VPN Gateway:Use IPsec-VPN to connect Alibaba Cloud VPCs to Amazon VPCs

Examples

The following figure shows an example. An enterprise creates a VPC in the Germany (Frankfurt) region of Alibaba Cloud and also a VPC in the Europe (Frankfurt) region of Amazon Web Services (AWS). The enterprise wants the Alibaba Cloud VPC and the Amazon VPC to communicate with each other.

The enterprise can use a public VPN gateway of Alibaba Cloud and AWS VPN to establish IPsec-VPN connections to enable encrypted communication between the two VPCs.

Procedure

Step 3: Deploy the VPN gateway on Alibaba Cloud

After you configure VPN resources on AWS, deploy a VPN gateway on Alibaba Cloud based on the following information to establish an IPsec-VPN connection between the Amazon VPC and the Alibaba Cloud VPC.

1. Create customer gateways.

   1. Log on to the VPN Gateway console.

   2. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

   3. In the top navigation bar, select the region in which you want to create the customer gateway.

      Make sure that the customer gateway and the VPN gateway to be connected are deployed in the same region.

   4. On the Customer Gateways page, click Create Customer Gateway.

   5. In the Create Customer Gateway panel, configure the following parameters and click OK.

      You must create two customer gateways and use the external IP addresses of the tunnels of the AWS Site-to-Site VPN connections as the customer gateway IP addresses. The following table describes only the parameters that are relevant to this topic. You can use the default values of other parameters or leave them empty. For more information, see Create and manage a customer gateway.

      Important

      Use only the external IP address of Tunnel 1 of each Site-to-Site VPN connection as the customer gateway IP address. By default, the external IP address of Tunnel 2 of each Site-to-Site VPN connection is not used. After the IPsec-VPN connections are created, Tunnel 2 of each Site-to-Site VPN connection is unavailable.

      Parameter	Description	Customer gateway 1	Customer gateway 2
      Name	The name of the customer gateway.	Enter Customer Gateway 1.	Enter Customer Gateway 2.
      IP Address	Enter the external IP address of the AWS tunnel.	Enter 3.XX.XX.52.	Enter 3.XX.XX.56.
      ASN	The BGP ASN of the AWS virtual private gateway. Note If you use the BGP dynamic routing mode, you must configure this parameter.	Enter 64512.	Enter 64512.

2. Create an IPsec-VPN connection.

   1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

   2. In the top navigation bar, select the region in which you want to create the IPsec-VPN connection.

      Make sure that the IPsec-VPN connection and the VPN gateway are in the same region.

   3. On the IPsec Connections page, click Create IPsec-VPN Connection.

   4. On the Create IPsec-VPN Connection page, configure the IPsec-VPN connection based on the following information and click OK.

