gateway instances.

    Example scenario

    This example shows how to combine IPsec-VPN and CEN to enable any-to-any communication among global sites. A multinational company has two data centers in the China (Shanghai) region and two in the US (Silicon Valley) region. The company also has VPC1 in the China (Shanghai) region and VPC2 in the US (Silicon Valley) region, with applications deployed on ECS instances in both VPCs. As its business expands, the company needs connectivity among the six sites: data center 1 and data center 2 in the China (Shanghai) region, data center 3 and data center 4 in the US (Silicon Valley) region, VPC1, and VPC2.

    image

    CIDR block planning

    Important

    When you plan your CIDR blocks, ensure that they do not overlap between sites that need to communicate with each other.

    VPC

    VPC name

    VPC region

    VPC CIDR block

    ECS IP address

    VPC1

    China (Shanghai)

    • VPC CIDR block: 192.168.0.0/16

    • vSwitch 1 CIDR block: 192.168.99.0/24, in zone E

    • vSwitch 2 CIDR block: 192.168.100.0/24, in zone F

    ECS1 IP address: 192.168.99.48

    VPC2

    US (Silicon Valley)

    • VPC CIDR block: 10.0.0.0/16

    • vSwitch 1 CIDR block: 10.0.10.0/24, in zone A

    • vSwitch 2 CIDR block: 10.0.20.0/24, in zone B

    ECS2 IP address: 10.0.10.33

    On-premises data center

    Data center name

    Data center region

    On-premises CIDR block

    Gateway public IP

    Client IP address

    Data center 1

    China (Shanghai)

    172.16.10.0/24

    • Public IP 1: 47.XX.XX.23

    • Public IP 2: 47.XX.XX.32

    172.16.10.207

    Data center 2

    China (Shanghai)

    172.16.40.0/24

    • Public IP 1: 47.XX.XX.69

    • Public IP 2: 47.XX.XX.71

    172.16.40.60

    Data center 3

    US (Silicon Valley)

    10.10.10.0/24

    • Public IP 1: 57.XX.XX.11

    • Public IP 2: 57.XX.XX.191

    10.10.10.201

    Data center 4

    US (Silicon Valley)

    10.30.66.0/24

    • Public IP 1: 57.XX.XX.22

    • Public IP 2: 57.XX.XX.234

    10.30.66.11

    Before you begin

    • You have created VPC1 in the China (Shanghai) region and VPC2 in the US (Silicon Valley) region, and deployed services on ECS instances in both VPCs. For more information, see Create a VPC with an IPv4 CIDR block.

    • You have created a public VPN Gateway instance in both the China (Shanghai) and US (Silicon Valley) regions, and enabled the IPsec-VPN feature for both instances. For more information, see Enable IPsec-VPN.

      Note

      This topic uses VPN Gateway instances that support IPsec-VPN connections in dual-tunnel mode. If your VPN Gateway instance supports only single-tunnel mode, we recommend that you upgrade it. IPsec-VPN connections in dual-tunnel mode provide availability zone-level disaster recovery. For more information, see Upgrade an IPsec-VPN connection to dual-tunnel mode.

      The following table lists the information about the VPN Gateway instances, their associated VPC instances, and their system-allocated IP addresses. You will need the IP addresses of the VPN Gateway instances to create IPsec-VPN connections.

      Instance name

      Region

      Gateway Type

      Network type

      Tunnels

      Associated VPC instance

      IP addresses

      VPN Gateway 1

      China (Shanghai)

      Standard

      Public

      Dual-tunnel

      VPC1

      • IPsec address 1: 47.XX.XX.87

      • IPsec address 2: 47.XX.XX.78

      VPN Gateway 2

      US (Silicon Valley)

      Standard

      Public

      Dual-tunnel

      VPC2

      • IPsec address 1: 47.XX.XX.207

      • IPsec address 2: 47.XX.XX.15

    Procedure

    Step 1: Create customer gateways

    You must create customer gateways to register the public IP addresses of your on-premises gateway devices with Alibaba Cloud. A VPN gateway requires a registered customer gateway to establish an IPsec-VPN connection with an on-premises data center.

    1. Log on to the VPN Gateway console.

    2. In the navigation pane on the left, choose Interconnections > VPN > Customer Gateways.

    3. In the top navigation bar, select the region where you want to create the customer gateways.

      Note

      The customer gateway and the VPN gateway must be in the same region.

    4. On the Customer Gateway page, click Create Customer Gateway.

    5. In the Create Customer Gateway panel, configure the customer gateways with the following settings and click OK.

      Create eight customer gateways to register the public IP addresses of the four on-premises gateway devices. The following table describes the required settings. Keep the default values for all other parameters. For more information, see customer gateways.

      Region

      Parameter

      IP address

      China (Shanghai)

      CustomerGateway1

      First public IP address of on-premises gateway device 1: 47.XX.XX.23

      CustomerGateway2

      Second public IP address of on-premises gateway device 1: 47.XX.XX.32

      CustomerGateway3

      First public IP address of on-premises gateway device 2: 47.XX.XX.69

      CustomerGateway4

      Second public IP address of on-premises gateway device 2: 47.XX.XX.71

      US (Silicon Valley)

      CustomerGateway5

      First public IP address of on-premises gateway device 3: 57.XX.XX.11

      CustomerGateway6

      Second public IP address of on-premises gateway device 3: 47.XX.XX.191

      CustomerGateway7

      First public IP address of on-premises gateway device 4: 57.XX.XX.22

      CustomerGateway8

      Second public IP address of on-premises gateway device 4: 47.XX.XX.234

    Step 2: Create IPsec connections

    Create two IPsec-VPN connections for each VPN Gateway. When creating an IPsec-VPN connection, specify the tunnel's encryption settings and the peer data center. Each connection corresponds to a single data center.

    1. Go to the IPsec-VPN Connections page in the VPN Gateway console, click Bind VPN Gateway, and configure the following parameters.

    2. The following table lists the key parameters for the IPsec-VPN connections. Keep the default values for all other parameters. For more information, see IPsec-VPN connection (Bind VPN Gateway).

      Parameter

      IPsec connection 1

      IPsec connection 2

      IPsec connection 3

      IPsec connection 4

      Name

      Enter IPsec-VPN Connection 1.

      Enter IPsec-VPN Connection 2.

      Enter IPsec-VPN Connection 3.

      Enter IPsec-VPN Connection 4.

      Region

      Select China (Shanghai).

      Select China (Shanghai).

      Select US (Silicon Valley).

      Select US (Silicon Valley).

      Bind VPN Gateway

      Select VPN Gateway 1.

      Select VPN Gateway 1.

      Select VPN Gateway 2.

      Select VPN Gateway 2.

      Routing Mode

      Select Destination Routing. In this scenario, this routing mode is used to allow communication between multiple network segments.

      Effective Immediately

      Keep the default value Yes. This allows the IPsec negotiation to start immediately after you complete the configuration.

      Tunnel 1

      Customer Gateway

      Select Customer Gateway 1.

