VPN Gateway:Create multiple private IPsec-VPN connections to implement load balancing

Scenarios

The preceding scenario is used as an example in this topic. An enterprise owns a data center in Shanghai and created a VPC in the China (Hangzhou) region. Applications are deployed on an Elastic Compute Service (ECS) instance in the VPC. The enterprise wants to create private connections between the data center and the VPC. The enterprise also wants to encrypt the private connections and use the connections to implement load balancing based on ECMP routing.

Network design

Network settings

The following network settings are used in this topic:

• The data center is connected to Alibaba Cloud through two Express Connect circuits, and communicates with the VPC through a Cloud Enterprise Network (CEN) instance. The two Express Connect circuits ensure network redundancy and forward traffic.

• After the data center and the VPC are connected through Express Connect circuits, you can create IPsec-VPN connections over the Express Connect circuits. You can create two IPsec-VPN connections over each Express Connect circuit. The connections encrypt data transmission between the data center and the VPC, and balance the load of traffic based on ECMP routing.

  • When you create an IPsec-VPN connection, you must set Gateway Type to Private.

  • The resources associated with the IPsec-VPN connections must be of the CEN type. This way, multiple IPsec-VPN connections can form ECMP connections.

    Note

    You can associate IPsec-VPN connections only with Enterprise Edition transit routers.

• The data center, the virtual border routers (VBRs), and the IPsec-VPN connections use BGP to automatically learn and advertise routes. This facilitates route configuration. When one of the IPsec-VPN connections fails, traffic is redirected to another IPsec-VPN connection. This ensures service reliability.

Network planning

Preparations

Procedure

Step 1: Deploy Express Connect circuits

You must deploy an Express Connect circuit to connect the data center to Alibaba Cloud.

1. Create dedicated connections over Express Connect circuits.

   In this example, two dedicated connections over Express Connect circuits are created in the China (Shanghai) region. The Express Connect circuits are named Express Connect Circuit 1 and Express Connect Circuit 2. For more information, see Create and manage a dedicated connection over an Express Connect circuit.

   When you apply for the second Express Connect circuit, you may need to specify a redundant Express Connect circuit based on the access point.

   • If you want to connect the Express Connect circuits to the same access point, you must specify the redundant Express Connect circuit. Set Redundant Connection ID to the first Express Connect circuit. This way, the Express Connect circuits will be connected to different access devices.
   • If you want to connect the Express Connect circuits to different access points, you do not need to specify the redundant Express Connect circuit. In this case, you do not need to specify Redundant Connection ID.

     In this example, the Express Connect circuits are connected to different access points.

2. Create a VBR.

   1. Log on to the Express Connect console.

   2. In the left-side navigation pane, click Virtual Border Routers (VBRs).

   3. In the top navigation bar, select the region where you want to create the VBR.

      In this example, China (Shanghai) is selected.

   4. On the Virtual Border Routers (VBRs) page, click Create VBR.

   5. In the Create VBR panel, set the following parameters and click OK.

      Create two VBRs based on the following information. Associate the VBRs with different Express Connect circuits. The following table describes only the key parameters. The default values are used for the other parameters. For more information, see Create and manage a VBR.

      Parameter	Description	VBR1	VBR2
      Account	Specify whether to create a VBR for the current or another Alibaba Cloud account.	In this example, Current account is selected.
      Name	Enter a name for the VBR.	In this example, VBR1 is used.	In this example, VBR2 is used.
      Physical Connection Interface	Select the Express Connect circuit that you want to associate with the VBR.	In this example, Dedicated Physical Connection is selected, and Express Connect circuit 1 that is created in Step 1 is selected.	In this example, Dedicated Physical Connection is selected, and the Express Connect circuit 2 that is created in Step 1 is selected.
      VLAN ID	Enter the VLAN ID of the VBR. Note Make sure that the VLAN ID of the VBR is the same as the VLAN ID of the interface that the on-premises gateway device uses to connect to the Express Connect circuit.	In this example, 201 is used.	In this example, 202 is used.
      Set VBR Bandwidth Value	Specify a maximum bandwidth value for the VBR.	Select a maximum bandwidth value based on your business requirements.
      IPv4 Address (Alibaba Cloud Gateway)	Specify an IPv4 address for the VBR to route network traffic from the VPC to the data center.	In this example, 10.0.0.2 is used.	In this example, 10.0.1.2 is used.
      IPv4 Address (Data Center Gateway)	Specify an IPv4 address for the gateway device in the data center to route network traffic from the data center to the VPC.	In this example, 10.0.0.1 is used.	In this example, 10.0.1.1 is used.
      Subnet Mask (IPv4 Address)	Enter the subnet mask of the specified IPv4 addresses.	In this example, 255.255.255.252 is used.	In this example, 255.255.255.252 is used.

3. Configure a BGP group for each VBR.

   1. On the Virtual Border Routers (VBRs) page, click the ID of the VBR that you want to manage.

   2. On the details page, click the BGP Groups tab.

   3. On the BGP Groups tab, click Create BGP Group, set the following parameters, and click OK.

      Configure the BGP groups based on the following information. The following table describes only the key parameters. The default values are used for the other parameters. For more information, see Create a BGP group.

      Parameter	Description	VBR1	VBR2
      Name	Enter a name for the BGP group.	In this example, VBR1-BGP is used.	In this example, VBR2-BGP is used.
      Peer ASN	Enter the ASN of the on-premises gateway device.	In this example, 65530 is used. This is the ASN of On-premises Gateway Device 1.	In this example, 65530 is used. This is the ASN of On-premises Gateway Device 2.

4. Configure a BGP peer for each VBR.

   1. On the VBR details page, click the BGP Peers tab.

   2. On the BGP Peers tab, click Create BGP Peer.

   3. In the Create BGP Peer panel, set the following parameters and click OK:

      Configure the BGP peers based on the following information. The following table describes only the key parameters. The default values are used for the other parameters. For more information, see Create a BGP peer.

      Parameter	Description	VBR1	VBR2
      BGP Group	Select the BGP group to which you want to add the BGP peer.	In this example, VBR1-BGP is selected.	In this example, VBR2-BGP is selected.
      BGP Peer IP Address	Enter the IP address of the BGP peer.	In this example, the IP address 10.0.0.1 is entered. This is the IP address of the interface that On-premises Gateway Device 1 uses to connect to Express Connect Circuit 1.	In this example, the IP address 10.0.1.1 is entered. This is the IP address of the interface that On-premises Gateway Device 2 uses to connect to Express Connect Circuit 2.

5. Configure BGP routing for the on-premises gateway devices.

   After you configure BGP routing for the on-premises gateway devices, the on-premises gateway devices and the VBRs establish peering connections, and automatically learn and advertise routes. The following configurations are used for reference only. The commands may vary based on the network device vendor. Contact the vendor to obtain the information about specific commands.

   # Configure On-premises Gateway Device 1.
   router bgp 65530                         //Enable BGP and configure the ASN of the data center. In this example, 65530 is used. 
   bgp router-id 10.0.0.1                   //Enter the ID of the BGP router. In this example, 10.0.0.1 is used. 
   bgp log-neighbor-changes
   neighbor 10.0.0.2 remote-as 45104        //Establish a peering connection to VBR1. 
   !
   address-family ipv4
   network 192.168.0.0 mask 255.255.255.0     //Advertise the CIDR block of the data center. 
   network 192.168.1.0 mask 255.255.255.0
   network 192.168.2.0 mask 255.255.255.0 
   neighbor 10.0.0.2 activate               //Activate the BGP peer. 
   exit-address-family
   !
   # Configure On-premises Gateway Device 2.
   router bgp 65530                         //Enable BGP and configure the ASN of the data center. In this example, 65530 is used. 
   bgp router-id 10.0.1.1                   //Enter the ID of the BGP router. In this example, 10.0.1.1 is used. 
   bgp log-neighbor-changes
   neighbor 10.0.1.2 remote-as 45104        //Establish a peering connection to VBR2. 
   !
   address-family ipv4
   network 192.168.0.0 mask 255.255.255.0     //Advertise the CIDR block of the data center. 
   network 192.168.1.0 mask 255.255.255.0
   network 192.168.2.0 mask 255.255.255.0 
   neighbor 10.0.1.2 activate               //Activate the BGP peer. 
   exit-address-family
   !

Step 2: Configure a CEN instance

After you deploy the Express Connect circuits, the data center is connected to Alibaba Cloud through the Express Connect circuits. However, the data center and the VPC cannot communicate with each other. To enable communication between the data center and the VPC, you must connect the VBRs and the VPC to a CEN instance.

1. Create a VPC connection.

   1. Log on to the CEN console.

   2. On the Instances page, find the CEN instance that you created and click its ID.

   3. On the Basic Settings > Transit Router tab, find the transit router that you want to manage and click Create Connection in the Actions column.

   4. On the Connection with Peer Network Instance page, set the following parameters and click OK.

      Parameter	Description	VPC connection
      Network Type	Specify the type of network instance.	In this example, VPC is selected.
      Region	Select the region of the network instance.	China (Hangzhou) is selected in this example.
      Transit Router	The system automatically displays the transit router in the current region.
      Resource Owner ID	Specify whether the network instance belongs to the current Alibaba Cloud account.	In this example, Your Account is selected.
      Billing Method	Select a billing method for the VPC connection. Default value: Pay-As-You-Go. For more information about the billing rules for transit routers, see Billing rules.
      Attachment Name	Enter a name for the VPC connection.	In this example, VPC-test is used.
      Networks	Select a network instance.	In this example, the VPC created in the Preparations section is selected.
      vSwitch	Select the vSwitches that are deployed in the zones of the transit router. If the transit router supports only one zone in the current region, select a vSwitch in the zone. If the transit router supports multiple zones in the current region, you need to select at least two vSwitches that reside in different zones. When the VPC and transit router communicate, the vSwitches are used to implement zone-disaster recovery. We recommend that you select a vSwitch in each zone to reduce the network latency and improve network performance because data can be transmitted over a shorter distance. Make sure that each selected vSwitch has at least one idle IP address. If the VPC does not have a vSwitch in the zone supported by the transit router or the vSwitch does not have an idle IP address, create a new vSwitch in the zone. For more information, see Create and manage a vSwitch. For more information, see Connect VPCs.	In this example, vSwitch 1 is selected in Zone H and vSwitch 2 is selected in Zone I.
      Advanced Settings	Specify whether to enable the advanced features. By default, all advanced features are enabled.	In this example, the default settings are used.

