All Products
Search

This Product

    VPN Gateway:Create and manage IPsec-VPN servers

    Document Center

    VPN Gateway:Create and manage IPsec-VPN servers

    Última atualização: May 27, 2026

    To use the native VPN client on an iOS device to connect to Alibaba Cloud through IPsec-VPN, create an IPsec-VPN server that controls which networks and resources the device can access.

    Prerequisites

    Create an IPsec-VPN server

    1. Log on to the VPN Gateway console.

    2. In the left navigation pane, choose Interconnections > VPN > IPsec-VPN Server.

    3. In the top navigation bar, select the region where you want to deploy the IPsec-VPN server.

      Click to view the regions that support IPsec-VPN servers

      China (Hangzhou), China (Shanghai), China (Nanjing - Local Region), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), Japan (Tokyo), South Korea (Seoul), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), Germany (Frankfurt), UK (London), US (Virginia), US (Silicon Valley), UAE (Dubai), Mexico, SAU (Riyadh - Partner Region)

    4. On the IPsec-VPN Server page, click Create IPsec-VPN Server.

    5. On the Create IPsec-VPN Server page, set the following parameters and click OK.

      Parameter

      Description

      Name

      Enter a name for the IPsec-VPN server.

      Resource Group

      Select the resource group of the VPN gateway instance.

      The IPsec-VPN server must belong to the same resource group as the associated VPN gateway.

      VPN Gateway

      Select the VPN gateway instance to associate with the IPsec-VPN server.

      Note

      The associated VPN gateway cannot be changed after the IPsec-VPN server is created.

      Local Network

      Enter the CIDR blocks that clients can access through the IPsec-VPN server.

      The local network can be the CIDR block of a VPC, a vSwitch, or an on-premises data center connected to the VPC through an Express Connect circuit.

      Click Add Local CIDR Block to add multiple CIDR blocks.

      Client CIDR Block

      The CIDR block from which IP addresses are assigned to the client virtual network interface. This is not the client's existing private CIDR block. When a client connects to the local network through the IPsec-VPN server, the VPN gateway assigns an IP address from this block to the client.

      The following CIDR blocks are not supported:

      • 100.64.0.0 to 100.127.255.255

      • 127.0.0.0 to 127.255.255.255

      • 169.254.0.0 to 169.254.255.255

      • 224.0.0.0 to 239.255.255.255

      • 255.0.0.0 to 255.255.255.255

      Important

      • Make sure that the client CIDR block does not overlap with the local network or any CIDR blocks in the VPC.

      • The client CIDR block must contain at least four times the maximum concurrent connections supported by the VPN gateway.

        For example, with a client CIDR block of 192.168.0.0/24, the system allocates a /30 subnet (such as 192.168.0.4/30) per connection — one IP for the client and three reserved for the system. Each connection consumes four IP addresses.

      Pre-Shared Key

      Enter the pre-shared key for authentication between the server and client. The key must be 1 to 100 characters in length.

      If you do not specify a pre-shared key, the system generates a random 16-character string. After creation, view the generated key by clicking Edit. Modify an IPsec-VPN server.

      Important

      The client's pre-shared key must match the IPsec-VPN server's key. Mismatched keys prevent connection.

      Effective Immediately

      Whether to start negotiation immediately.

      • Yes: Negotiation starts immediately after the configuration is complete.

      • No: Negotiation starts when inbound traffic is detected.

      Advanced Configuration: IKE Configurations

      Version

      The IKE protocol version.

      • ikev1

      • ikev2

      Both IKEv1 and IKEv2 are supported. IKEv2 simplifies negotiation and better supports multi-network scenarios. IKEv2 is recommended.

      Local ID

      The server identifier. Defaults to the VPN gateway's public IP address. In single-tunnel mode, the public IP address is used.

      Supports FQDN and IP address formats. The Local ID must match the Remote ID of the peer IPsec client.

      IP address format is recommended.

      Remote ID

      The client identifier. Supports FQDN and IP address formats. Must match the Local ID of the peer IPsec client. IP address format is recommended.

    Modify an IPsec-VPN server

    1. Log on to the VPN Gateway console.

    2. In the left navigation pane, choose Interconnections > VPN > IPsec-VPN Server.

    3. In the top navigation bar, select the region of the IPsec server.

    4. On the IPsec-VPN Server page, find the IPsec-VPN server that you want to modify, and then click Edit in the Actions column.

    5. On the Edit IPsec-VPN Server page, modify the parameters and click OK.

      Parameter descriptions are in Create an IPsec-VPN server.

    Delete an IPsec-VPN server

    Deleting an IPsec-VPN server immediately terminates all active client connections.

    1. Log on to the VPN Gateway console.

    2. In the left navigation pane, choose Interconnections > VPN > IPsec-VPN Server.

    3. In the top navigation bar, select the region of the IPsec server.

    4. On the IPsec-VPN Server page, find the IPsec-VPN server that you want to delete, and then click Delete in the Actions column.

    5. In the Delete IPsec-VPN Server dialog box, confirm the information and click OK.

    Manage IPsec-VPN servers by API

    You can use tools such as Alibaba Cloud SDKs (recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS) to manage IPsec-VPN servers through API operations: