An IPsec-VPN connection in dual-tunnel mode has an active tunnel and a standby tunnel. If the active tunnel is down, the standby tunnel takes over to ensure service availability. This topic describes how to upgrade a VPN gateway to enable the dual-tunnel mode.
Background information
Before you upgrade a VPN gateway to enable the dual-tunnel mode, we recommend that you know more about the dual-tunnel mode such as the network topology and data transfer path. For more information, see [Upgrade notice] IPsec-VPN connections support the dual-tunnel mode.
Supported regions and zones
The following table describes the regions and zones in which you can upgrade IPsec-VPN connections to enable the dual-tunnel mode.
Region | Zone |
China (Hangzhou) | Zone K, Zone J, Zone I, Zone H, and Zone G |
China (Shanghai) | Zone K, Zone L, Zone M, Zone N, Zone B, Zone D, Zone E, Zone F, and Zone G |
China (Nanjing - Local Region) | Zone A |
China (Shenzhen) | Zone A, Zone E, Zone D, and Zone F |
China (Heyuan) | Zone A and Zone B |
China (Guangzhou) | Zone A and Zone B |
China (Qingdao) | Zone B and Zone C |
China (Beijing) | Zone F, Zone E, Zone H, Zone G, Zone A, Zone C, Zone J, Zone I, Zone L, and Zone K |
China (Zhangjiakou) | Zone A, Zone B, and Zone C |
China (Hohhot) | Zone A and Zone B |
China (Ulanqab) | Zone A, Zone B, and Zone C |
China (Chengdu) | Zone A and Zone B |
China (Hong Kong) | Zone B, Zone C, and Zone D |
Singapore | Zone A, Zone B, and Zone C |
Thailand (Bangkok) | Zone A |
Japan (Tokyo) | Zone A, Zone B, and Zone C |
South Korea (Seoul) | Zone A |
Philippines (Manila) | Zone A |
Indonesia (Jakarta) | Zone A, Zone B, and Zone C |
Malaysia (Kuala Lumpur) | Zone A and Zone B |
UK (London) | Zone A and Zone B |
Germany (Frankfurt) | Zone A, Zone B, and Zone C |
US (Silicon Valley) | Zone A and Zone B |
US (Virginia) | Zone A and Zone B |
SAU (Riyadh - Partner Region) | Zone A and Zone B |
UAE (Dubai) | Zone A |
Prerequisites
Before you upgrade a VPN gateway, make sure that the following requirements are met:
Usage notes on the upgrade process
A VPN gateway is unavailable during the upgrade process. The existing connections are interrupted. We recommend that you upgrade a VPN gateway during a network maintenance window to prevent service interruptions.
The upgrade takes about 10 minutes. During this period, the VPN gateway cannot forward traffic.
You cannot manage the VPN gateway during the upgrade process.
Procedure
- Log on to the VPN gateway console.
In the top navigation bar, select the region in which the VPN gateway resides.
On the VPN Gateways page, click the ID of the VPN gateway that you want to manage.
In the upper-right corner of the details page, click Enable Zone Redundancy.
In the Enable Zone Redundancy dialog box, specify a vSwitch and enable environment verification. Make sure that the requirements are met and click Enable.
If the environment verification failed, refer to the Prerequisites section of this topic for troubleshooting.
After you click Enable, the system starts the upgrade.
What to do next
When you use a dual-tunnel IPsec-VPN connection, make sure that the active tunnel and standby tunnel are available. If you configure or use only one of the tunnels, IPsec-VPN connection redundancy based on active/standby tunnels and zone-disaster recovery are not supported.