Create an IPsec-VPN connection that is associated with a transit router - VPN Gateway

You can create IPsec-VPN connections to establish encrypted connections between data centers and transit routers. This topic describes how to create and manage such IPsec-VPN connections.

Prerequisites

Before you create an IPsec-VPN connection, understand the procedure and make sure that the prerequisites are met. For more information, see the "Procedure" section of the Overview topic.

Create an IPsec-VPN connection

Log on to the VPN gateway console.
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
In the top navigation bar, select the region in which you want to create an IPsec-VPN connection.
The IPsec-VPN connection must be created in the same region as the transit router to be associated with the IPsec-VPN connection.
On the IPsec Connections page, click Create IPsec-VPN Connection.

On the Create IPsec-VPN Connection page, configure the parameters that are described in the following table and click OK.

Basic configurations

Note

When you create a VPN gateway or an IPsec-VPN connection associated with a transit router for the first time, the system automatically creates the service-linked role AliyunServiceRoleForVpn. The service-linked role allows a VPN gateway to access other cloud resources such as elastic network interfaces (ENIs) and security groups. This helps you create a VPN gateway or an IPsec-VPN connection. If the AliyunServiceRoleForVpn role already exists, the system does not create the role again. For more information about this service-linked role, see AliyunServiceRoleForVpn.

Parameter	Description
Name	The name of the IPsec-VPN connection.
Resource Group	The resource group of the Cloud Enterprise Network (CEN) instance. If you leave this parameter empty, the system displays the CEN instances in all resource groups.
Associate Resource	The type of network resource to be associated with the IPsec-VPN connection. Select Do Not Associate or CEN. If you select CEN, the system automatically associates the IPsec-VPN connection with the specified transit router of the current Alibaba Cloud account. If you select Do Not Associate, the IPsec-VPN connection is not associated with any resources. After the IPsec-VPN connection is created, you can manually associate the IPsec-VPN connection with a transit router of the current Alibaba Cloud account or a different Alibaba Cloud account in the CEN console. For more information, see Attach an IPsec-VPN connection to a transit router. Note If you want to associate another transit router with the IPsec-VPN connection, you must delete the VPN connection from the original transit router and create a VPN connection for the new transit router. For more information, see Delete a network instance connection and Attach an IPsec-VPN connection to a transit router.
Gateway Type	The type of gateway used by the IPsec-VPN connection. Default value: Public. Valid values: Public: creates the IPsec-VPN connection over the Internet. Private: creates the IPsec-VPN connection over a private network.
CEN Instance ID	The ID of the CEN instance to which the transit router belongs.
Transit Router	The ID of the transit router that belongs to the CEN instance in the region.
Zone	The zone in which the system creates resources.
Routing Mode	The routing mode of the IPsec-VPN connection. Default value: Destination Routing Mode. Valid values: Destination Routing Mode: routes and forwards traffic based on the destination IP address. Protected Data Flows: routes and forwards traffic based on the source and destination IP addresses. If you select Protected Data Flows, you must configure the Local Network and Remote Network parameters. After the IPsec-VPN connection is configured, the system automatically adds destination-based routes to the route table of the IPsec-VPN connection. By default, the routes are advertised to the route table of the transit router that is associated with the IPsec-VPN connection.
Local Network	The CIDR block on the Alibaba Cloud side. This CIDR block is used in Phase 2 negotiations. Click the icon next to the field to add more CIDR blocks. Note If you specify multiple CIDR blocks, you must set the Internet Key Exchange (IKE) version to ikev2.
Remote Network	The CIDR block of the data center to be connected. This CIDR block is used in Phase 2 negotiations. Click the icon next to the field to add more CIDR blocks. Note If you specify multiple CIDR blocks, you must set the IKE version to ikev2.
Effective Immediately	Specifies whether to immediately start IPsec-VPN negotiations. Default value: Yes. Valid values: Yes: immediately starts IPsec-VPN negotiations after the IPsec-VPN connection is created. No: starts IPsec-VPN negotiations when inbound traffic is detected.
Customer Gateway	The customer gateway to be associated with the IPsec-VPN connection.
Pre-Shared Key	The pre-shared key that is used for authentication between the transit router and the data center. The key must be 1 to 100 characters in length, and can contain digits, letters, and the following special characters: ~ ` ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ \| ; : ' , . < > / ?. The key cannot contain spaces. If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. After an IPsec-VPN connection is created, you can click Edit in the Actions column of the IPsec-VPN connection to view the pre-shared key that is generated for the IPsec-VPN connection. For more information, see the Modify an IPsec-VPN connection section of this topic. Important The pre-shared keys must be the same on both sides. Otherwise, the system cannot establish an IPsec-VPN connection.
Enable BGP	Specifies whether to enable the Border Gateway Protocol (BGP) dynamic routing feature for the IPsec-VPN connection. By default, Enable BGP is turned off. Before you use the BGP dynamic routing feature, we recommend that you understand how it works and its limits. For more information, see the "Configure BGP dynamic routing" section of the Configure routes for an IPsec-VPN connection topic.
Local ASN	The autonomous system number (ASN) of the IPsec-VPN connection on the Alibaba Cloud side. Default value: 45104. Valid values: 1 to 4294967295. You can enter the ASN in two segments and separate the first 16 bits from the following 16 bits with a period (.). Enter the number in each segment in decimal format. For example, if you enter 123.456, the ASN is 123 × 65536 + 456 = 8061384. Note We recommend that you use a private ASN to establish a connection to Alibaba Cloud over BGP. For more information about the valid values of a private ASN, see the relevant documentation.