      Select Customer Gateway 3.

      Select Customer Gateway 5.

      Select Customer Gateway 7.

      Pre-Shared Key

      Important

      The pre-shared key of the IPsec-VPN connection must be the same as the pre-shared key of the peer gateway device. Otherwise, the IPsec-VPN connection cannot be established.

      Enter fddsFF111****.

      Enter fddsFF333****.

      Enter fddsFF555****.

      Enter fddsFF777****.

      Encryption Settings

      Keep the default values for other parameters, except for the following:

      • In the IKE Settings section, set DH Group to group14.

      • In the IPsec Settings section, set DH Group to group14.

      Note

      You need to select encryption parameters based on the on-premises gateway device to ensure that the encryption configurations for the IPsec connection are the same as those for the on-premises gateway device.

      Tunnel 2

      Customer Gateway

      Select Customer Gateway 2.

      Select Customer Gateway 4.

      Select Customer Gateway 6.

      Select Customer Gateway 8.

      Pre-Shared Key

      Enter fddsFF222****.

      Enter fddsFF444****.

      Enter fddsFF666****.

      Enter fddsFF888****.

      Encryption Settings

      Keep the default values for other parameters, except for the following:

      • In the IKE Settings section, set DH Group to group14.

      • In the IPsec Settings section, set DH Group to group14.

      Note

      You need to select encryption parameters based on the on-premises gateway device to ensure that the encryption configurations for the IPsec connection are the same as those for the on-premises gateway device.

    3. In the Created dialog box, click Cancel.

    4. Stay on the IPsec-VPN Connection page, find the IPsec-VPN connection that you created, and click Generate Peer Configuration in the Actions column.

      The peer configuration contains the settings that you need to apply to your local gateway devices.

    5. In the IPsec-VPN Connection Configuration dialog box, copy the configuration and save it locally. You will need this configuration to configure your local gateway devices later.

      After you complete the configuration, the following table shows the mapping among VPCs, VPN gateway instances, IPsec-VPN connections, Customer Gateway instances, and data centers.

      VPC

      VPN Gateway

      IPsec connection

      Tunnel

      Customer Gateway

      Peer data center

      VPC1

      VPN Gateway 1

      IPsec-VPN Connection 1

      active tunnel

      Customer Gateway 1

      Data Center 1

      standby tunnel

      Customer Gateway 2

      IPsec-VPN Connection 2

      active tunnel

      Customer Gateway 3

      Data Center 2

      standby tunnel

      Customer Gateway 4

      VPC2

      VPN Gateway 2

      IPsec-VPN Connection 3

      active tunnel

      Customer Gateway 5

      Data Center 3

      standby tunnel

      Customer Gateway 6

      IPsec-VPN Connection 4

      active tunnel

      Customer Gateway 7

      Data Center 4

      standby tunnel

      Customer Gateway 8

    Step 3: Configure VPN Gateway routes

    After creating the IPsec-VPN connections, add routes to the data centers in the VPN Gateway instances. This topic uses destination-based routes as an example. For more information about other routing methods, see route configuration.

    1. In the left navigation pane, choose Interconnections > VPN > VPN Gateways.

    2. In the top navigation bar, select the region where the VPN gateway instance resides.

    3. On the VPN Gateway page, find the target VPN Gateway instance and click its instance ID.

    4. Click the Destination-based Route Table tab, and then click Add Route Entry.

    5. In the Add Route Entry panel, configure the destination-based routes, and then click OK.

      In VPN Gateway 1, add routes to data center 1 and data center 2. In VPN Gateway 2, add routes to data center 3 and data center 4.

      Parameter

      VPN Gateway 1

      VPN Gateway 2

      Destination CIDR Block

      Enter 172.16.10.0/24 for data center 1.

      Enter 172.16.40.0/24 for data center 2.

      Enter 10.10.0.0/16 for data center 3.

      Enter 10.30.0.0/16 for data center 4.

      Next Hop Type

      Select IPsec-VPN Connection.

      Select IPsec-VPN Connection.

      Select IPsec-VPN Connection.

      Select IPsec-VPN Connection.

      Next Hop

      Select IPsec-VPN connection 1.

      Select IPsec-VPN connection 2.

      Select IPsec-VPN connection 3.

      Select IPsec-VPN connection 4.

      Advertise to VPC

      Keep the default value of Yes.

      After adding the destination-based route entry, the VPN Gateway automatically advertises the routes to data center 1 and data center 2 to the system route table of VPC1.

      Keep the default value of Yes.

      After adding the destination-based route entry, the VPN Gateway automatically advertises the routes to data center 3 and data center 4 to the system route table of VPC2.

    Step 4: Configure the on-premises gateway devices

    After you complete the previous steps, add VPN and routing configurations to your on-premises gateway devices to establish an IPsec-VPN connection with the VPN Gateway. This ensures that traffic from your data centers to other sites is preferentially routed through the active tunnel and automatically fails over to the standby tunnel if the active tunnel fails.

    Note

    In this example, the software Adaptive Security Appliance (ASA) 9.19.1 is used to describe how to configure a Cisco firewall. The commands may vary with software versions. Consult the documentation or your vendor based on your actual environment during operations. For more information, see Configure local gateways.

    The following content contains third-party product information, which is only for reference. Alibaba Cloud does not make guarantees or other forms of commitments for the performance and reliability of third-party products, or the potential impacts of operations performed by using these products.

    On-premises gateway device 1

    1. Log on to the command-line interface (CLI) of the Cisco firewall and enter configuration mode. 

      ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

    2. View the interface and public route configurations.

      The following is an example of an enabled interface configuration on the Cisco firewall.

      ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 47.XX.XX.23 255.255.255.255     #public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #The interface that connects to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security level for the private interface that is higher than that of the public interfaces.
 ip address 172.16.10.217 255.255.255.0       #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 47.XX.XX.32 255.255.255.255    #public IP address configured for the GigabitEthernet0/2 interface.
!
route outside1 47.XX.XX.87 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 47.XX.XX.78 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 172.16.10.0 255.255.255.0 172.16.10.216           #Configure a route to the on-premises data center.

    3. Enable IKEv2 on the public interfaces.

      crypto ikev2 enable outside1
crypto ikev2 enable outside2

    4. Create an IKEv2 policy. Specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

    5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

    6. Create tunnel groups and specify the pre-shared keys for the tunnels. The keys must match the configuration on Alibaba Cloud.

      tunnel-group 47.XX.XX.87 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 1 as L2L.
tunnel-group 47.XX.XX.87 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key fddsFF111****  #Specify the pre-shared key of the peer for Tunnel 1. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF111****   #Specify the local pre-shared key for Tunnel 1. This must match the key configured on Alibaba Cloud.
!
tunnel-group 47.XX.XX.78 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 2 as L2L.
tunnel-group 47.XX.XX.78 ipsec-attributes
 ikev2 remote-authentication pre-shared-key fddsFF222****  #Specify the pre-shared key of the peer for Tunnel 2. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF222****   #Specify the local pre-shared key for Tunnel 2. This must match the key configured on Alibaba Cloud.
!

