VPN Gateway:Configure a strongSwan device

Two egresses and BGP dynamic routing

Refer to Connect a VPC to a data center in dual-tunnel mode and enable BGP dynamic routing and complete the Create a VPN gateway, Create a customer gateway, Create an IPsec-VPN connection, and Enable BGP automatic route advertisement steps.

1. The strongSwan device has two Internet egress IP addresses. Therefore, you must create two customer gateways.

2. When you create IPsec-VPN connections, select Tunnel 1 for Egress 1 and Tunnel 2 for Egress 2. Destination Routing Mode is selected in this example.

Two egresses and static routing

Refer to Connect a VPC to a data center in dual-tunnel mode and complete the Create a VPN gateway, Create a customer gateway, Create an IPsec-VPN connection, and Configure VPN gateway routing steps.

1. The strongSwan device has two Internet egress IP addresses. Therefore, you must create two customer gateways.

2. When you create IPsec-VPN connections, select Tunnel 1 for Egress 1 and Tunnel 2 for Egress 2. Destination Routing Mode is selected in this example.

One egress and BGP dynamic routing

Refer to Connect a VPC to a data center in dual-tunnel mode and enable BGP dynamic routing and complete the Create a VPN gateway, Create a customer gateway, Create an IPsec-VPN connection, and Enable BGP automatic route advertisement steps.

1. The strongSwan device has only one Internet egress IP address. Therefore, you need only to create one customer gateway.

2. When you create IPsec-VPN connections, select the two tunnels for the same customer gateway. Destination Routing Mode is selected in this example.

One egress and static routing

Refer to Connect a VPC to a data center in dual-tunnel mode and complete the Create a VPN gateway, Create a customer gateway, Create an IPsec-VPN connection, and Configure VPN gateway routing steps.

1. The strongSwan device has only one Internet egress IP address. Therefore, you need only to create one customer gateway.

2. When you create IPsec-VPN connections, configure protected data flows. Select the two tunnels for the same customer gateway.

   • For the local CIDR block, enter the CIDR block of the VPC, which is 192.168.0.0/16.

   • For the peer CIDR block, enter the CIDR block of the data center, which is 172.16.0.0/16.

Two egresses - static routing and BGP dynamic routing

1. Configure routes so that access from IPsec Address 1 goes through eth0 and access from IPsec Address 2 goes through eth1.

   ip route add 47.XX.XX.151 via 172.16.20.253 dev eth0  #172.16.20.253 is the private gateway address of eth0.
   ip route add 47.XX.XX.87 via 172.16.21.253 dev eth1   #172.16.20.253 is the private gateway address of eth1.

   Make sure the following two IPsec addresses can be pinged.

   ping 47.XX.XX.151 
   ping 47.XX.XX.87 

2. Create two virtual network interfaces for establishing IPsec-VPN tunnels.

   ip link add ipsec0 type xfrm dev eth0 if_id 42 # Create an XFRM virtual network interface for Tunnel 1, with the interface ID 42 and the public interface eth0 as the underlying interface. 
   ip link add ipsec1 type xfrm dev eth1 if_id 43 # Create an XFRM virtual network interface for Tunnel 2, with the interface ID 43 and the public interface eth1 as the underlying interface. 
   ip link set ipsec0 up # Start the XFRM virtual network interface for Tunnel 1. 
   ip link set ipsec1 up # Start the XFRM virtual network interface for Tunnel 2.

   Important

   The preceding configuration for creating virtual network interfaces is a temporary configuration. After you restart the strongSwan device, you must add the configuration again and run the sudo systemctl restart strongswan;swanctl --load-all command. The command requires root permissions. If you want to configure a script that runs on system startup to automatically create virtual network interfaces after the strongSwan device is restarted, perform the following steps.

   Click here to expand the procedure.

   1. Run the following command to create a script:

      vi xfrm.sh

   2. Add and save the following configurations.

      sudo ip link add ipsec0 type xfrm dev eth0 if_id 42 # Create an XFRM virtual network interface for Tunnel 1, with the interface ID 42 and the public interface eth0 as the underlying interface. 
      sudo ip link add ipsec1 type xfrm dev eth1 if_id 43 # Create an XFRM virtual network interface for Tunnel 2, with the interface ID 43 and the public interface eth1 as the underlying interface. 
      sudo ip link set ipsec0 up # Start the XFRM virtual network interface for Tunnel 1. 
      sudo ip link set ipsec1 up # Start the XFRM virtual network interface for Tunnel 2.

   3. Run the following command to view the absolute path of the script:

      sudo find / -name xfrm.sh

   4. Run the sudo vi /etc/rc.d/rc.local command to add the absolute path of the script to the /etc/rc.d/rc.local file.

      Press i to enter the edit mode. Add the absolute path /root/xfrm.sh to the /etc/rc.d/rc.local file. Press Esc to exit and enter :wq to save the change.

   5. Run the following commands to make the rc.local and xfrm.sh files executable:

      sudo chmod +x /etc/rc.d/rc.local
      sudo chmod +x /root/xfrm.sh

3. Modify the strongSwan configuration file.

   1. Back up the original strongSwan configuration file.

      mv /etc/strongswan/swanctl/swanctl.conf /etc/strongswan/swanctl/swanctl.conf.bak

   2. Create a strongSwan configuration file.

      vi /etc/strongswan/swanctl/swanctl.conf

   3. Add and save the following configurations based on the example.

      Important

      If you plan to use static routing, enable the updown = /root/connect_1.sh and updown = /root/connect_2.sh commands in the configuration file.

      connections {
         vco1 {                            # The VPN configurations of IPsec-VPN Tunnel 1.
            version = 2                    # The IKE version, which must be the same as that configured for Tunnel 1 on Alibaba Cloud. A value of 2 indicates IKEv2. 
            local_addrs  = 172.16.20.80       # The IP address of the first local NIC.
            remote_addrs = 47.XX.XX.151       # Set the remote address of Tunnel 1 to the VPN gateway address of Tunnel 1 on Alibaba Cloud, which is IPsec Address 1. 
            dpd_delay = 10
            rekey_time = 84600             # The SA lifetime of Tunnel 1, which must be the same as that specified in the IKE configurations of Tunnel 1 on Alibaba Cloud. 
            over_time = 1800               
            proposals = aes-sha1-modp1024  # The encryption algorithm, authentication algorithm, and DH group of Tunnel 1, which must be the same as those specified in the IKE configurations of Tunnel 1 on Alibaba Cloud. A value of group2 indicates modp1024. 
            encap = yes
      
            local {
               auth = psk                  # Set the authentication algorithm of the data center to PSK. 
               id = 120.XX.XX.202             # The public IP address of the first local egress. This value must be the same as RemoteId of Tunnel 1. 
            }
            remote {
               auth = psk                  # Set the authentication algorithm of the VPC to PSK. 
               id = 47.XX.XX.151             # IPsec Address 1 on the Alibaba Cloud side. This value must be the same as LocalId of Tunnel 1. 
            }
            children {
               vco_child1 {
                  local_ts  = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0. 
                  remote_ts = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0. 
                  mode = tunnel
                  rekey_time = 85500
                  life_time = 86400        # The SA lifetime of Tunnel 1, which must be the same as that specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. 
                  dpd_action = restart
                  start_action = start
                  close_action = start
                  esp_proposals = aes-sha1-modp1024   # The encryption algorithm, authentication algorithm, and DH group of Tunnel 1, which must be the same as those specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. A value of group2 indicates modp1024. 
      