      Parameter	Description	Example
      Name	The name of the IPsec-VPN connection.	Enter IPsec Connection.
      Associate Resource	Select the type of network resource to be associated with the IPsec-VPN connection.	In this example, VPN Gateway is selected.
      VPN Gateway	The VPN gateway that you want to associate with the IPsec-VPN connection.	Select VPN Gateway.
      Routing Mode	Select a routing mode. Destination Routing Mode: Traffic is forwarded based on the destination IP address. Protected Data Flows: Traffic is forwarded based on the source and destination IP addresses.	If you use the static routing mode, we recommend that you select Protected Data Flows. Local Network: Enter 10.0.0.0/16. Remote Network: Enter 192.168.0.0/16. If you use the BGP dynamic routing mode, we recommend that you select Destination Routing Mode.
      Effective Immediately	Specify whether to immediately start negotiations for the connection. Valid value: Yes: starts negotiations after the configuration is complete. No: starts negotiations when inbound traffic is detected.	In this example, Yes is selected.
      Enable BGP	Specify whether to enable Border Gateway Protocol (BGP). If you want to use BGP routing for the IPsec-VPN connection, turn on Enable BGP. By default, Enable BGP is turned off.	In this example, turn off Enable BGP to use the static routing mode by default. If you want to use BGP dynamic routing after the IPsec-VPN connection is created, you can separately add BGP configurations.
      Tunnel 1	Configure VPN parameters for the active tunnel. By default, Tunnel 1 serves as the active tunnel and Tunnel 2 serves as the standby tunnel. You cannot modify this configuration.
      Customer Gateway	The customer gateway that you want to associate with the active tunnel.	Select Customer Gateway 1.
      Pre-Shared Key	The pre-shared key of the active tunnel that is used to verify identities. The pre-shared key must be 1 to 100 characters in length, and can contain digits, letters, and the following characters: ~ ` ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | ; : ' , . < > / ? If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. Important The tunnel and the peer gateway device must use the same pre-shared key. Otherwise, the system cannot establish an IPsec-VPN connection.	The pre-shared key of the current tunnel must be the same as the key of the AWS tunnel to be connected.
      Encryption Configuration	Configure the parameters for the IKE, IPsec, dead peer detection (DPD), and NAT traversal features.	The value of SA Life Cycle (seconds) in IKE Configurations must be the same as the value specified on AWS. In this example, the value is set to 28800. The value of SA Life Cycle (seconds) in IPsec Configurations must be the same as the value specified on AWS. In this example, the value is set to 3600. Use the default values for the other parameters. For more information, see Create and manage IPsec-VPN connections in dual-tunnel mode.
      Tunnel 2	Configure VPN parameters for the standby tunnel.
      Customer Gateway	The customer gateway that you want to associate with the standby tunnel.	Select Customer Gateway 2.
      Pre-Shared Key	The pre-shared key of the standby tunnel that is used to verify identities.	The pre-shared key of the current tunnel must be the same as the key of the AWS tunnel to be connected.
      Encryption Configuration	Configure the parameters for the IKE, IPsec, dead peer detection (DPD), and NAT traversal features.	The value of SA Life Cycle (seconds) in IKE Configurations must be the same as the value specified on AWS. In this example, the value is set to 28800. The value of SA Life Cycle (seconds) in IPsec Configurations must be the same as the value specified on AWS. In this example, the value is set to 3600. Use the default values for the other parameters. For more information, see Create and manage IPsec-VPN connections in dual-tunnel mode.

   5. In the Created message, click OK.

3. Advertise the route of the VPN gateway.

   Use static routing

   After you create the IPsec-VPN connection, you must advertise the route of the VPN gateway. If you select Protected Data Flows as Routing Mode, the system creates a policy-based route for the VPN gateway after the IPsec-VPN connection is created. The route is in the Unpublished state. You must advertise the policy-based route of the VPN gateway to the VPC.

   1. In the left-side navigation pane, choose Interconnections > VPN > VPN Gateways.

   2. In the top navigation bar, select the region in which the VPN gateway resides.

   3. On the VPN Gateways page, find the VPN gateway that you want to manage and click its ID.

   4. On the details page of the VPN gateway, click the Policy-based Route Table tab, find the route that you want to manage, and then click Advertise in the Actions column.

   5. In the Advertise Route message, click OK.

   Use BGP dynamic routing

   1. Configure BGP dynamic routing for the IPsec-VPN connection.

      1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

      2. On the IPsec Connections page, find the IPsec-VPN connection and click its ID.

      3. In the IPsec Connections section, click Edit next to Enable BGP. In the BGP Configuration dialog box, configure the following parameters and click OK.

         Parameter	Description	IPsec-VPN connection configuration
         Local ASN	The ASN of the IPsec-VPN connection.	Enter 65530.
         Tunnel 1	The BGP configuration added for the active tunnel.	Add the BGP configuration for the active tunnel of the IPsec-VPN connection.
         Tunnel CIDR Block	The CIDR block that is used for IPsec tunneling.	Enter 169.254.116.208/30.
         Local BGP IP address	The BGP IP address for the IPsec-VPN connection. This IP address must fall within the CIDR block for IPsec tunneling.	Enter 169.254.116.210.
         Tunnel 2	The BGP configuration added for the standby tunnel.	Add the BGP configuration for the standby tunnel of the IPsec-VPN connection.
         Tunnel CIDR Block	The CIDR block that is used for IPsec tunneling.	Enter 169.254.214.96/30.
         Local BGP IP address	The BGP IP address for the IPsec-VPN connection. This IP address must fall within the CIDR block for IPsec tunneling.	Enter 169.254.214.98.

   2. To enable automatic BGP route propagation for the VPN gateway, perform the following steps:

      1. In the left-side navigation pane, choose Interconnections > VPN > VPN Gateways.

      2. On the VPN Gateways page, find the VPN gateway, move the pointer over the icon, and then click Enable Automatic BGP Propagation in the Actions column.

      3. In the Enable Automatic BGP Propagation message, click OK.