    7. Create the tunnel interfaces.

      interface Tunnel1                                  #Create an interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.10.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside1                  #Specify the source interface for Tunnel 1 as the public interface GigabitEthernet0/0.
 tunnel destination 47.XX.XX.87                    #Specify the tunnel destination as the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create an interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.20.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside2                  #Specify the source interface for Tunnel 2 as the public interface GigabitEthernet0/2.
 tunnel destination 47.XX.XX.78                    #Specify the tunnel destination as the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

    8. Configure static routes to other sites.

      Configure a high-priority route for traffic from data center 1 to other sites through the Tunnel 1 interface.
route ALIYUN1 172.16.40.0 255.255.255.0 47.XX.XX.87 4  #Configure a route to data center 2.
route ALIYUN1 10.30.0.0 255.255.0.0 47.XX.XX.87 4      #Configure a route to data center 4.
route ALIYUN1 10.10.0.0 255.255.0.0 47.XX.XX.87 4      #Configure a route to data center 3.
route ALIYUN1 10.0.0.0 255.255.0.0 47.XX.XX.87 4       #Configure a route to VPC2.
route ALIYUN1 192.168.99.0 255.255.255.0 47.XX.XX.87 4 #Configure a route to VPC1.
Configure a low-priority route for traffic from data center 1 to other sites through the Tunnel 2 interface.
route ALIYUN2 172.16.40.0 255.255.255.0 47.XX.XX.78 5   
route ALIYUN2 10.30.0.0 255.255.0.0 47.XX.XX.78 5       
route ALIYUN2 10.10.0.0 255.255.0.0 47.XX.XX.78 5       
route ALIYUN2 10.0.0.0 255.255.0.0 47.XX.XX.78 5        
route ALIYUN2 192.168.99.0 255.255.255.0 47.XX.XX.78 5

    9. Depending on your network environment, add routes in data center 1 to allow its clients to access other sites through the Cisco firewall.

    On-premises gateway device 2

    1. Log on to the command-line interface (CLI) of the Cisco firewall and enter configuration mode. 

      ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

    2. View the interface and public route configurations.

      The following is an example of an enabled interface configuration on the Cisco firewall.

      ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 47.XX.XX.69 255.255.255.255     #public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #The interface that connects to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security level for the private interface that is higher than that of the public interfaces.
 ip address 172.16.40.217 255.255.255.0       #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 47.XX.XX.71 255.255.255.255    #public IP address configured for the GigabitEthernet0/2 interface.
!
route outside1 47.XX.XX.87 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 47.XX.XX.78 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 172.16.40.0 255.255.255.0 172.16.40.216           #Configure a route to the on-premises data center.

    3. Enable IKEv2 on the public interfaces.

      crypto ikev2 enable outside1
crypto ikev2 enable outside2

    4. Create an IKEv2 policy. Specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

    5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

    6. Create tunnel groups and specify the pre-shared keys for the tunnels. The keys must match the configuration on Alibaba Cloud.

      tunnel-group 47.XX.XX.87 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 1 as L2L.
tunnel-group 47.XX.XX.87 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key fddsFF333****  #Specify the pre-shared key of the peer for Tunnel 1. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF333****   #Specify the local pre-shared key for Tunnel 1. This must match the key configured on Alibaba Cloud.
!
tunnel-group 47.XX.XX.78 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 2 as L2L.
tunnel-group 47.XX.XX.78 ipsec-attributes
 ikev2 remote-authentication pre-shared-key fddsFF444****  #Specify the pre-shared key of the peer for Tunnel 2. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF444****   #Specify the local pre-shared key for Tunnel 2. This must match the key configured on Alibaba Cloud.
!

    7. Create the tunnel interfaces.

      interface Tunnel1                                  #Create an interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.11.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside1                  #Specify the source interface for Tunnel 1 as the public interface GigabitEthernet0/0.
 tunnel destination 47.XX.XX.87                    #Specify the tunnel destination as the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create an interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.21.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside2                  #Specify the source interface for Tunnel 2 as the public interface GigabitEthernet0/2.
 tunnel destination 47.XX.XX.78                    #Specify the tunnel destination as the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

    8. Configure static routes to other sites.

      Configure a high-priority route for traffic from data center 2 to other sites through the Tunnel 1 interface.
route ALIYUN1 172.16.10.0 255.255.255.0 47.XX.XX.87 4  #Configure a route to data center 1.
route ALIYUN1 10.30.0.0 255.255.0.0 47.XX.XX.87 4      #Configure a route to data center 4.
route ALIYUN1 10.10.0.0 255.255.0.0 47.XX.XX.87 4      #Configure a route to data center 3.
route ALIYUN1 10.0.0.0 255.255.0.0 47.XX.XX.87 4       #Configure a route to VPC2.
route ALIYUN1 192.168.99.0 255.255.255.0 47.XX.XX.87 4 #Configure a route to VPC1.
Configure a low-priority route for traffic from data center 2 to other sites through the Tunnel 2 interface.
route ALIYUN2 172.16.10.0 255.255.255.0 47.XX.XX.78 5   
route ALIYUN2 10.30.0.0 255.255.0.0 47.XX.XX.78 5       
route ALIYUN2 10.10.0.0 255.255.0.0 47.XX.XX.78 5       
route ALIYUN2 10.0.0.0 255.255.0.0 47.XX.XX.78 5        
route ALIYUN2 192.168.99.0 255.255.255.0 47.XX.XX.78 5

    9. Depending on your network environment, add routes in data center 2 to allow its clients to access other sites through the Cisco firewall.

    On-premises gateway device 3

    1. Log on to the command-line interface (CLI) of the Cisco firewall and enter configuration mode. 

      ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

    2. View the interface and public route configurations.

      The following is an example of an enabled interface configuration on the Cisco firewall.

      ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 57.XX.XX.11 255.255.255.255     #public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #The interface that connects to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security level for the private interface that is higher than that of the public interfaces.
 ip address 10.10.10.217 255.255.255.0       #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 57.XX.XX.191 255.255.255.255    #public IP address configured for the GigabitEthernet0/2 interface.
!
route outside1 47.XX.XX.207 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 47.XX.XX.15 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 10.10.10.0 255.255.255.0 10.10.10.216           #Configure a route to the on-premises data center.

    3. Enable IKEv2 on the public interfaces.

      crypto ikev2 enable outside1
crypto ikev2 enable outside2

    4. Create an IKEv2 policy. Specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

    5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

    6. Create tunnel groups and specify the pre-shared keys for the tunnels. The keys must match the configuration on Alibaba Cloud.

      tunnel-group 47.XX.XX.207 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 1 as L2L.
tunnel-group 47.XX.XX.207 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key fddsFF555****  #Specify the pre-shared key of the peer for Tunnel 1. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF555****   #Specify the local pre-shared key for Tunnel 1. This must match the key configured on Alibaba Cloud.
!
tunnel-group 47.XX.XX.15 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 2 as L2L.
tunnel-group 47.XX.XX.15 ipsec-attributes
 ikev2 remote-authentication pre-shared-key fddsFF666****  #Specify the pre-shared key of the peer for Tunnel 2. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF666****   #Specify the local pre-shared key for Tunnel 2. This must match the key configured on Alibaba Cloud.
!