2. Create VBR connections.

   1. Return to the Basic Settings > Transit Router tab, find the transit router that you want to manage and click Create Connection in the Actions column.

   2. On the Connection with Peer Network Instance page, set the following parameters and click OK.

      Create a VBR connection for VBR1 and VBR2 based on the following information.

      Parameter	Description	VBR1	VBR2
      Network Type	Specify the type of network instance.	In this example, Virtual Border Router (VBR) is selected.
      Region	Specify the region of the network instance.	In this example, China (Shanghai) is selected.
      Transit Router	The system automatically displays the transit router in the current region.
      Resource Owner ID	Specify whether the network instance belongs to the current Alibaba Cloud account.	In this example, Your Account is selected.
      Attachment Name	Enter a name for the network connection.	In this example, VBR1-test is used.	In this example, VBR2-test is used.
      Networks	Select a network instance.	VBR1 is selected in this example.	VBR2 is selected in this example.
      Advanced Settings	Specify whether to enable the advanced features. By default, all advanced features are enabled.	In this example, the default settings are used.

3. Purchase a bandwidth plan.

   The transit router associated with the VBRs and the transit router associated with the VPC are deployed in different regions. By default, the VBRs cannot communicate with the VPC in this scenario. To allow the VBRs to communicate with the VPC across regions, you need to create an inter-region connection between the transit router in the China (Hangzhou) region and the transit router in the China (Shanghai) region.

   You can allocate bandwidth to an inter-region connection from a bandwidth plan or pay for the bandwidth usage of the inter-region connection on a pay-by-data-transfer basis. In this example, a bandwidth plan is used.

   Purchase a bandwidth plan to allocate bandwidth for inter-region communication before you create an inter-region connection.

   1. On the Instances page, find the CEN instance that you want to manage and click its ID.

   2. On the details page of the CEN instance, choose Basic Settings > Bandwidth Plans and click Purchase Bandwidth Plan(Subscription).

   3. On the buy page, configure the following parameters, click Buy Now, and then complete the payment.

      Parameter	Description
      CEN ID	Select the CEN instance for which you want to purchase the bandwidth plan. After you complete the payment, the bandwidth plan is automatically associated with the CEN instance. In this example, the CEN instance created in the Preparations section is selected.
      Area A	Select one of the areas where you want to enable inter-region communication. Mainland China is selected in this example. Note After you purchase a bandwidth plan, you cannot change the areas that you selected for the bandwidth plan. For more information about the regions and areas that support bandwidth plans, see Work with a bandwidth plan.
      Area B	Select the other area where you want to enable inter-region communication. Mainland China is selected in this example.
      Billing method	Displays the billing method of the bandwidth plan. The default billing method is Pay by Bandwidth. For more information about bandwidth plan billing, see Billing rules.
      Bandwidth	Select a bandwidth value based on your business requirements. Unit: Mbit/s.
      Bandwidth_package_name	Enter a name for the bandwidth plan.
      Order time	Select a subscription duration for the bandwidth plan. You can select Auto-renewal to allow the system to automatically renew the bandwidth plan.

4. Create an inter-region connection

   1. On the Instances page, find the CEN instance that you want to manage and click its ID.

   2. Navigate to the Basic Settings > Bandwidth Plans tab and click Set Region Connection.

   3. On the Connection with Peer Network Instance page, set the following parameters and click OK.

      Parameter	Description
      Network type	Inter-region Connection is selected in this example.
      Region	Select the region that you want to connect. China (Hangzhou) is selected in this example.
      Transit Router	The system automatically displays the ID of the transit router in the selected region.
      Attachment Name	Enter a name for the inter-region connection. In this example, Cross-Region-test is used.
      Peer Region	Select the other region to be connected. In this example, China (Shanghai) is selected.
      Transit Router	The system automatically displays the ID of the transit router in the selected region.
      Bandwidth Allocation Mode	The following modes are supported: Allocate from Bandwidth Plan: Bandwidth resources are allocated from a purchased bandwidth plan. Pay-By-Data-Transfer: You are charged for data transfer over the inter-region connection. In this example, Allocate from Bandwidth Plan is selected.
      Bandwidth Plan	Select the bandwidth plan that is associated with the CEN instance.
      Bandwidth	Specify a bandwidth value for the inter-region connection. Unit: Mbit/s.
      Advanced Settings	By default, all advanced features are enabled. In this example, the default setting is used.

Step 3: Create IPsec-VPN connections

After you complete the preceding steps, the data center can communicate with the VPC over private connections. However, data transmission between the data center and the VPC is not encrypted. To encrypt data transmission, you must create IPsec-VPN connections between the data center and Alibaba Cloud.