                  if_id_out = 42           # Specify that the XFRM virtual network interface of Tunnel 1 is used as the egress port and ingress port of Tunnel 1. 
                  if_id_in = 42
                  #updown = /root/connect_1.sh         # Execute the /root/connect_1.sh script to configure routing based on the UP/DOWN status of Tunnel 1. This parameter is required only when static routing is used. 
               }
            }
         }
        vco2 {                             # The VPN configurations of IPsec-VPN Tunnel 2.
            version = 2                    # The IKE version, which must be the same as that configured for Tunnel 2 on Alibaba Cloud. A value of 2 indicates IKEv2. 
            local_addrs  = 172.16.21.248        # The IP address of the second local NIC. 
            remote_addrs = 47.XX.XX.127       # Set the remote address of Tunnel 2 to the VPN gateway address of Tunnel 2 on Alibaba Cloud, which is IPsec address 2. 
            dpd_delay = 10
            rekey_time = 84600             # The SA lifecycle of Tunnel 2, which must be the same as that specified in the IKE configurations of Tunnel 2 on Alibaba Cloud. 
            over_time = 1800               # 
            proposals = aes-sha1-modp1024  # The encryption algorithm, authentication algorithm, and DH group of Tunnel 2, which must be the same as those specified in the IKE configurations of Tunnel 2 on Alibaba Cloud. A value of group2 indicates modp1024. 
            encap = yes
      
            local {
               auth = psk                  # Set the authentication algorithm of the data center to PSK. 
               id = 47.XX.XX.87              # The public IP address of the second local egress. This value must be the same as RemoteId of Tunnel 2. 
            }
            remote {
               auth = psk                  # Set the authentication algorithm of the VPC to PSK. 
               id = 47.XX.XX.127             # IPsec Address 2 on the Alibaba Cloud side. This value must be the same as LocalId of Tunnel 2. 
            }
            children {
               vco_child2 {
                  local_ts  = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0.
                  remote_ts = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0.
                  mode = tunnel 
                  rekey_time = 85500
                  life_time = 86400        # The SA lifetime of Tunnel 2, which must be the same as that specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. 
                  dpd_action = restart
                  start_action = start
                  close_action = start
                  esp_proposals = aes-sha1-modp1024     # The encryption algorithm, authentication algorithm, and DH group of Tunnel 2, which must be the same as those specified in the IPsec configurations of Tunnel 2 on Alibaba Cloud. A value of group2 indicates modp1024. 
                  if_id_out = 43           # Specify that the XFRM virtual network interface of Tunnel 2 is used as the egress port and ingress port of Tunnel 2. 
                  if_id_in = 43
                  #updown = /root/connect_2.sh           # Execute the /root/connect_2.sh script to configure routing based on the UP/DOWN status of Tunnel 2. This parameter is required only when static routing is used. 
               }
            }
         }
      }
      
      secrets {
         ike-vco1 {
            secret = ChangeMe***            # The PSK of Tunnel 1, which must be the same as that configured for Tunnel 1 on Alibaba Cloud. 
         }
         ike-vco2 {
            secret = ChangeMe***            # The PSK of Tunnel 2, which must be the same as that configured for Tunnel 2 on Alibaba Cloud. 
         }
      }

4. Restart the strongSwan process and view the tunnel status.

   sudo systemctl restart strongswan
   swanctl --load-all
   watch swanctl --list-sas

   In the following figure, the strongSwan device and VPN gateway are connected through an IPsec-VPN connection. You still need to configure routing so that they can communicate.

   

5. Configure routes.

   Choose a routing method on demand.

   BGP dynamic routing

   Note

   After the strongSwan device restarts, re-add the BGP configuration.

   1. Run the following command to configure BGP IP addresses.

      ip address add 169.254.10.2/30 dev ipsec0
      ip address add 169.254.20.2/30 dev ipsec1

   2. Install frr.

      yum install -y frr

   3. Run the vi /etc/frr/daemons command to enable BGP dynamic routing.

      Press i to enter the edit mode. Change the value of the bgpd parameter to yes to enable BGP dynamic routing. Press Esc to exit and enter :wq to save the change.

   4. Run the frr feature.

      systemctl enable frr
      systemctl restart frr

   5. Add the BGP configuration.

      1. Run the following command to access the configuration interface.

         vtysh

      2. Run the following command to enter the configuration mode.

         config terminal

      3. Add the BGP configuration.

         Run the following command to replace the following addresses with the actual ones.

         • Replace “169.254.10.1” and “169.254.20.1” with the actual tunnel BGP IP addresses on the Alibaba Cloud side.

         • Replace “65535” with the actual BGP ASN of the VPN gateway.

         • Replace “172.16.20.0/24” and “172.16.21.0/24” with the actual CIDR blocks of the data center.

         route-map allow-all permit 1
         exit
         
         router bgp 65530
          bgp router-id 169.254.10.2
          neighbor 169.254.10.1 remote-as 65535   
          neighbor 169.254.10.1 timers 10 30
          neighbor 169.254.20.1 remote-as 65535    
          neighbor 169.254.20.1 timers 10 30
          
          address-family ipv4 unicast
           network 172.16.20.0/24                  
           network 172.16.21.0/24
           neighbor 169.254.10.1 soft-reconfiguration inbound
           neighbor 169.254.10.1 route-map allow-all in
           neighbor 169.254.10.1 route-map allow-all out
           neighbor 169.254.20.1 soft-reconfiguration inbound
           neighbor 169.254.20.1 route-map allow-all in
           neighbor 169.254.20.1 route-map allow-all out
           maximum-paths 32                       
          exit-address-family
         exit
         

   6. Run exit to exit and run show ip bgp to view BGP routes.

      The strongSwan device has learned routes from the VPC. The data center and VPC can communicate.

   Static routing

   Create two scripts for strongSwan and configure routes to forward traffic.

   1. Create and edit /root/connect_1.sh.

      vi /root/connect_1.sh

   2. Add and save the following script.

      #!/usr/bin/env bash
      if [ x"$PLUTO_VERB" == "xup-client" ]; then
      	echo "ip route add 192.168.0.0/16 dev ipsec0" >> /root/vpn_route.log;ip route add 192.168.0.0/16 dev ipsec0 metric 100
      elif [ x"$PLUTO_VERB" == "xdown-client" ]; then
      	echo "ip route del 192.168.0.0/16 dev ipsec0" >> /root/vpn_route.log;ip route del 192.168.0.0/16 dev ipsec0 metric 100
      fi

      Script purpose: If the status of Tunnel 1 is UP, add a route to transmit traffic from the data center to the VPC whose CIDR block is 192.168.0.0/16 through the XFRM virtual network interface of Tunnel 1. In addition, set the metric value of this route to 100 to assign this route a higher priority than the route that points to the XFRM virtual network interface of Tunnel 2. If the status of Tunnel 1 is DOWN, withdraw the route.

   3. Create and edit /root/connect_2.sh.

      vi /root/connect_2.sh

   4. Add and save the following script.

      #!/usr/bin/env bash
      if [ x"$PLUTO_VERB" == "xup-client" ]; then
      	echo "ip route add 192.168.0.0/16 dev ipsec1" >> /root/vpn_route.log;ip route add 192.168.0.0/16 dev ipsec1 metric 101
      elif [ x"$PLUTO_VERB" == "xdown-client" ]; then
      	echo "ip route del 192.168.0.0/16 dev ipsec1" >> /root/vpn_route.log;ip route del 192.168.0.0/16 dev ipsec1 metric 101
      fi

      Script purpose: If the status of Tunnel 2 is UP, add a route to transmit traffic from the data center to the VPC whose CIDR block is 192.168.0.0/16 through the XFRM virtual network interface of Tunnel 2. In addition, set the metric value of this route to 101 to assign this route a lower priority than the route that points to the XFRM virtual network interface of Tunnel 1. If the status of Tunnel 2 is DOWN, withdraw the route.