    7. Create the tunnel interfaces.

      interface Tunnel1                                  #Create an interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.12.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside1                  #Specify the source interface for Tunnel 1 as the public interface GigabitEthernet0/0.
 tunnel destination 47.XX.XX.207                    #Specify the tunnel destination as the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create an interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.22.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside2                  #Specify the source interface for Tunnel 2 as the public interface GigabitEthernet0/2.
 tunnel destination 47.XX.XX.15                   #Specify the tunnel destination as the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

    8. Configure static routes to other sites.

      Configure a high-priority route for traffic from data center 3 to other sites through the Tunnel 1 interface.
route ALIYUN1 172.16.40.0 255.255.255.0 47.XX.XX.207 4  #Configure a route to data center 2.
route ALIYUN1 10.30.0.0 255.255.0.0 47.XX.XX.207 4      #Configure a route to data center 4.
route ALIYUN1 172.16.10.0 255.255.255.0 47.XX.XX.207 4  #Configure a route to data center 1.
route ALIYUN1 10.0.0.0 255.255.0.0 47.XX.XX.207 4       #Configure a route to VPC2.
route ALIYUN1 192.168.99.0 255.255.255.0 47.XX.XX.207 4 #Configure a route to VPC1.
Configure a low-priority route for traffic from data center 3 to other sites through the Tunnel 2 interface.
route ALIYUN2 172.16.40.0 255.255.255.0 47.XX.XX.15 5   
route ALIYUN2 10.30.0.0 255.255.0.0 47.XX.XX.15 5       
route ALIYUN2 172.16.10.0 255.255.255.0 47.XX.XX.15 5      
route ALIYUN2 10.0.0.0 255.255.0.0 47.XX.XX.15 5        
route ALIYUN2 192.168.99.0 255.255.255.0 47.XX.XX.15 5

    9. Depending on your network environment, add routes in data center 3 to allow its clients to access other sites through the Cisco firewall.

    On-premises gateway device 4

    1. Log on to the command-line interface (CLI) of the Cisco firewall and enter configuration mode. 

      ciscoasa> enable
Password: ********             #Enter the password for enable mode.
ciscoasa# configure terminal   #Enter configuration mode.
ciscoasa(config)#

    2. View the interface and public route configurations.

      The following is an example of an enabled interface configuration on the Cisco firewall.

      ciscoasa(config)# show running-config interface 
!
interface GigabitEthernet0/0
 nameif outside1                            #Name of the GigabitEthernet0/0 interface.
 security-level 0
 ip address 57.XX.XX.22 255.255.255.255     #public IP address configured for the GigabitEthernet0/0 interface.
!
interface GigabitEthernet0/1                #The interface that connects to the on-premises data center.
 nameif private                             #Name of the GigabitEthernet0/1 interface.
 security-level 100                         #Specify a security level for the private interface that is higher than that of the public interfaces.
 ip address 10.30.66.217 255.255.255.0       #IP address configured for the GigabitEthernet0/1 interface.
!
interface GigabitEthernet0/2                
 nameif outside2                            #Name of the GigabitEthernet0/2 interface.
 security-level 0
 ip address 57.XX.XX.234 255.255.255.255    #public IP address configured for the GigabitEthernet0/2 interface.
!
route outside1 47.XX.XX.207 255.255.255.255 192.XX.XX.172   #Configure a route to the public IP address of Tunnel 1 on the Alibaba Cloud side. The next hop is a public IP address.
route outside2 47.XX.XX.15 255.255.255.255 192.XX.XX.158   #Configure a route to the public IP address of Tunnel 2 on the Alibaba Cloud side. The next hop is a public IP address.
route private 10.30.66.0 255.255.255.0 10.30.66.216           #Configure a route to the on-premises data center.

    3. Enable IKEv2 on the public interfaces.

      crypto ikev2 enable outside1
crypto ikev2 enable outside2

    4. Create an IKEv2 policy. Specify the authentication algorithm, encryption algorithm, DH group, and SA lifetime for the IKE phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IKE Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ikev2 policy 10     
 encryption aes             #Specify the encryption algorithm.
 integrity sha              #Specify the authentication algorithm.
 group 14                   #Specify the DH group.
 prf sha                    #The prf value must be the same as the integrity value. On the Alibaba Cloud side, prf defaults to the same value as the authentication algorithm.
 lifetime seconds 86400     #Specify the SA lifetime.

    5. Create an IPsec proposal and profile. Specify the encryption algorithm, authentication algorithm, DH group, and SA lifetime for the IPsec phase. These settings must match the Alibaba Cloud configuration.

      Important

      On Alibaba Cloud, you can specify only one value for the Encryption Algorithm, Authentication Algorithm, and DH Group parameters in the IPsec Configurations phase. We recommend you do the same on your Cisco firewall and ensure the values match the Alibaba Cloud configuration.

      crypto ipsec ikev2 ipsec-proposal ALIYUN-PROPOSAL    #Create an IPsec proposal.
 protocol esp encryption aes                         #Specify the encryption algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
 protocol esp integrity sha-1                        #Specify the authentication algorithm. The protocol is ESP, which is required on the Alibaba Cloud side.
crypto ipsec profile ALIYUN-PROFILE                  
 set ikev2 ipsec-proposal ALIYUN-PROPOSAL            #Create an IPsec profile and apply the created proposal. 
 set ikev2 local-identity address                    #Set the local ID format to IP address to match the RemoteId format on the Alibaba Cloud side.
 set pfs group14                                     #Specify PFS and the DH group.
 set security-association lifetime seconds 86400     #Specify the time-based SA lifetime.
 set security-association lifetime kilobytes unlimited #Disable the traffic-based SA lifetime.

    6. Create tunnel groups and specify the pre-shared keys for the tunnels. The keys must match the configuration on Alibaba Cloud.

      tunnel-group 47.XX.XX.207 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 1 as L2L.
tunnel-group 47.XX.XX.207 ipsec-attributes             
 ikev2 remote-authentication pre-shared-key fddsFF777****  #Specify the pre-shared key of the peer for Tunnel 1. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF777****   #Specify the local pre-shared key for Tunnel 1. This must match the key configured on Alibaba Cloud.
!
tunnel-group 47.XX.XX.15 type ipsec-l2l                    #Specify the encapsulation mode for Tunnel 2 as L2L.
tunnel-group 47.XX.XX.15 ipsec-attributes
 ikev2 remote-authentication pre-shared-key fddsFF888****  #Specify the pre-shared key of the peer for Tunnel 2. This is the pre-shared key on the Alibaba Cloud side.
 ikev2 local-authentication pre-shared-key fddsFF888****   #Specify the local pre-shared key for Tunnel 2. This must match the key configured on Alibaba Cloud.
!