Encryption configurations

Parameter	Description
Encryption Configuration: IKE Configurations
Version	The IKE version. Default value: ikev2. Valid values: ikev1 ikev2 Compared with IKEv1, IKEv2 simplifies security association (SA) negotiations and provides better support for scenarios in which communication is established among multiple CIDR blocks. We recommend that you use IKEv2.
Negotiation Mode	The negotiation mode. Default value: main. Valid values: main: This mode offers higher security during negotiations. aggressive: This mode supports faster negotiations and supports a higher success rate. Connections negotiated in both modes ensure the same level of security for data transmission.
Encryption Algorithm	The encryption algorithm that is used in Phase 1 negotiations. Valid values: aes, aes192, aes256, des, and 3des. By default, a value of aes specifies AES-128. Note If the bandwidth of the VPN gateway is 200 Mbit/s or higher, we recommend that you select aes, aes192, or aes256. 3des is not recommended. Advanced Encryption Standard (AES) is a symmetric-key encryption algorithm that provides high-level encryption and decryption. AES ensures secure data transmission and has little impact on network latency, throughput, and forwarding performance. Triple Data Encryption Standard (3DES) offers enhanced security by using its triple-layered encryption technique. Compared with AES encryption, 3DES encryption requires a large amount of computation, takes an extended period of time, and downgrades forwarding performance.
Authentication Algorithm	The authentication algorithm that is used in Phase 1 negotiations. Valid values: sha1, md5, sha256, sha384, and sha512. Default value: sha1.
DH Group	The Diffie-Hellman (DH) key exchange algorithm that is used in Phase 1 negotiations. Default value: group2. Valid values: group1: DH group 1. group2: DH group 2. group5: DH group 5. group14: DH group 14.
SA Life Cycle (seconds)	The lifetime of the SA after Phase 1 negotiations succeed. Unit: seconds. Default value: 86400. Valid values: 0 to 86400.
LocalId	The ID of the IPsec-VPN connection on the Alibaba Cloud side. The ID is used in Phase 1 negotiations. By default, this value is the gateway IP address of the IPsec-VPN connection. This parameter is used only to identify Alibaba Cloud in IPsec-VPN negotiations. You can use an IP address or a fully qualified domain name (FQDN) as the ID. The value cannot contain spaces. We recommend that you use a private IP address as the ID of the IPsec-VPN connection on the Alibaba Cloud side. If you set the LocalId parameter to an FQDN, such as example.aliyun.com, the peer ID of the IPsec-VPN connection on the data center side must be the same as the value of the LocalId parameter. In this case, we recommend that you set the negotiation mode to aggressive.
RemoteId	The ID of the IPsec-VPN connection on the data center side. The ID is used in Phase 1 negotiations. By default, this value is the IP address of the customer gateway. This parameter is used only to identify the data center in IPsec-VPN negotiations. You can use an IP address or an FQDN as the ID. The value cannot contain spaces. We recommend that you use a private IP address as the identifier of the IPsec-VPN connection in the data center. If you set the RemoteId parameter to an FQDN, such as example.aliyun.com, the local ID of the IPsec-VPN connection on the data center side must be the same as the value of the RemoteId parameter. In this case, we recommend that you set the negotiation mode to aggressive.