1. Log on to the VPN Gateway console.

2. Create a customer gateway.

   Before you create IPsec-VPN connections, you need to create customer gateways to provide information about the on-premises gateway devices to Alibaba Cloud.

   1. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

   2. In the top navigation bar, select the region where you want to create the customer gateways.

      VPN gateways do not support cross-border IPsec-VPN connections. Therefore, you need to follow the nearby access principle and select a region that is closest to your data center when you choose the region in which your customer gateways are deployed. In this example, China (Shanghai) is selected.

      For more information about cross-border connections, see What are inter-border connections and intra-border connections?.

   3. On the Customer Gateway page, click Create Customer Gateway.

   4. In the Create Customer Gateway panel, set the following parameters and click OK.

      Create four customer gateways in the China (Shanghai) region based on the following information.

      Parameter	Description	Customer Gateway 1	Customer Gateway 2	Customer Gateway 3	Customer Gateway 4
      Name	Enter a name for each customer gateway.	Customer-Gateway1	Customer-Gateway2	Customer-Gateway3	Customer-Gateway4
      IP Address	Enter the public IP address of the on-premises gateway device to be connected to Alibaba Cloud.	In this example, 192.168.0.1, the first VPN IP address of On-premises Gateway Device 1, is entered.	In this example, 192.168.1.1, the second VPN IP address of On-premises Gateway Device 1, is entered.	In this example, 192.168.1.2, the first VPN IP address of On-premises Gateway Device 2, is entered.	In this example, 192.168.2.2, the second VPN IP address of On-premises Gateway Device 2, is entered.
      ASN	Enter the BGP ASN of the on-premises gateway device.	65530 is used in this example.

3. Create IPsec-VPN connections.

   After you create customer gateways, you need to create IPsec-VPN connections between Alibaba Cloud and the data center.

   1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

   2. In the top navigation bar, select the region in which you want to create IPsec-VPN connections.

      The IPsec-VPN connections and the customer gateways must be created in the same region. In this example, China (Shanghai) is selected.

   3. On the IPsec-VPN connection page, click Create IPsec-VPN Connection.

   4. On the Create IPsec-VPN Connection page, set the following parameters and click OK.

      Create four IPsec-VPN connections in the China (Shanghai) region based on the following information. You are charged for using IPsec-VPN connections. For more information, see Billing rules.

      Parameter	Description	IPsec-VPN Connection 1	IPsec-VPN Connection 2	IPsec-VPN Connection 3	IPsec-VPN Connection 4
      Name	Enter a name for each IPsec-VPN connection.	IPsec-VPN Connection 1	IPsec-VPN Connection 2	IPsec-VPN Connection 3	IPsec-VPN Connection 4
      Associate Resource	Select the type of network resource to be associated with the IPsec-VPN connection.	In this example, CEN is selected.
      Gateway Type	Select the network type of the IPsec-VPN connection.	In this example, Private is selected.
      CEN Instance ID	Select a CEN instance.	In this example, the CEN instance created in the Preparations section is selected.
      Transit Router	Select the transit router to be associated with the IPsec-VPN connection.	The system automatically selects a transit router in the region in which the IPsec-VPN connection is created.
      Zone	Select the zone in which the IPsec-VPN connection is created. Make sure that the IPsec-VPN connection is created in a zone that supports transit routers.	In this example, Shanghai Zone F is selected. Note In this scenario, we recommend that you deploy IPsec-VPN connections in different zones to implement disaster recovery.		In this example, Shanghai Zone G is selected.
      Customer Gateway	Select the customer gateways to be associated with the IPsec-VPN connections.	Customer-Gateway1	Customer-Gateway2	Customer-Gateway3	Customer-Gateway4
      Routing Mode	Select a routing mode.	In this example, Destination Routing Mode is selected.
      Effective Immediately	Select whether to immediately apply the settings of the IPsec-VPN connection. Valid values: Yes: starts negotiations when the configuration is complete. No: starts connection negotiations when traffic is received.	In this example, Yes is selected.
      Pre-Shared Key	Enter a pre-shared key that is used to authenticate the on-premises gateway device. The pre-shared key must be 1 to 100 characters in length, and can contain digits, letters, and the following characters: ~`!@#$%^&*()_-+={}[]\|;:',.<>/?. If you do not specify a pre-shared key, the system generates a random 16-bit string as the pre-shared key. After you create an IPsec-VPN connection, you can click Edit to view the pre-shared key that is generated by the system. For more information, see Modify an IPsec-VPN connection. Important The IPsec-VPN connection and the peer gateway device must use the same pre-shared key. Otherwise, the system cannot establish an IPsec-VPN connection.	fddsFF123****	fddsFF456****	fddsFF789****	fddsFF901****
      EncryptionConfiguration	Set encryption configurations, including IKE configurations and IPsec configurations.	In this example, ikev1 is used and the other parameters use the default settings. For more information, see Create and manage IPsec-VPN connections in single-tunnel mode.
      BGP Configuration	Specify whether to enable BGP. By default, BGP is disabled.	In this example, BGP is enabled.
      Tunnel CIDR Block	Specify the CIDR block that is used for IPsec tunneling. The CIDR block must fall within 169.254.0.0/16. The subnet mask of the CIDR block must be 30 bits in length.	169.254.10.0/30	169.254.11.0/30	169.254.12.0/30	169.254.13.0/30
      Local BGP IP address	Enter a BGP IP address for each IPsec-VPN connection. This IP address must fall within the CIDR block for IPsec tunneling.	169.254.10.1	169.254.11.1	169.254.12.1	169.254.13.1
      Local ASN	Enter the ASN of the IPsec-VPN connection.	45104	45104	45104	45104
      Health Check	Specify whether to enable the health check feature. The health check feature is disabled by default.	In this example, the health check feature is disabled.