    7. Create the tunnel interfaces.

      interface Tunnel1                                  #Create an interface for Tunnel 1.
 nameif ALIYUN1
 ip address 169.254.13.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside1                  #Specify the source interface for Tunnel 1 as the public interface GigabitEthernet0/0.
 tunnel destination 47.XX.XX.207                   #Specify the tunnel destination as the public IP address of Tunnel 1 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 1.
 no shutdown                                       #Enable the Tunnel 1 interface.
!
interface Tunnel2                                  #Create an interface for Tunnel 2.
 nameif ALIYUN2                
 ip address 169.254.23.2 255.255.255.252           #Specify the IP address of the interface.
 tunnel source interface outside2                  #Specify the source interface for Tunnel 2 as the public interface GigabitEthernet0/2.
 tunnel destination 47.XX.XX.15                    #Specify the tunnel destination as the public IP address of Tunnel 2 on the Alibaba Cloud side.
 tunnel mode ipsec ipv4                            
 tunnel protection ipsec profile ALIYUN-PROFILE    #Apply the ALIYUN-PROFILE IPsec profile to Tunnel 2.
 no shutdown                                       #Enable the Tunnel 2 interface.
!

    8. Configure static routes to other sites.

      Configure a high-priority route for traffic from data center 4 to other sites through the Tunnel 1 interface.
route ALIYUN1 172.16.40.0 255.255.255.0 47.XX.XX.207 4  #Configure a route to data center 2.
route ALIYUN1 10.10.0.0 255.255.0.0 47.XX.XX.207 4      #Configure a route to data center 3.
route ALIYUN1 172.16.10.0 255.255.255.0 47.XX.XX.207 4  #Configure a route to data center 1.
route ALIYUN1 10.0.0.0 255.255.0.0 47.XX.XX.207 4       #Configure a route to VPC2.
route ALIYUN1 192.168.99.0 255.255.255.0 47.XX.XX.207 4 #Configure a route to VPC1.
Configure a low-priority route for traffic from data center 4 to other sites through the Tunnel 2 interface.
route ALIYUN2 172.16.40.0 255.255.255.0 47.XX.XX.15 5   
route ALIYUN2 10.10.0.0 255.255.0.0 47.XX.XX.15 5       
route ALIYUN2 172.16.10.0 255.255.255.0 47.XX.XX.15 5      
route ALIYUN2 10.0.0.0 255.255.0.0 47.XX.XX.15 5        
route ALIYUN2 192.168.99.0 255.255.255.0 47.XX.XX.15 5

    9. Depending on your network environment, add routes in data center 4 to allow its clients to access other sites through the Cisco firewall.

    After configuring the on-premises gateway devices, data center 1, data center 2, and VPC1 can communicate with each other, and data center 3, data center 4, and VPC2 can also communicate with each other. However, communication between these two groups is not yet established.

    Step 5: Configure Cloud Enterprise Network (CEN)

    Use Cloud Enterprise Network (CEN) to connect data center 1, data center 2, VPC1, data center 3, data center 4, and VPC2.

    1. Create a CEN instance. For more information, see CEN instance.

    2. Create a transit router in the China (Shanghai) region and another in the US (Silicon Valley) region. For more information, see Create a transit router instance.

      You can use the default settings when you create the transit routers.

    3. Create VPC attachments.

      Attach VPC1 to the transit router in the China (Shanghai) region and VPC2 to the transit router in the US (Silicon Valley) region.

      1. On the details page of the CEN instance, go to the Basic Settings > Transit Router tab. Find the transit router in the China (Shanghai) region and click Create Network Instance Connection in the Actions column.

      2. Configure the parameters as shown in the following table and click OK.

        This table lists the key parameters for creating VPC attachments. Use the default values for all other parameters. For more information, see Use an Enterprise Edition transit router to create a VPC attachment.

        Parameter

        VPC1 attachment

        VPC2 attachment

        Network Type

        Select VPC.

        Region

        Select China (Shanghai).

        Select US (Silicon Valley).

        Account

        Select Same Account.

        Attachment Name

        Enter VPC1 attachment.

        Enter VPC2 attachment.

        Networks

        Select VPC1.

        Select VPC2.

        vSwitch

        Select vSwitch 1 in zone E and vSwitch 2 in zone F.

        Make sure that each selected vSwitch has an idle IP address. If the VPC does not have a vSwitch in the zones supported by the transit router, or if the vSwitches do not have idle IP addresses, you must create a vSwitch. For more information, see Create and manage vSwitches.

        Select vSwitch 1 in zone A and vSwitch 2 in zone B.

        Make sure that each selected vSwitch has an idle IP address. If the VPC does not have a vSwitch in the zones supported by the transit router, or if the vSwitches do not have idle IP addresses, you must create a vSwitch. For more information, see Create and manage vSwitches.

        Advanced Settings

        Keep the default settings. All advanced options are enabled by default.

    4. Create an inter-region connection.

      Because VPC1 and VPC2 are in different regions, you must create an inter-region connection to enable communication between them.

      1. On the details page of the CEN instance, go to the Basic Settings > Bandwidth Package Management tab and click Set Inter-region Bandwidth.

      2. On the Connect Network Instance page, configure the inter-region connection as follows and then click OK.

        Parameter

        Description

        Network Type

        Select Inter-region Connection.

        Region

        Select China (Shanghai).

        Local Region

        Select US (Silicon Valley).

        Bandwidth Allocation Mode

        Select Pay-By-Data-Transfer. Cloud Data Transfer (CDT) charges the fees for this billing method.

        Bandwidth

        Enter the bandwidth for the inter-region connection. Unit: Mbit/s.

        Default Line Type

        Keep the default link type, Gold.

        Advanced Settings

        All advanced options are selected by default.

    5. Publish the data center routes to the transit router.

      The inter-region connection allows only VPC1 and VPC2 to communicate. To enable communication among all data centers, you must also publish their routes to the transit router.

      1. On the details page of the CEN instance, go to the Basic Settings > Transit Router tab, find the transit router in the China (Shanghai) region, and click its ID.

      2. On the details page of the transit router, click the Network Instance Route Table tab.

      3. On the Network Instance Route Table tab, find the route entries for the VPC1 instance that point to data center 1 and data center 2.

      4. In the Publishing Progress column for a route entry, click Publish. In the PublishRoute dialog box, confirm the route information and click OK.

      5. Repeat the process for the transit router in the US (Silicon Valley) region. For the VPC2 instance, publish the routes that point to data center 3 and data center 4.

      Data centers 1 and 2

      On the Network Instance Route Table tab of the transit router, select the VPC1 network instance and its route table. Verify that the Publish Status for the two VpnGateway route entries, 172.16.10.0/24 and 172.16.40.0/24, is Published.

      Data centers 3 and 4

      On the Network Instance Route Table tab of the transit router, select the VPC2 network instance and its route table. Verify that the Publish Status for the two custom VpnGateway route entries 10.10.0.0/16 and 10.30.0.0/16 is Published.