   5. Run the following command to make the scripts executable:

      sudo chmod +x /root/connect_1.sh
      sudo chmod +x /root/connect_2.sh

   6. Restart the strongSwan process.

      sudo systemctl restart strongswan

   7. Run the following command to check whether the changes in the configuration file take effect:

      route -n

      

One egress - BGP dynamic routing

1. Create two virtual network interfaces for establishing IPsec-VPN tunnels.

   ip link add ipsec0 type xfrm dev eth0 if_id 42 # Create an XFRM virtual network interface for Tunnel 1, with the interface ID 42 and the public interface eth0 as the underlying interface. 
   ip link add ipsec1 type xfrm dev eth0 if_id 43 # Create an XFRM virtual network interface for Tunnel 2, with the interface ID 43 and the public interface eth0 as the underlying interface. 
   ip link set ipsec0 up # Start the XFRM virtual network interface for Tunnel 1. 
   ip link set ipsec1 up # Start the XFRM virtual network interface for Tunnel 2.

   Important

   The preceding configuration for creating virtual network interfaces is a temporary configuration. After you restart the strongSwan device, you must add the configuration again and run the sudo systemctl restart strongswan;swanctl --load-all command. The command requires root permissions. If you want to configure a script that runs on system startup to automatically create virtual network interfaces after the strongSwan device is restarted, perform the following steps.

   Click here to expand the procedure.

   1. Run the following command to create a script:

      vi xfrm.sh

   2. Add and save the following configurations.

      sudo ip link add ipsec0 type xfrm dev eth0 if_id 42 # Create an XFRM virtual network interface for Tunnel 1, with the interface ID 42 and the public interface eth0 as the underlying interface. 
      sudo ip link add ipsec1 type xfrm dev eth0 if_id 43 # Create an XFRM virtual network interface for Tunnel 2, with the interface ID 43 and the public interface eth0 as the underlying interface. 
      sudo ip link set ipsec0 up # Start the XFRM virtual network interface for Tunnel 1. 
      sudo ip link set ipsec1 up # Start the XFRM virtual network interface for Tunnel 2.

   3. Run the following command to view the absolute path of the script:

      sudo find / -name xfrm.sh

   4. Run the sudo vi /etc/rc.d/rc.local command to add the absolute path of the script to the /etc/rc.d/rc.local file.

      Press i to enter the edit mode. Add the absolute path /root/xfrm.sh to the /etc/rc.d/rc.local file. Press Esc to exit and enter :wq to save the change.

   5. Run the following commands to make the rc.local and xfrm.sh files executable:

      sudo chmod +x /etc/rc.d/rc.local
      sudo chmod +x /root/xfrm.sh

2. Modify the strongSwan configuration file.

   1. Back up the original strongSwan configuration file.

      mv /etc/strongswan/swanctl/swanctl.conf /etc/strongswan/swanctl/swanctl.conf.bak

   2. Create a strongSwan configuration file.

      vi /etc/strongswan/swanctl/swanctl.conf

   3. Add and save the following configurations based on the example.

      connections {
         vco1 {                            # The VPN configurations of IPsec-VPN Tunnel 1. 
            version = 2                    # The IKE version, which must be the same as that configured for Tunnel 1 on Alibaba Cloud. A value of 2 indicates IKEv2. 
            local_addrs  = 172.16.20.80    # The private IP address of eth0. 
            remote_addrs = 47.XX.XX.151    # Set the remote address of Tunnel 1 to the VPN gateway address of Tunnel 1 on Alibaba Cloud, which is IPsec Address 1. 
            dpd_delay = 10
            rekey_time = 84600             # The SA lifetime of Tunnel 1, which must be the same as that specified in the IKE configurations of Tunnel 1 on Alibaba Cloud. 
            over_time = 1800               
            proposals = aes-sha1-modp1024  # The encryption algorithm, authentication algorithm, and DH group of Tunnel 1, which must be the same as those specified in the IKE configurations of Tunnel 1 on Alibaba Cloud. A value of group2 indicates modp1024. 
            encap = yes
      
            local {
               auth = psk                  # Set the authentication algorithm of the data center to PSK. 
               id = 120.XX.XX.202          # The IP address of the Internet egress of eth0. This value must be the same as RemoteId of Tunnel 1. 
            }
            remote {
               auth = psk                  # Set the authentication algorithm of the VPC to PSK. 
               id = 47.XX.XX.151           # IPsec Address 1 on the Alibaba Cloud side. This value must be the same as LocalId of Tunnel 1. 
            }
            children {
               vco_child1 {
                  local_ts  = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0. 
                  remote_ts = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0. 
                  mode = tunnel
                  rekey_time = 85500
                  life_time = 86400        # The SA lifetime of Tunnel 1, which must be the same as that specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. 
                  dpd_action = restart
                  start_action = start
                  close_action = start
                  esp_proposals = aes-sha1-modp1024   # The encryption algorithm, authentication algorithm, and DH group of Tunnel 1, which must be the same as those specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. A value of group2 indicates modp1024. 
      
                  if_id_out = 42           # Specify that the XFRM virtual network interface of Tunnel 1 is used as the egress port and ingress port of Tunnel 1. 
                  if_id_in = 42
               }
            }
         }
        vco2 {                             # The VPN configurations of IPsec-VPN Tunnel 2.
            version = 2                    # The IKE version, which must be the same as that configured for Tunnel 2 on Alibaba Cloud. A value of 2 indicates IKEv2. 
            local_addrs  = 172.16.20.80    # The private IP address of eth0. 
            remote_addrs = 47.XX.XX.87     # Set the remote address of Tunnel 2 to the VPN gateway address of Tunnel 2 on Alibaba Cloud, which is IPsec address 2. 
            dpd_delay = 10
            rekey_time = 84600             # The SA lifecycle of Tunnel 2, which must be the same as that specified in the IKE configurations of Tunnel 2 on Alibaba Cloud. 
            over_time = 1800               # 
            proposals = aes-sha1-modp1024  # The encryption algorithm, authentication algorithm, and DH group of Tunnel 2, which must be the same as those specified in the IKE configurations of Tunnel 2 on Alibaba Cloud. A value of group2 indicates modp1024. 
            encap = yes
      
            local {
               auth = psk                  # Set the authentication algorithm of the data center to PSK. 
               id = 120.XX.XX.202          # The IP address of the Internet egress of eth0. This value must be the same as RemoteId of Tunnel 2. 
            }
            remote {
               auth = psk                  # Set the authentication algorithm of the VPC to PSK. 
               id = 47.XX.XX.87            # IPsec Address 2 on the Alibaba Cloud side. This value must be the same as LocalId of Tunnel 2. 
            }
            children {
               vco_child2 {
                  local_ts  = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0. 
                  remote_ts = 0.0.0.0/0    # Specify that the CIDR block of the protected data flows for the destination-based route mode on Alibaba Cloud is 0.0.0.0/0. 
                  mode = tunnel 
                  rekey_time = 85500
                  life_time = 86400        # The SA lifetime of Tunnel 2, which must be the same as that specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. 
                  dpd_action = restart
                  start_action = start
                  close_action = start
                  esp_proposals = aes-sha1-modp1024     # The encryption algorithm, authentication algorithm, and DH group of Tunnel 2, which must be the same as those specified in the IPsec configurations of Tunnel 2 on Alibaba Cloud. A value of group2 indicates modp1024. 
                  if_id_out = 43           # Specify that the XFRM virtual network interface of Tunnel 2 is used as the egress port and ingress port of Tunnel 2. 
                  if_id_in = 43
                
               }
            }
         }
      }
      
      secrets {
         ike-vco1 {
            secret = ChangeMe***            # The PSK of Tunnel 1, which must be the same as that configured for Tunnel 1 on Alibaba Cloud. 
         }
         ike-vco2 {
            secret = ChangeMe***            # The PSK of Tunnel 2, which must be the same as that configured for Tunnel 2 on Alibaba Cloud. 
         }
      }

3. Restart the strongSwan process and view the tunnel status.

   sudo systemctl restart strongswan
   swanctl --load-all
   watch swanctl --list-sas

   In the following figure, the strongSwan device and VPN gateway are connected through an IPsec-VPN connection. You still need to configure routing so that they can communicate.

   

4. Configure BGP dynamic routing.

   Note

   After the strongSwan device restarts, re-add the BGP configuration.

   1. Run the following command to configure BGP IP addresses.

      ip address add 169.254.10.2/30 dev ipsec0
      ip address add 169.254.20.2/30 dev ipsec1

   2. Install frr.

      yum install -y frr

   3. Run the vi /etc/frr/daemons command to enable BGP dynamic routing.

      Press i to enter the edit mode. Change the value of the bgpd parameter to yes to enable BGP dynamic routing. Press Esc to exit and enter :wq to save the change.

   4. Run the frr feature.

      systemctl enable frr
      systemctl restart frr

   5. Add the BGP configuration.

      1. Run the following command to access the configuration interface.

         vtysh

      2. Run the following command to enter the configuration mode.

         config terminal

      3. Add the BGP configuration.

         Run the following command to replace the following addresses with the actual ones.

         • Replace “169.254.10.1” and “169.254.20.1” with the actual tunnel BGP IP addresses on the Alibaba Cloud side.

         • Replace “65535” with the actual BGP ASN of the VPN gateway.

         • Replace “172.16.20.0/24” and “172.16.21.0/24” with the actual CIDR blocks of the data center.

         route-map allow-all permit 1
         exit
         
         router bgp 65530
          bgp router-id 169.254.10.2
          neighbor 169.254.10.1 remote-as 65535   
          neighbor 169.254.10.1 timers 10 30
          neighbor 169.254.20.1 remote-as 65535    
          neighbor 169.254.20.1 timers 10 30
          
          address-family ipv4 unicast
           network 172.16.20.0/24                  
           network 172.16.21.0/24
           neighbor 169.254.10.1 soft-reconfiguration inbound
           neighbor 169.254.10.1 route-map allow-all in
           neighbor 169.254.10.1 route-map allow-all out
           neighbor 169.254.20.1 soft-reconfiguration inbound
           neighbor 169.254.20.1 route-map allow-all in
           neighbor 169.254.20.1 route-map allow-all out
           maximum-paths 32                       
          exit-address-family
         exit
         

   6. Run exit to exit and run show ip bgp to view BGP routes.

      The strongSwan device has learned routes from the VPC. The data center and VPC can communicate.

One egress - static routing

1. Back up the original strongSwan configuration file.

   mv /etc/strongswan/swanctl/swanctl.conf /etc/strongswan/swanctl/swanctl.conf.bak

2. Create a strongSwan configuration file.

   vi /etc/strongswan/swanctl/swanctl.conf

3. Add and save the following configurations based on the Examples section.

   connections {
      vco1 {                            # The VPN configurations of IPsec-VPN Tunnel 1. 
         version = 2                    # The IKE version, which must be the same as that configured for Tunnel 1 on Alibaba Cloud. A value of 2 indicates IKEv2. 
         local_addrs  = 172.16.20.80      # The private IP addess of eth0. 
         remote_addrs = 47.XX.XX.151      # Set the remote address of Tunnel 1 to the VPN gateway address of Tunnel 1 on Alibaba Cloud, which is IPsec Address 1. 
         dpd_delay = 10
         rekey_time = 84600             # The SA lifetime of Tunnel 1, which must be the same as that specified in the IKE configurations of Tunnel 1 on Alibaba Cloud. 
         over_time = 1800               
         proposals = aes-sha1-modp1024  # The encryption algorithm, authentication algorithm, and DH group of Tunnel 1, which must be the same as those specified in the IKE configurations of Tunnel 1 on Alibaba Cloud. A value of group2 indicates modp1024. 
         encap = yes
   