Encryption Configuration: IPsec Configurations
Encryption Algorithm	The encryption algorithm that is used in Phase 2 negotiations. Valid values: aes, aes192, aes256, des, and 3des. By default, a value of aes specifies AES-128. Note If the bandwidth of the VPN gateway is 200 Mbit/s or higher, we recommend that you select aes, aes192, or aes256. 3des is not recommended. Advanced Encryption Standard (AES) is a symmetric-key encryption algorithm that provides high-level encryption and decryption. AES ensures secure data transmission and has little impact on network latency, throughput, and forwarding performance. Triple Data Encryption Standard (3DES) offers enhanced security by using its triple-layered encryption technique. Compared with AES encryption, 3DES encryption requires a large amount of computation, takes an extended period of time, and downgrades forwarding performance.
Authentication Algorithm	The authentication algorithm that is used in Phase 2 negotiations. Valid values: sha1, md5, sha256, sha384, and sha512. Default value: sha1.
DH Group	The DH key exchange algorithm that is used in Phase 2 negotiations. Default value: group2. Valid values: disabled: does not use a DH key exchange algorithm. For clients that do not support perfect forward secrecy (PFS), select disabled. If you select a value other than disabled, PFS is enabled by default. In this case, the key is updated for each negotiation. Therefore, you must enable PFS for your client. group1: DH group 1. group2: DH group 2. group5: DH group 5. group14: DH group 14.
SA Life Cycle (seconds)	The lifetime of the SA after Phase 2 negotiations succeed. Unit: seconds. Default value: 86400. Valid values: 0 to 86400.
DPD	Specifies whether to enable the dead peer detection (DPD) feature. By default, the DPD feature is enabled. After you enable the DPD feature, the IPsec-VPN connection sends DPD packets to check whether the peer exists and is available. If no response is sent from the peer within the specified period of time, the connection fails. Then, the Internet Security Association and Key Management Protocol (ISAKMP) SA, IPsec SA, and IPsec tunnel are deleted. If a DPD packet timeout occurs, the IPsec-VPN connection automatically reinitiates IPsec-VPN negotiations with the tunnel.
NAT Traversal	Specifies whether to enable the NAT traversal feature. By default, the NAT traversal feature is enabled. After you enable the NAT traversal feature, the initiator does not check UDP ports during IKE negotiations and can automatically discover NAT gateway devices along the IPsec tunnel.

BGP Configuration

If the BGP dynamic routing feature is enabled for the IPsec-VPN connection, you must specify the CIDR block of the BGP tunnel and the IP address of the BGP tunnel on the Alibaba Cloud side.

Parameter

Description

Tunnel CIDR Block

The CIDR block of the IPsec tunnel.

The CIDR block must fall into 169.254.0.0/16. The subnet mask of the CIDR block must be 30 bits in length. The CIDR block cannot be 169.254.0.0/30, 169.254.1.0/30, 169.254.2.0/30, 169.254.3.0/30, 169.254.4.0/30, 169.254.5.0/30, or 169.254.169.252/30.

Local BGP IP address

The BGP IP address of the IPsec-VPN connection on the Alibaba Cloud side.