    Step 6: Test connectivity

    The preceding steps enable communication among the data centers and VPCs in different regions. This section describes how to test the connectivity.

    Note

    Before testing connectivity, verify that the security group rules for the ECS instances and the ACL rules for the on-premises data centers permit traffic between the data centers and VPCs. For more information about security group rules, see Query security group rules and Add security group rules.

    Test connectivity from VPC1 to VPC2, data center 1, data center 2, data center 3, and data center 4.

    1. Log on to the ECS1 instance in VPC1. For more information, see Connection method overview.

    2. On the ECS1 instance, run the ping command to test connectivity to clients at other sites.

      ping <client_ip_address>
      [root@izbxxxbdZ ~]# ping 10.0.10.33
PING 10.0.10.33 (10.0.10.33) 56(84) bytes of data.
64 bytes from 10.0.10.33: icmp_seq=1 ttl=62 time=30.7 ms
64 bytes from 10.0.10.33: icmp_seq=2 ttl=62 time=30.4 ms
64 bytes from 10.0.10.33: icmp_seq=3 ttl=62 time=30.5 ms
64 bytes from 10.0.10.33: icmp_seq=4 ttl=62 time=30.5 ms
^Z
[5]+  Stopped                 ping 10.0.10.33
[root@izbpxxxdZ ~]# ping 10.10.10.201
PING 10.10.10.201 (10.10.10.201) 56(84) bytes of data.
64 bytes from 10.10.10.201: icmp_seq=1 ttl=60 time=34.2 ms
64 bytes from 10.10.10.201: icmp_seq=2 ttl=60 time=33.6 ms
64 bytes from 10.10.10.201: icmp_seq=3 ttl=60 time=34.6 ms
64 bytes from 10.10.10.201: icmp_seq=4 ttl=60 time=33.5 ms
^Z
[6]+  Stopped                 ping 10.10.10.201
      [root@izbpxxxodZ ~]# ping 10.30.66.11
PING 10.30.66.11 (10.30.66.11) 56(84) bytes of data.
64 bytes from 10.30.66.11: icmp_seq=1 ttl=60 time=35.2 ms
64 bytes from 10.30.66.11: icmp_seq=2 ttl=60 time=34.4 ms
64 bytes from 10.30.66.11: icmp_seq=3 ttl=60 time=34.3 ms
64 bytes from 10.30.66.11: icmp_seq=4 ttl=60 time=34.3 ms
^Z
[7]+  Stopped                 ping 10.30.66.11
[root@izbpxxxdZ ~]# ping 172.16.40.60
PING 172.16.40.60 (172.16.40.60) 56(84) bytes of data.
64 bytes from 172.16.40.60: icmp_seq=1 ttl=62 time=8.27 ms
64 bytes from 172.16.40.60: icmp_seq=2 ttl=62 time=7.75 ms
64 bytes from 172.16.40.60: icmp_seq=3 ttl=62 time=7.84 ms
64 bytes from 172.16.40.60: icmp_seq=4 ttl=62 time=7.96 ms
^Z
[8]+  Stopped                 ping 172.16.40.60
[root@izbpxxxdZ ~]# ping 172.16.10.207
PING 172.16.10.207 (172.16.10.207) 56(84) bytes of data.
64 bytes from 172.16.10.207: icmp_seq=1 ttl=62 time=9.62 ms
64 bytes from 172.16.10.207: icmp_seq=2 ttl=62 time=8.52 ms
64 bytes from 172.16.10.207: icmp_seq=3 ttl=62 time=9.59 ms
64 bytes from 172.16.10.207: icmp_seq=4 ttl=62 time=8.81 ms
^Z
[9]+  Stopped                 ping 172.16.10.207

      The echo reply packets in the output confirm that VPC1 is connected to the other sites.

    Test connectivity from VPC2 to VPC1, data center 1, data center 2, data center 3, and data center 4.

    1. Log on to the ECS2 instance in VPC2. For more information, see Connection method overview.

    2. On the ECS2 instance, run the ping command to test connectivity to clients at other sites.

      ping <client_ip_address>

      [root@iZ2zeixxxsdZ ~]# ping 192.168.99.48
PING 192.168.99.48 (192.168.99.48) 56(84) bytes of data.
64 bytes from 192.168.99.48: icmp_seq=1 ttl=62 time=31.9 ms
64 bytes from 192.168.99.48: icmp_seq=2 ttl=62 time=31.6 ms
64 bytes from 192.168.99.48: icmp_seq=3 ttl=62 time=31.6 ms
64 bytes from 192.168.99.48: icmp_seq=4 ttl=62 time=31.7 ms
^Z
[1]+  Stopped                 ping 192.168.99.48
[root@iZ2zeixxxsdZ ~]# ping 172.16.10.207
PING 172.16.10.207 (172.16.10.207) 56(84) bytes of data.
64 bytes from 172.16.10.207: icmp_seq=1 ttl=60 time=37.3 ms
64 bytes from 172.16.10.207: icmp_seq=2 ttl=60 time=36.4 ms
64 bytes from 172.16.10.207: icmp_seq=3 ttl=60 time=36.4 ms
64 bytes from 172.16.10.207: icmp_seq=4 ttl=60 time=36.3 ms
^Z
[2]+  Stopped                 ping 172.16.10.207
[root@iZ2zeixxxsdZ ~]# ping 172.16.40.60
PING 172.16.40.60 (172.16.40.60) 56(84) bytes of data.
64 bytes from 172.16.40.60: icmp_seq=1 ttl=60 time=34.1 ms
64 bytes from 172.16.40.60: icmp_seq=2 ttl=60 time=33.1 ms
64 bytes from 172.16.40.60: icmp_seq=3 ttl=60 time=32.7 ms
64 bytes from 172.16.40.60: icmp_seq=4 ttl=60 time=32.7 ms
^Z
[3]+  Stopped                 ping 172.16.40.60
      [root@iZ2zxxxsdZ ~]# ping 10.30.66.11
PING 10.30.66.11 (10.30.66.11) 56(84) bytes of data.
64 bytes from 10.30.66.11: icmp_seq=1 ttl=62 time=7.29 ms
64 bytes from 10.30.66.11: icmp_seq=2 ttl=62 time=7.02 ms
64 bytes from 10.30.66.11: icmp_seq=3 ttl=62 time=6.88 ms
64 bytes from 10.30.66.11: icmp_seq=4 ttl=62 time=6.63 ms
^Z
[6]+  Stopped                 ping 10.30.66.11
[root@iZ2zxxxsdZ ~]# ping 10.10.10.201
PING 10.10.10.201 (10.10.10.201) 56(84) bytes of data.
64 bytes from 10.10.10.201: icmp_seq=1 ttl=62 time=5.01 ms
64 bytes from 10.10.10.201: icmp_seq=2 ttl=62 time=4.68 ms
64 bytes from 10.10.10.201: icmp_seq=3 ttl=62 time=4.51 ms
64 bytes from 10.10.10.201: icmp_seq=4 ttl=62 time=4.58 ms
^Z
[7]+  Stopped                 ping 10.10.10.201
[root@iZ2zeiyvn7mvzzdqy253sdZ ~]#

      The echo reply packets in the output confirm that VPC2 is connected to the other sites.

    Test connectivity from data center 1 to VPC1, VPC2, data center 2, data center 3, and data center 4.

    1. Log on to the command-line interface of a client in data center 1.

    2. On the client, run the ping command to test connectivity to clients at other sites.

      ping <client_ip_address>

      [root@iZbp1xxx5rZ ~]# ping 192.168.99.48
PING 192.168.99.48 (192.168.99.48) 56(84) bytes of data.
64 bytes from 192.168.99.48: icmp_seq=1 ttl=62 time=8.66 ms
64 bytes from 192.168.99.48: icmp_seq=2 ttl=62 time=8.71 ms
64 bytes from 192.168.99.48: icmp_seq=3 ttl=62 time=8.64 ms
64 bytes from 192.168.99.48: icmp_seq=4 ttl=62 time=8.51 ms
^Z
[2]+  Stopped                 ping 192.168.99.48
[root@iZbp1xxx5rZ ~]# ping 172.16.40.60
PING 172.16.40.60 (172.16.40.60) 56(84) bytes of data.
64 bytes from 172.16.40.60: icmp_seq=1 ttl=61 time=17.0 ms
64 bytes from 172.16.40.60: icmp_seq=2 ttl=61 time=15.9 ms
64 bytes from 172.16.40.60: icmp_seq=3 ttl=61 time=16.2 ms
64 bytes from 172.16.40.60: icmp_seq=4 ttl=61 time=15.9 ms
^Z
[3]+  Stopped                 ping 172.16.40.60
      [root@iZxxx ~]# ping 10.30.66.11
PING 10.30.66.11 (10.30.66.11) 56(84) bytes of data.
64 bytes from 10.30.66.11: icmp_seq=1 ttl=58 time=49.3 ms
64 bytes from 10.30.66.11: icmp_seq=2 ttl=58 time=48.7 ms
64 bytes from 10.30.66.11: icmp_seq=3 ttl=58 time=48.6 ms
64 bytes from 10.30.66.11: icmp_seq=4 ttl=58 time=48.4 ms
^Z
[4]+  Stopped                 ping 10.30.66.11
[root@iZxxx ~]# ping 10.10.10.201
PING 10.10.10.201 (10.10.10.201) 56(84) bytes of data.
64 bytes from 10.10.10.201: icmp_seq=1 ttl=58 time=39.1 ms
64 bytes from 10.10.10.201: icmp_seq=2 ttl=58 time=38.6 ms
64 bytes from 10.10.10.201: icmp_seq=3 ttl=58 time=38.6 ms
64 bytes from 10.10.10.201: icmp_seq=4 ttl=58 time=38.3 ms
^Z
[5]+  Stopped                 ping 10.10.10.201
[root@iZxxx ~]# ping 10.0.10.33
PING 10.0.10.33 (10.0.10.33) 56(84) bytes of data.
64 bytes from 10.0.10.33: icmp_seq=1 ttl=60 time=37.5 ms
64 bytes from 10.0.10.33: icmp_seq=2 ttl=60 time=36.8 ms
64 bytes from 10.0.10.33: icmp_seq=3 ttl=60 time=37.1 ms
64 bytes from 10.0.10.33: icmp_seq=4 ttl=60 time=36.9 ms
^Z
[6]+  Stopped                 ping 10.0.10.33

      The echo reply packets in the output confirm that data center 1 is connected to the other sites.

    Test connectivity from data center 2 to VPC1, VPC2, data center 1, data center 3, and data center 4.

    1. Log on to the command-line interface of a client in data center 2.

    2. On the client, run the ping command to test connectivity to clients at other sites.

      ping <client_ip_address>
      [root@xxx ~]# ping 192.168.99.48
PING 192.168.99.48 (192.168.99.48) 56(84) bytes of data.
64 bytes from 192.168.99.48: icmp_seq=1 ttl=62 time=8.29 ms
64 bytes from 192.168.99.48: icmp_seq=2 ttl=62 time=7.93 ms
64 bytes from 192.168.99.48: icmp_seq=3 ttl=62 time=8.07 ms
64 bytes from 192.168.99.48: icmp_seq=4 ttl=62 time=8.01 ms
^Z
[1]+  Stopped                 ping 192.168.99.48
[root@xxx ~]# ping 172.16.10.207
PING 172.16.10.207 (172.16.10.207) 56(84) bytes of data.
64 bytes from 172.16.10.207: icmp_seq=1 ttl=61 time=16.9 ms
64 bytes from 172.16.10.207: icmp_seq=2 ttl=61 time=16.2 ms
64 bytes from 172.16.10.207: icmp_seq=3 ttl=61 time=16.2 ms
64 bytes from 172.16.10.207: icmp_seq=4 ttl=61 time=17.6 ms
^Z
[2]+  Stopped                 ping 172.16.10.207
[root@xxx ~]# ping 10.30.66.11
PING 10.30.66.11 (10.30.66.11) 56(84) bytes of data.
64 bytes from 10.30.66.11: icmp_seq=1 ttl=58 time=42.7 ms
64 bytes from 10.30.66.11: icmp_seq=2 ttl=58 time=41.9 ms
64 bytes from 10.30.66.11: icmp_seq=3 ttl=58 time=42.2 ms
64 bytes from 10.30.66.11: icmp_seq=4 ttl=58 time=41.8 ms
^Z
[3]+  Stopped                 ping 10.30.66.11
      [root@xxx ~]# ping 10.10.10.201
PING 10.10.10.201 (10.10.10.201) 56(84) bytes of data.
64 bytes from 10.10.10.201: icmp_seq=1 ttl=58 time=41.5 ms
64 bytes from 10.10.10.201: icmp_seq=2 ttl=58 time=42.8 ms
64 bytes from 10.10.10.201: icmp_seq=3 ttl=58 time=41.3 ms
64 bytes from 10.10.10.201: icmp_seq=4 ttl=58 time=41.4 ms
^Z
[6]+  Stopped                 ping 10.10.10.201
[root@xxx ~]# ping 10.0.10.33
PING 10.0.10.33 (10.0.10.33) 56(84) bytes of data.
64 bytes from 10.0.10.33: icmp_seq=1 ttl=60 time=41.7 ms
64 bytes from 10.0.10.33: icmp_seq=2 ttl=60 time=41.5 ms
64 bytes from 10.0.10.33: icmp_seq=3 ttl=60 time=41.4 ms
64 bytes from 10.0.10.33: icmp_seq=4 ttl=60 time=41.6 ms
64 bytes from 10.0.10.33: icmp_seq=5 ttl=60 time=41.7 ms
64 bytes from 10.0.10.33: icmp_seq=6 ttl=60 time=41.9 ms
64 bytes from 10.0.10.33: icmp_seq=7 ttl=60 time=41.4 ms
64 bytes from 10.0.10.33: icmp_seq=8 ttl=60 time=41.4 ms
64 bytes from 10.0.10.33: icmp_seq=9 ttl=60 time=41.3 ms
^Z
[7]+  Stopped                 ping 10.0.10.33
[root@xxx ~]#

      The echo reply packets in the output confirm that data center 2 is connected to the other sites.

