VPN Gateway:Create and manage a VPN gateway instance

Limitations

• The maximum bandwidth for data transfer between an on-premises data center and a VPN gateway varies based on the IPsec-VPN tunnel mode and the maximum bandwidth of the VPN gateway.

  IPsec-VPN tunnel mode	Gateway bandwidth	Outbound bandwidth	Inbound bandwidth
  Dual-tunnel	Greater than 10 Mbps	The maximum bandwidth of the VPN gateway.	The maximum bandwidth of the VPN gateway.
  	Less than or equal to 10 Mbps	The maximum bandwidth of the VPN gateway.	10 Mbps.
  Single-tunnel	Greater than 100 Mbps	The maximum bandwidth of the VPN gateway.	The maximum bandwidth of the VPN gateway.
  	Less than or equal to 100 Mbps	The maximum bandwidth of the VPN gateway.	100 Mbps.

• The maximum bandwidth supported by a VPN gateway varies by region. In some regions, the maximum bandwidth can reach 1,000 Mbps.

  Classification	Region
  Regions that support a maximum bandwidth of 1,000 Mbps	China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), Singapore, Japan (Tokyo), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Thailand (Bangkok), South Korea (Seoul), Philippines (Manila), US (Silicon Valley), US (Virginia), Germany (Frankfurt), UK (London), Mexico
  Regions that support a maximum bandwidth of 500 Mbps	China (Nanjing - Local Region), UAE (Dubai), and SAU (Riyadh - Partner Region)

Create a VPN gateway instance

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where you want to create the VPN gateway.

   Ensure the VPN gateway is in the same region as the VPC that clients will access.

3. On the VPN Gateways page, click Create VPN Gateway.

4. On the buy page, set the following parameters, click Buy Now, and then complete the payment.

   Parameter	Description
   Instance name	The name of the VPN gateway.
   Resource group	The resource group to which the VPN gateway belongs. If you do not select a resource group, the VPN gateway is added to the default resource group. You can use the Resource Management console to manage the resource groups of your VPN gateways and other cloud resources. For more information, see What is Resource Management?.
   Region	The region where you want to create the VPN gateway. Ensure the VPN gateway is in the same region as the VPC that clients will access.
   Gateway type	The type of the VPN gateway. Default value: Standard.
   Network type	The network type of the VPN gateway. Select Public. This allows you to establish SSL-VPN connections over the internet.
   Tunnels	Shows the IPsec-VPN tunnel modes supported in the selected region. Single-tunnel Dual-tunnel
   VPC	The VPC to associate with the VPN gateway. The VPN gateway must be associated with the VPC that clients need to access.
   vSwitch	A vSwitch from the specified VPC. If the IPsec-VPN connection uses the single-tunnel mode, you need to specify only one vSwitch. If the IPsec-VPN connection uses the dual-tunnel mode, you need to specify two vSwitches. After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) in each vSwitch. The ENIs enable communication between the VPC and the IPsec-VPN connection. Each ENI uses an IP address from its vSwitch. Note By default, the system selects the first vSwitch. You can use the default vSwitch or select another one. You cannot change the vSwitch associated with a VPN gateway after it is created. On the details page of the VPN gateway, you can view information about the associated vSwitch, its zone, and the ENI in it.
   vSwitch 2	A second vSwitch from the VPC. This parameter is required if you use the dual-tunnel mode. You must specify two vSwitches that are located in different zones within the associated VPC. For a region with only one zone, specify two different vSwitches in that zone. Regions that support only one zone China (Nanjing - Local Region), Thailand (Bangkok), South Korea (Seoul), Philippines (Manila), UAE (Dubai), and Mexico.
   Maximum bandwidth	The maximum bandwidth for the VPN gateway, in Mbps.
   Traffic	The billing method for the VPN gateway. The default value is Pay-by-data-transfer.
   IPsec-VPN	Specifies whether to enable the IPsec-VPN feature. This feature is not required for SSL-VPN connections.
   SSL-VPN	Specifies whether to enable the SSL-VPN feature. You must Enable this feature to establish an SSL-VPN connection. Note If the VPN gateway is in dual-tunnel mode, the system creates an ENI in each of the two vSwitches that you specified when you enable the SSL-VPN feature. These ENIs enable traffic exchange between the SSL-VPN connection and the VPC. Each ENI uses an IP address from its vSwitch. The ENIs created for the SSL-VPN feature are independent of the ENIs created for the IPsec-VPN feature. If you enable both the IPsec-VPN and SSL-VPN features for a VPN gateway, the system creates four ENIs in the vSwitches of the VPC.
   SSL connections	If you enable SSL-VPN, specify the maximum number of concurrent client connections.
   Duration	The billing cycle of the VPN gateway. The default value is Pay-As-You-Go.
   Service-linked role	Click Create Service-linked Role. The system automatically creates the AliyunServiceRoleForVpn service-linked role. The VPN Gateway service uses this role to access resources in other cloud services. For more information, see AliyunServiceRoleForVpn. If Created is displayed, the role has already been created for your account.

   After the VPN gateway is created, the system assigns a public IP address to it. This IP address enables clients to establish an SSL-VPN connection to the VPN gateway.

   Next steps

   To establish an SSL-VPN connection, you must also create an SSL server after creating the VPN gateway. For more information, see Create and manage an SSL server.

Modify the name and description of a VPN gateway

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where the VPN gateway instance resides.

3. On the VPN Gateways page, find the VPN gateway that you want to manage and click its ID.

4. In the Basic Information section on the details page of the VPN gateway, modify the name and description of the VPN gateway.

   • Click Edit next to the Name parameter. In the dialog box that appears, modify the name of the VPN gateway and click OK.

   • Click Edit next to the Description field. In the dialog box that appears, modify the description and click OK.

Delete a VPN gateway instance

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where the VPN gateway instance resides.

3. On the VPN Gateways page, find the VPN gateway that you want to delete and click Delete in the Actions column.

4. In the Delete VPN Gateway dialog box, click OK.

Create and manage VPN gateways by calling API operations

You can call API operations to create and manage VPN gateways by using tools such as Alibaba Cloud SDKs, Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS). We recommend that you use Alibaba Cloud SDKs. For more information about the related API operations, see the following topics:

• CreateVpnGateway: creates a VPN gateway.

• ModifyVpnGatewayAttribute: modifies the name and description of a VPN gateway.

• DeleteVpnGateway: deletes a VPN gateway.

• DescribeVpnGateway: queries the information about a VPN gateway.

• DescribeVpnGateways: queries the information about VPN gateways in a region.

• MoveVpnResourceGroup: modifies the resource group to which a VPN gateway belongs.