   After the IPsec-VPN connections are created, the system assigns a private gateway IP address to each IPsec-VPN connection. The gateway IP address is an endpoint on the Alibaba Cloud side of the IPsec-VPN connection. You can view the gateway IP address of an IPsec-VPN connection on the details page, as shown in the following figure.

   The following table describes the gateway IP addresses that are assigned to IPsec-VPN Connection 1, IPsec-VPN Connection 2, IPsec-VPN Connection 3, and IPsec-VPN Connection 4.

   IPsec-VPN connections	Gateway IP address
   IPsec-VPN Connection 1	192.168.168.1
   IPsec-VPN Connection 2	192.168.168.2
   IPsec-VPN Connection 3	192.168.168.3
   IPsec-VPN Connection 4	192.168.168.4

   Note

   • The system assigns gateway IP addresses to IPsec-VPN connections only after you associate the IPsec-VPN connections with transit routers. When you create an IPsec-VPN connection, if you set Associate Resource to Do Not Associate or VPN Gateway, the system does not assign a gateway IP address to the IPsec-VPN connection.

   • After a private IPsec-VPN connection is associated with a transit router, the system automatically advertises the gateway IP address of the IPsec-VPN connection to the route table of the transit router.

4. Download the peer configurations of the IPsec-VPN connections.

   Go to the IPsec-VPN connection page, find the IPsec-VPN connection that you created and click Generate Peer Configuration in the Actions column.

   Download the peer configurations of the four IPsec-VPN connections to your on-premises machine so that you can use the configurations when you add VPN configurations to the on-premises gateway devices.

5. Add VPN configurations and BGP configurations to the on-premises gateway devices.

   After the IPsec-VPN connections are created, perform the following steps to add the VPN and BGP configurations in the peer configurations that you downloaded to the On-premises Gateway Device 1 and On-premises Gateway Device 2. This way, the data center can communicate with Alibaba Cloud over the IPsec-VPN connections.

   The following configurations are used for reference only. The commands may vary based on the network device vendor. Contact the vendor to obtain the information about specific commands.

   1. Open the CLI of the on-premises gateway device.

   2. Run the following command to configure the isakmp policy:

      //Add the following configuration to the two on-premises gateway devices:
      crypto isakmp policy 1 
      authentication pre-share      //Configure the authentication method. In this example, pre-shared keys are used for authentication. 
      encryption aes                //Configure the encryption algorithm. In this example, aes is used. 
      hash sha                      //Configure the authentication algorithm. In this example, sha is used. 
      group  2                      //Configure the DH group. In this example, group2 is used. 
      lifetime 86400
                                      

   3. Run the following command to configure pre-shared keys:

      //Add the following configuration to On-premises Gateway Device 1:
      crypto keyring keyring1 
          pre-shared-key address 192.168.168.1 key fddsFF123****
      crypto keyring keyring2 
          pre-shared-key address 192.168.168.2 key fddsFF456****
      
      //Add the following configuration to On-premises Gateway Device 2:
      crypto keyring keyring1 
          pre-shared-key address 192.168.168.3  key fddsFF789****
      crypto keyring keyring2 
          pre-shared-key address 192.168.168.4  key fddsFF901****

   4. Run the following command to configure the ikev1 profile:

      //Add the following configuration to On-premises Gateway Device 1:
      crypto isakmp profile profile1 
          keyring keyring1 
          match identity address 192.168.168.1 255.255.255.255 
      crypto isakmp profile profile2 
          keyring keyring2 
          match identity address 192.168.168.2 255.255.255.255
      //Add the following configuration to On-premises Gateway Device 2:
      crypto isakmp profile profile1 
          keyring keyring1 
          match identity address 192.168.168.3 255.255.255.255  
      crypto isakmp profile profile2 
          keyring keyring2 
          match identity address 192.168.168.4 255.255.255.255

   5. Run the following command to configure the IPsec protocol:

      //Add the following configuration to the two on-premises gateway devices:
      crypto ipsec transform-set ipsecpro64 esp-aes esp-sha-hmac 
      mode tunnel

   6. Run the following command to configure the IPsec profile:

      //Add the following configuration to the two on-premises gateway devices:
      crypto ipsec profile IPSEC_PROFILE1
          set transform-set ipsecpro64
          set isakmp-profile profile1
      crypto ipsec profile IPSEC_PROFILE2
          set transform-set ipsecpro64
          set isakmp-profile profile2
                                      