    Test connectivity from data center 3 to VPC1, VPC2, data center 1, data center 2, and data center 4.

    1. Log on to the command-line interface of a client in data center 3.

    2. On the client, run the ping command to test connectivity to clients at other sites.

      ping <client_ip_address>

      [root@xxx             ~]# ping 192.168.99.48
PING 192.168.99.48 (192.168.99.48) 56(84) bytes of data.
64 bytes from 192.168.99.48: icmp_seq=1 ttl=61 time=34.4 ms
64 bytes from 192.168.99.48: icmp_seq=2 ttl=61 time=33.2 ms
64 bytes from 192.168.99.48: icmp_seq=3 ttl=61 time=33.8 ms
64 bytes from 192.168.99.48: icmp_seq=4 ttl=61 time=33.6 ms
^Z
[1]+  Stopped                 ping 192.168.99.48
[root@xxx             ~]# ping 172.16.10.207
PING 172.16.10.207 (172.16.10.207) 56(84) bytes of data.
64 bytes from 172.16.10.207: icmp_seq=1 ttl=59 time=43.3 ms
64 bytes from 172.16.10.207: icmp_seq=2 ttl=59 time=40.5 ms
64 bytes from 172.16.10.207: icmp_seq=3 ttl=59 time=40.7 ms
64 bytes from 172.16.10.207: icmp_seq=4 ttl=59 time=40.4 ms
^Z
[2]+  Stopped                 ping 172.16.10.207
[root@xxx             ~]# ping 172.16.40.60
PING 172.16.40.60 (172.16.40.60) 56(84) bytes of data.
64 bytes from 172.16.40.60: icmp_seq=1 ttl=59 time=40.3 ms
64 bytes from 172.16.40.60: icmp_seq=2 ttl=59 time=39.6 ms
64 bytes from 172.16.40.60: icmp_seq=3 ttl=59 time=39.3 ms
64 bytes from 172.16.40.60: icmp_seq=4 ttl=59 time=39.3 ms
^Z
[3]+  Stopped                 ping 172.16.40.60
      [root@xxx                         ~]# ping 10.30.66.11
PING 10.30.66.11 (10.30.66.11) 56(84) bytes of data.
64 bytes from 10.30.66.11: icmp_seq=1 ttl=62 time=11.6 ms
64 bytes from 10.30.66.11: icmp_seq=2 ttl=62 time=10.8 ms
64 bytes from 10.30.66.11: icmp_seq=3 ttl=62 time=11.3 ms
64 bytes from 10.30.66.11: icmp_seq=4 ttl=62 time=11.3 ms
^Z
[4]+  Stopped                 ping 10.30.66.11
[root@xxx               ~]# ping 10.0.10.33
PING 10.0.10.33 (10.0.10.33) 56(84) bytes of data.
64 bytes from 10.0.10.33: icmp_seq=1 ttl=63 time=4.81 ms
64 bytes from 10.0.10.33: icmp_seq=2 ttl=63 time=4.68 ms
64 bytes from 10.0.10.33: icmp_seq=3 ttl=63 time=4.71 ms
64 bytes from 10.0.10.33: icmp_seq=4 ttl=63 time=4.66 ms
^Z
[5]+  Stopped                 ping 10.0.10.33

      The echo reply packets in the output confirm that data center 3 is connected to the other sites.

    Test connectivity from data center 4 to VPC1, VPC2, data center 1, data center 2, and data center 3.

    1. Log on to the command-line interface of a client in data center 4.

    2. On the client, run the ping command to test connectivity to clients at other sites.

      ping <client_ip_address>

      [root@xxx          ~]# ping 192.168.99.48
PING 192.168.99.48 (192.168.99.48) 56(84) bytes of data.
64 bytes from 192.168.99.48: icmp_seq=1 ttl=60 time=34.4 ms
64 bytes from 192.168.99.48: icmp_seq=2 ttl=60 time=37.3 ms
64 bytes from 192.168.99.48: icmp_seq=3 ttl=60 time=34.3 ms
64 bytes from 192.168.99.48: icmp_seq=4 ttl=60 time=34.3 ms
^Z
[2]+  Stopped                 ping 192.168.99.48
[root@xxx          ~]# ping 172.16.10.207
PING 172.16.10.207 (172.16.10.207) 56(84) bytes of data.
64 bytes from 172.16.10.207: icmp_seq=1 ttl=58 time=47.0 ms
64 bytes from 172.16.10.207: icmp_seq=2 ttl=58 time=43.0 ms
64 bytes from 172.16.10.207: icmp_seq=3 ttl=58 time=43.1 ms
64 bytes from 172.16.10.207: icmp_seq=4 ttl=58 time=43.1 ms
^Z
[3]+  Stopped                 ping 172.16.10.207
[root@xxx          ~]# ping 172.16.40.60
PING 172.16.40.60 (172.16.40.60) 56(84) bytes of data.
64 bytes from 172.16.40.60: icmp_seq=1 ttl=58 time=57.8 ms
64 bytes from 172.16.40.60: icmp_seq=2 ttl=58 time=52.5 ms
64 bytes from 172.16.40.60: icmp_seq=3 ttl=58 time=52.5 ms
64 bytes from 172.16.40.60: icmp_seq=4 ttl=58 time=52.2 ms
^Z
[4]+  Stopped                 ping 172.16.40.60
      [root@xxx                          ~]# ping 10.10.10.201
PING 10.10.10.201 (10.10.10.201) 56(84) bytes of data.
64 bytes from 10.10.10.201: icmp_seq=1 ttl=61 time=11.2 ms
64 bytes from 10.10.10.201: icmp_seq=2 ttl=61 time=10.4 ms
64 bytes from 10.10.10.201: icmp_seq=3 ttl=61 time=16.4 ms
64 bytes from 10.10.10.201: icmp_seq=4 ttl=61 time=12.8 ms
^Z
[6]+  Stopped                 ping 10.10.10.201
[root@xxx                          ~]# ping 10.0.10.33
PING 10.0.10.33 (10.0.10.33) 56(84) bytes of data.
64 bytes from 10.0.10.33: icmp_seq=1 ttl=62 time=7.28 ms
64 bytes from 10.0.10.33: icmp_seq=2 ttl=62 time=7.09 ms
64 bytes from 10.0.10.33: icmp_seq=3 ttl=62 time=8.54 ms
64 bytes from 10.0.10.33: icmp_seq=4 ttl=62 time=6.89 ms
^Z
[7]+  Stopped                 ping 10.0.10.33
[root@xxx                          ~]#

      The echo reply packets in the output confirm that data center 4 is connected to the other sites.