         local {
            auth = psk                   # Set the authentication algorithm of the data center to PSK. 
            id = 120.XX.XX.202            # The IP address of the local Internet egress. This value must be the same as RemoteId of Tunnel 1. 
         }
         remote {
            auth = psk                  # Set the authentication algorithm of the VPC to PSK. 
            id = 120.XX.XX.202            # IPsec Address 1 on the Alibaba Cloud side. This value must be the same as LocalId of Tunnel 1. 
         }
         children {
            vco_child1 {
               local_ts  = 172.16.0.0/16   # The local protected data flows. Enter the private CIDR block of the data center, which is 172.16.0.0/16. 
               remote_ts = 192.168.0.0/16  # The protected data flows on the Alibaba Cloud side. Enter the VPC CIDR block, which is 192.168.0.0/16. 
               mode = tunnel
               rekey_time = 85500
               life_time = 86400        # The SA lifetime of Tunnel 1, which must be the same as that specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. 
               dpd_action = restart
               start_action = start
               close_action = start
               esp_proposals = aes-sha1-modp1024   # The encryption algorithm, authentication algorithm, and DH group of Tunnel 1, which must be the same as those specified in the IPsec configurations of Tunnel 1 on Alibaba Cloud. A value of group2 indicates modp1024. 
               priority = 1                        # The priority of Tunnel 1. Prioritize Tunnel 1. 
            }
         }
      }
     vco2 {                             # The VPN configurations of IPsec-VPN Tunnel 2.
         version = 2                    # The IKE version, which must be the same as that configured for Tunnel 2 on Alibaba Cloud. A value of 2 indicates IKEv2. 
         local_addrs  = 172.16.20.80    # The private IP address of eth0.
         remote_addrs = 47.XX.XX.87     # Set the remote address of Tunnel 2 to the VPN gateway address of Tunnel 2 on Alibaba Cloud, which is IPsec address 2. 
         dpd_delay = 10
         rekey_time = 84600             # The SA lifetime of Tunnel 2, which must be the same as that specified in the IKE configurations of Tunnel 2 on Alibaba Cloud. 
         over_time = 1800               
         proposals = aes-sha1-modp1024  # The encryption algorithm, authentication algorithm, and DH group of Tunnel 2, which must be the same as those specified in the IKE configurations of Tunnel 2 on Alibaba Cloud. A value of group2 indicates modp1024. 
         encap = yes
   
         local {
            auth = psk                  # Set the authentication algorithm of the data center to PSK. 
            id = 120.XX.XX.202          # The public IP address of the local Internet egress. This value must be the same as RemoteId of Tunnel 2. 
         }
         remote {
            auth = psk                  # Set the authentication algorithm of the VPC to PSK. 
            id = 47.XX.XX.87            #  IPsec Address 2 on the Alibaba Cloud side. This value must be the same as LocalId of Tunnel 2. 
         }
         children {
            vco_child2 {
               local_ts  = 172.16.0.0/16     # The local protected data flows. Enter the private CIDR block of the data center, which is 172.16.0.0/16. 
               remote_ts =  192.168.0.0/16   # The protected data flows on the Alibaba Cloud side. Enter the VPC CIDR block, which is 192.168.0.0/16. 
               mode = tunnel 
               rekey_time = 85500
               life_time = 86400        # The SA lifetime of Tunnel 2, which must be the same as that specified in the IPsec configurations of Tunnel 2 on Alibaba Cloud. 
               dpd_action = restart
               start_action = start
               close_action = start
               esp_proposals = aes-sha1-modp1024     # The encryption algorithm, authentication algorithm, and DH group of Tunnel 2, which must be the same as those specified in the IPsec configurations of Tunnel 2 on Alibaba Cloud. A value of group2 indicates modp1024. 
               priority = 2                          # The priority of Tunnel 2, which is lower than Tunnel 1. 
            }
         }
      }
   }
   
   secrets {
      ike-vco1 {
         secret = ChangeMe***            # The PSK of Tunnel 1, which must be the same as that configured for Tunnel 1 on Alibaba Cloud. 
      }
      ike-vco2 {
         secret = ChangeMe***            # The PSK of Tunnel 2, which must be the same as that configured for Tunnel 2 on Alibaba Cloud. 
      }
   }

4. Restart the strongSwan process and view the tunnel status.

   sudo systemctl restart strongswan
   swanctl --load-all
   watch swanctl --list-sas

   In the following figure, the strongSwan device and VPN gateway are connected through an IPsec-VPN connection. The data center and VPC can communicate.