   7. Run the following commands to configure IPsec tunneling:

      //Add the following configuration to On-premises Gateway Device 1:
      interface Tunnel100
      ip address 169.254.10.2 255.255.255.252    //Specify the tunnel IP address of IPsec-VPN Connection 1 on On-premises Gateway Device 1. In this example, 169.254.10.2 is used. 
      tunnel source GigabitEthernet1
      tunnel mode ipsec ipv4
      tunnel destination 192.168.168.1            //Specify the private IP address of IPsec-VPN Connection 1 on the Alibaba Cloud side. In this example, 192.168.168.1 is used. 
      tunnel protection ipsec profile IPSEC_PROFILE1
      no shutdown
      exit
      !
      interface GigabitEthernet1                 //Configure the IP address of the interface that is used to establish IPsec-VPN Connection 1. 
      ip address 192.168.0.1 255.255.255.0
      negotiation auto
      !
      interface Tunnel101
      ip address 169.254.11.2 255.255.255.252    //Specify the tunnel IP address of IPsec-VPN Connection 2 on On-premises Gateway Device 1. In this example, 169.254.11.2 is used. 
      tunnel source GigabitEthernet2
      tunnel mode ipsec ipv4
      tunnel destination 192.168.168.2            //Specify the private IP address of IPsec-VPN Connection 2 on the Alibaba Cloud side. In this example, 192.168.168.2 is used. 
      tunnel protection ipsec profile IPSEC_PROFILE2
      no shutdown
      exit
      !
      interface GigabitEthernet2                 //Configure the IP address of the interface that is used to establish IPsec-VPN Connection 2. 
      ip address 192.168.1.1 255.255.255.0
      negotiation auto
      !
      //Add the following configuration to On-premises Gateway Device 2:
      interface Tunnel100
      ip address 169.254.12.2 255.255.255.252    //Specify the tunnel IP address of IPsec-VPN Connection 3 on On-premises Gateway Device 2. In this example, 169.254.12.2 is used. 
      tunnel source GigabitEthernet1
      tunnel mode ipsec ipv4
      tunnel destination 192.168.168.3            //Specify the private IP address of IPsec-VPN Connection 3 on the Alibaba Cloud side. In this example, 192.168.168.3 is used. 
      tunnel protection ipsec profile IPSEC_PROFILE1
      no shutdown
      exit
      !
      interface GigabitEthernet1                 //Configure the IP address of the interface that is used to establish IPsec-VPN Connection 3. 
      ip address 192.168.1.2 255.255.255.0
      negotiation auto
      !
      
      interface Tunnel101
      ip address 169.254.13.2 255.255.255.252    //Specify the tunnel IP address of IPsec-VPN Connection 4 on On-premises Gateway Device 2. In this example, 169.254.13.2 is used. 
      tunnel source GigabitEthernet2
      tunnel mode ipsec ipv4
      tunnel destination 192.168.168.4            //Specify the private IP address of IPsec-VPN Connection 4 on the Alibaba Cloud side. In this example, 192.168.168.4 is used. 
      tunnel protection ipsec profile IPSEC_PROFILE2
      no shutdown
      exit
      !
      interface GigabitEthernet2                 //Configure the IP address of the interface that is used to establish IPsec-VPN Connection 4. 
      ip address 192.168.2.2 255.255.255.0
      negotiation auto
      !

   8. Run the following commands to configure BGP:

      //Add the following configuration to On-premises Gateway Device 1:
      router bgp 65530                         
      neighbor 169.254.10.1 remote-as 45104    //Configure the ASN of the BGP peer. In this example, the BGP ASN of IPsec-VPN Connection 1 is used, which is 45104. 
      neighbor 169.254.10.1 ebgp-multihop 10   //Set the eBGP hop-count to 10.   
      neighbor 169.254.11.1 remote-as 45104    //Configure the ASN of the BGP peer. In this example, the BGP ASN of IPsec-VPN Connection 2 is used, which is 45104. 
      neighbor 169.254.11.1 ebgp-multihop 10   //Set the eBGP hop-count to 10. 
      !
      address-family ipv4 
      neighbor 169.254.10.1 activate           //Activate the BGP peers. 
      neighbor 169.254.11.1 activate 
      exit-address-family
      !
      //Add the following configuration to On-premises Gateway Device 2:
      router bgp 65530                         
      neighbor 169.254.12.1 remote-as 45104    //Configure the ASN of the BGP peer. In this example, the BGP ASN of IPsec-VPN Connection 3 is used, which is 45104. 
      neighbor 169.254.12.1 ebgp-multihop 10   //Set the eBGP hop-count to 10.  
      neighbor 169.254.13.1 remote-as 45104    //Configure the ASN of the BGP peer. In this example, the BGP ASN of IPsec-VPN Connection 4 is used, which is 45104. 
      neighbor 169.254.13.1 ebgp-multihop 10   //Set the eBGP hop-count to 10.  
      !
      address-family ipv4 
      neighbor 169.254.12.1 activate           //Activate the BGP peers. 
      neighbor 169.254.13.1 activate
      exit-address-family
      !
                                      

Step 4: Configure routes and routing policies

After you complete the preceding configurations, you must add routes and routing policies on Alibaba Cloud so that the IPsec-VPN connections can work as expected. You must also route traffic between the data center and Alibaba Cloud to encrypted tunnels.