This IP address must fall within the CIDR block of the IPsec tunnel.

Health check

By default, the health check feature is disabled. Before you add health check configurations, enable the health check feature.

Important

After you enable the health check feature for the IPsec-VPN connection, add the following route to the data center: The destination CIDR block is the Source IP Address, the subnet mask is 32 bits in length, and the next hop is the IPsec-VPN connection. This ensures that the health check runs as expected.

Parameter	Description
Destination IP Address	The IP address of the data center that Alibaba Cloud can access over the IPsec-VPN connection. Note Make sure that the destination IP address supports Internet Control Message Protocol (ICMP) responses.
Source IP Address	The IP address on the Alibaba Cloud side that the data center can access over the IPsec-VPN connection.
Retry Interval	The retry interval of the health check. Unit: seconds. Default value: 3.
Number of Retries	The number of health check retries. Default value: 3.
Switch Route	Specifies whether to allow the system to withdraw advertised routes after the health check fails. Default value: Yes. If you use the default value, the system is allowed to withdraw advertised routes after the health check fails. If you clear Yes, the system is not allowed to withdraw advertised routes after the health check fails.

Advanced configurations

When you create an IPsec-VPN connection, the system enables the following advanced features by default.

Parameter	Description
Automatic Advertising	After this feature is enabled, the system automatically advertises routes in the route table of the transit router that is associated with the IPsec-VPN connection to the BGP route table of the IPsec-VPN connection. Note This feature takes effect only if the BGP dynamic routing feature is enabled for the IPsec-VPN connection and data center. You can disable this feature by turning off Route Synchronization. For more information, see the "Disable route synchronization" section of the Route Synchronization topic.
Automatically Associate with Default Route Table of Transit Router	After this feature is enabled, the IPsec-VPN connection is associated with the default route table of the transit router. The transit router queries the default route table to forward traffic from the IPsec-VPN connection.
Automatically Advertise System Routes to Default Route Table of Transit Router	After this feature is enabled, the system advertises the routes in the destination-based route table and the BGP route table of the IPsec-VPN connection to the default route table of the transit router.

You can also disable the preceding advanced features and use the transit router to establish network communication based on your business requirements. For more information, see Manage routes.

What to do next

After an IPsec-VPN connection is created, you can download the peer configurations of the IPsec-VPN connection and load the configurations to an on-premises gateway device. For more information, see the "Download the configurations of an IPsec-VPN connection" section of the Create and manage IPsec-VPN connections in dual-tunnel mode topic and Configure local gateways.

Download the configurations of an IPsec-VPN connection

After an IPsec-VPN connection is created, you can download the configurations of the IPsec-VPN connection to configure an on-premises gateway device.

Log on to the VPN Gateway console.
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
In the top navigation bar, select the region of the IPsec-VPN connection.
On the IPsec Connections page, find the IPsec-VPN connection that you want to manage and click Generate Peer Configuration in the Actions column.
In the IPsec-VPN Connection Configuration dialog box, click Copy and save the configurations to your on-premises machine to configure your on-premises gateway device.
For more information about how to configure an on-premises gateway device, see Configure local gateways.

Grant the permissions on an IPsec-VPN connection to a transit router of another Alibaba Cloud account

You can associate an IPsec-VPN connection with a transit router of another Alibaba Cloud account. Before you perform the association, you must grant the permissions on the IPsec-VPN connection to the transit router.

Before you grant the permissions, make sure that the IPsec-VPN connection is not associated with any resources. If the IPsec-VPN connection is associated with a transit router, disassociate the transit router from the IPsec-VPN connection. For more information, see Delete a network instance connection.

Log on to the VPN Gateway console.
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
In the top navigation bar, select the region of the IPsec-VPN connection.
On the IPsec Connections page, find the IPsec-VPN connection that you want to manage and click its ID.
On the Authorize Cross Account Attach CEN tab of the connection details page, click Authorize Cross Account Attach CEN.

In the Attach to CEN dialog box, configure the parameters that are described in the following table and click OK.