1. Add custom routes to the VBRs.

   Route traffic destined for the data center to the Express Connect circuits.

   1. Log on to the Express Connect console.

   2. In the left-side navigation pane, click Virtual Border Routers (VBRs).

   3. In the top navigation bar, select the region where the VBRs are deployed.

      In this example, China (Shanghai) is selected.

   4. On the Virtual Border Routers (VBRs) page, click the ID of the VBR that you want to manage.

   5. Click the Routes tab and click Add Route.

   6. In the Add Route panel, set the following parameters and click OK.

      Add Route 1 and Route 2 to VBR1. Add Route 3 and Route 4 to VBR2.

      Parameter	Description	Route 1	Route 2	Route 3	Route 4
      Next Hop Type	Select Physical Connection Interface.
      Destination CIDR Block	Enter the VPN IP address of the on-premises gateway device.	VPN IP address 1 of On-premises Gateway Device 1: 192.168.0.1/32.	VPN IP address 2 of On-premises Gateway Device 1: 192.168.1.1/32.	VPN IP address 1 of On-premises Gateway Device 2: 192.168.1.2/32.	VPN IP address 1 of On-premises Gateway Device 2: 192.168.2.2/32.
      Next Hop	Select an Express Connect circuit.	Select Express Connect Circuit 1.	Select Express Connect Circuit 1.	Select Express Connect Circuit 2.	Select Express Connect Circuit 2.

2. Add routing policies to the CEN instance.

   1. Log on to the CEN console.

   2. On the Instances page, click the ID of the CEN instance.

   3. Choose Basic Settings > Transit Router, find the transit router in the China (Shanghai), and then click the ID of the transit router.

   4. On the details page of the transit router, click the Route Table tab and click Route Maps.

   5. On the Route Maps tab, click Add Route Map. On the Add Route Map page, set the following parameters and click OK.

      Add four routing policies to CEN based on the information in the following table. The following section describes the four routing policies:

      • Routing Policy 1: The data center learns CIDR blocks from the VPC through the VBRs and the IPsec-VPN connections. To ensure that traffic destined for the VPC is routed to the IPsec-VPN connections, you must create Routing Policy 1 so that the priority of the CIDR blocks advertised by the VBRs is lower than the priority of the CIDR blocks advertised by the IPsec-VPN connections.

      • Routing Policy 2: When the CEN instance learns the same CIDR block through the VBRs and the IPsec-VPN connections, the CIDR block advertised by the VBRs has a higher priority. You must create Routing Policy 2 to reject data center routes advertised by the VBRs. This ensures that traffic destined for the data center is routed to the IPsec-VPN connections.

      • Routing Policy 3 and Routing Policy 4: After you create a VBR connection, CEN adds a routing policy that applies in the outbound direction to the route table of the transit router. The priority of the routing policy is 5000, and the policy action is Deny. The routing policy prevents VBRs, Cloud Connect Network (CCN) instances, and IPsec-VPN connections that are connected to the same transit router from communicating with each other.

        You must add Routing Policy 3 and Routing Policy 4 to allow CEN to advertise the gateway IP addresses of the IPsec-VPN connections.

      The following table describes only the key parameters. For more information about the other parameters, see Routing policy overview.

      Parameter	Description	Routing Policy 1	Routing Policy 2	Routing Policy 3	Routing Policy 4
      Routing Policy Priority	Enter a priority value for the routing policy.	In this example, 5 is used.	In this example, 10 is used.	In this example, 15 is used.	In this example, 20 is used.
      Region	Select the region in which the routing policy applies.	In this example, China (Shanghai) is selected.
      Associated Route Table	Select a route table to associate with the routing policy.	In this example, the default route table of the current transit router is selected.
      Direction	Select the direction in which the routing policy applies.	In this example, Egress Regional Gateway is selected.	In this example, Ingress Regional Gateway is selected.	In this example, Egress Regional Gateway is selected.	In this example, Egress Regional Gateway is selected.
      Match Conditions	Configure match conditions for the routing policy.	Configure the following match conditions: Source Instance IDs: Enter the ID of the VPC. Destination Instance IDs: Enter the IDs of VBR1 and VBR2. Route Prefix: Enter 172.16.10.0/24 and 172.16.20.0/24, and select Exact Match.	Configure the following match conditions: Source Instance IDs: Enter the IDs of VBR1 and VBR2. Route Prefix: Enter 192.168.0.0/24, 192.168.10.0/24, and 192.168.20.0/24, and select Exact Match.	Configure the following match conditions: Destination Instance IDs: Enter the ID of VBR1. Route Prefix: Enter 192.168.168.1/32 and 192.168.168.2/32, and select Exact Match.	Configure the following match conditions: Destination Instance IDs: Enter the ID of VBR2. Route Prefix: Enter 192.168.168.3/32 and 192.168.168.4/32, and select Exact Match.
      Routing Policy Action	Select an action for the routing policy.	In this example, Allow is selected.	In this example, Deny is selected.	In this example, Allow is selected.	In this example, Allow is selected.
      Add Policy Entry	Specify a priority for the routes that are permitted.	In this example, Prepend AS Path is selected and 65525, 65526, and 65527 are entered. This reduces the priority of the VPC CIDR block that the VBRs advertise to the data center.	N/A	N/A	N/A

Step 5: Test the network connectivity

After you configure the routes, the data center can communicate with the VPC through private and encrypted connections. The traffic between the data center and VPC is load-balanced based on ECMP routing by using the four IPsec-VPN connections. This section describes how to test the network connectivity and how to check whether the four IPsec-VPN connections are used to load-balance the traffic.

1. Test the network connectivity.

   1. Log on to the ECS instance in the VPC. For more information, see Guidelines on ECS instance connection.

   2. Run the ping command on the ECS instance to access a client in the data center.

      ping <IP address of the client in the data center>

      If the ECS instance receives echo reply messages, the data center can communicate with the VPC.

2. Check whether traffic is load-balanced.

   Send requests to the ECS instance from multiple clients in the data center or use iPerf3 to send requests to the ECS instance. If you can view traffic monitoring data on the details pages of IPsec-VPN Connection 1, IPsec-VPN Connection 2, IPsec-VPN Connection 3, and IPsec-VPN Connection 4, traffic between the data center and the VPC is load-balanced through the four IPsec-VPN connections. For more information about how to install and use iPerf3, see Test the performance of an Express Connect circuit.

   1. Log on to the VPN Gateway console.

   2. In the top navigation bar, select the region in which the IPsec-VPN connection is created.

   3. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

   4. On the IPsec Connections page, click the ID of the IPsec-VPN connection that you want to manage.

      Go to the details page of the IPsec-VPN connection to view the monitoring data of data transfer on the Monitor tab.

Routing configuration

In this topic, the default routing configuration is used to create the IPsec-VPN connections, VPC connection, VBR connections, and inter-region connection. When the default routing configuration is used, CEN automatically learns and distributes routes to enable the data center to communicate with the VPC. The following sections describe the default routing configuration.

IPsec-VPN connection

If you associate an IPsec-VPN connection with a transit router when you create the IPsec-VPN connection, the system automatically applies the following routing configuration to the IPsec-VPN connection:

• The IPsec-VPN connection is associated with the default route table of the transit router. The transit router forwards traffic from the IPsec-VPN connection based on the default route table.

• The destination-based routes that you configure for the IPsec-VPN connection and the routes learned from the data center through the IPsec-VPN connection by using BGP dynamic routing are automatically propagated to the default route table of the transit router.

• The transit router automatically propagates the routes in the default route table to the BGP route table associated with the IPsec-VPN connection.

• The routes learned from the VPC through the IPsec-VPN connection by using BGP dynamic routing are automatically propagated to the data center.

VPC connection

If you use the default routing configuration (with all advanced features enabled) when you create a VPC connection, the system automatically applies the following routing configuration to the VPC:

• Associate with Default Route Table of Transit Router

  After this feature is enabled, the VPC connection is automatically associated with the default route table of the transit router. The transit router forwards the traffic of the VPC based on the default route table.

• Propagate System Routes to Default Route Table of Transit Router

  After this feature is enabled, the system routes of the VPC are advertised to the default route table of the transit router. This way, the VPC can communicate with other network instances that are connected to the transit router.

• Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC

  After this feature is enabled, the system automatically adds the following three routes to all route tables of the VPC: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The routes point to the VPC connection.

VBR connection

If you use the default routing configuration (with all advanced features enabled) when you create a VBR connection, the system automatically applies the following routing configuration to the VBR:

• Associate with Default Route Table of Transit Router

  After this feature is enabled, the VBR connection is automatically associated with the default route table of the transit router. The transit router forwards the traffic of the VBR based on the default route table.

• Propagate System Routes to Default Route Table of Transit Router

  After this feature is enabled, the system routes of the VBR are automatically advertised to the default route table of the transit router.

• Propagate Routes to VBR

  After this feature is enabled, the system automatically advertises the routes in the route table that is associated with the VBR connection to the VBR.

Inter-region connection

If you use the default routing configuration (with all advanced features enabled) when you create an inter-region connection, the system automatically applies the following routing configuration to the inter-region connection:

• Associate with Default Route Table of Transit Router

  After this feature is enabled, the inter-region connection is automatically associated with the default route table of the transit router. The transit router uses the default route table to forward network traffic across regions.

• Propagate System Routes to Default Route Table of Transit Router

  After this feature is enabled, the inter-region connection advertises system routes to the default route table of the transit router.

• Automatically Advertise Routes to Peer Region

  After this feature is enabled, the routes of the transit router deployed in the current region are automatically advertised to the route table of the peer transit router. The routes are used for cross-region communication between network instances.

View routes