Parameter	Description
Peer Account UID	The ID of the Alibaba Cloud account to which the transit router belongs.
Peer Account CEN ID	The ID of the CEN instance to which the transit router belongs.
Payer	The account that pays the fees. Default value: CEN Instance Owner Pays Bills. Valid values: CEN Instance Owner Pays Bills: After the IPsec-VPN connection is associated with a transit router, the owner account of the transit router pays the connection fee and data processing fee of the transit router. VPN Owner: After the IPsec-VPN connection is associated with a transit router, the owner account of the IPsec-VPN connection pays the connection fee and data processing fee of the transit router. Important Proceed with caution. Your services may be interrupted if you change the payment account. For more information, see the "Change the payment account" section of the Grant a transit router permissions on a network instance that belongs to another Alibaba Cloud account topic. After an IPsec-VPN connection is associated with a transit router, the owner account of the IPsec-VPN connection pays the instance fee and data transfer fee of the IPsec-VPN connection.

Record the ID of the IPsec-VPN connection and the ID of the Alibaba Cloud account to which the IPsec-VPN connection belongs. This facilitates creating VPN connections. For more information, see Attach an IPsec-VPN connection to a transit router.
You can view the account ID in the Account Management console.

Modify an IPsec-VPN connection

If the IPsec-VPN connection is associated with a transit router, you cannot modify the following information about the IPsec-VPN connection: the associated transit router, zone, and gateway type. However, you can modify the following information about the IPsec-VPN connection: the customer gateway, routing mode, pre-shared key, and encryption configurations.
If no resource is associated with the IPsec-VPN connection, you cannot modify the type of the associated customer gateway. However, you can modify the following information: the customer gateway, routing mode, pre-shared key, and encryption configurations.

Log on to the VPN Gateway console.
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
In the top navigation bar, select the region of the IPsec-VPN connection.
On the IPsec Connections page, find the IPsec-VPN connection that you want to manage, and click Edit in the Actions column.
On the Modify IPsec-VPN Connection page, modify the name, encryption configurations, and CIDR blocks based on your business requirements, and then click OK.
For more information, see the Create an IPsec-VPN connection section of this topic.

Revoke the permissions on the IPsec-VPN connection from a transit router of another Alibaba Cloud account

If you no longer need to associate an IPsec-VPN connection with a transit router of another Alibaba Cloud account, you can revoke the permissions on the IPsec-VPN connection from the transit router.

If the IPsec-VPN connection is associated with a transit router, disassociate the IPsec-VPN connection from the transit router before you revoke the permissions. For more information, see Delete a network instance connection.

Log on to the VPN Gateway console.
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
In the top navigation bar, select the region of the IPsec-VPN connection.
On the IPsec Connections page, find the IPsec-VPN connection that you want to manage and click its ID.
On the Authorize Cross Account Attach CEN tab of the connection details page, find the authorization record and click Unauthorize in the Actions column.
In the Unauthorize message, confirm the information and click OK.

Delete an IPsec-VPN connection

If the IPsec-VPN connection is associated with a transit router, disassociate the IPsec-VPN connection from the transit router before you delete the IPsec-VPN connection. For more information, see Delete a network instance connection.

Log on to the VPN Gateway console.
In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.
In the top navigation bar, select the region of the IPsec-VPN connection.
On the IPsec Connections page, find the IPsec-VPN connection that you want to manage and click Delete in the Actions column.
In the message that appears, confirm the information and click OK.

Create and manage IPsec-VPN connections by calling API operations

You can use tools such as Alibaba Cloud SDKs, Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS) to create and manage IPsec-VPN connections by calling API operations. We recommend that you use Alibaba Cloud SDKs. For more information about the API operations, see the following topics:

Parameter	Description
Tag Key	The tag key of the IPsec-VPN connection. You can select or enter a tag key.
Tag Value	The tag value of the IPsec-VPN connection. You can select or enter a tag value. You can leave the Tag Value parameter empty.

VPN Gateway:Create and manage IPsec-VPN connections associated with transit routers