VPN Gateway:Create and manage an SSL server

1. Log on to the VPN Gateway console.

2. In the left-side navigation pane, choose Interconnections > VPN > SSL Servers.

3. In the top navigation bar, select the region of the SSL server.

   The SSL server and VPN gateway must reside in the same region.

4. On the SSL Servers page, click Create SSL Server.

5. In the Create SSL Server panel, set the following parameters and click OK.

   Parameter	Description
   Name	Enter a name for the SSL server.
   Resource Group	The resource group to which the VPN gateway belongs. The SSL server is automatically added to the same resource group as the VPN gateway.
   VPN Gateway	Select the VPN gateway to associate with the SSL server. Make sure that SSL-VPN is enabled for the VPN gateway.
   Local Network	The CIDR block that clients use to access resources through the SSL-VPN connection. The CIDR block can be the CIDR block of a virtual private cloud (VPC), a vSwitch, a cloud service such as Object Storage Service (OSS) or ApsaraDB RDS, or a data center that is connected to a VPC over an Express Connect circuit. You can click Add Local Network to add up to five local CIDR blocks. The following CIDR blocks cannot be used for a local network: 127.0.0.0~127.255.255.255 169.254.0.0~169.254.255.255 224.0.0.0~239.255.255.255 255.0.0.0~255.255.255.255 Note The prefix length of the local network's subnet mask must be between 8 and 32 bits.
   Client CIDR Block	The IP address pool from which the VPN gateway assigns addresses to client virtual network interfaces. This is not the client's existing private network. When a client connects, the VPN gateway assigns it an IP address from this block. The client then uses this IP address to access cloud resources. Make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the VPN gateway. Click to view the reason. For example, if you specify 192.168.0.0/24 as the client CIDR block, the system first divides a subnet CIDR block with a subnet mask that is 30 bits in length from 192.168.0.0/24, such as 192.168.0.4/30, which provides up to four IP addresses. Then, the system assigns an IP address from 192.168.0.4/30 to the client and uses the other three IP addresses to ensure network communication. In this case, one client consumes four IP addresses. To ensure that an IP address is assigned to your client, you must make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the VPN gateway with which the SSL server is associated. Click to view the CIDR blocks that are not supported. 100.64.0.0~100.127.255.255 127.0.0.0~127.255.255.255 169.254.0.0~169.254.255.255 224.0.0.0~239.255.255.255 255.0.0.0~255.255.255.255 Recommended client CIDR blocks for different numbers of SSL-VPN connections If the number of SSL-VPN connections is 5, use a /27 subnet or larger (e.g., 10.0.0.0/27 or 10.0.0.0/26). If the number of SSL-VPN connections is 10, use a /26 subnet or larger (e.g., 10.0.0.0/26 or 10.0.0.0/25). If the number of SSL-VPN connections is 20, use a /25 subnet or larger (e.g., 10.0.0.0/25 or 10.0.0.0/24). If the number of SSL-VPN connections is 50, use a /24 subnet or larger (e.g., 10.0.0.0/24 or 10.0.0.0/23). If the number of SSL-VPN connections is 100, use a /23 subnet or larger (e.g., 10.0.0.0/23 or 10.0.0.0/22). If the number of SSL-VPN connections is 200, use a /22 subnet or larger (e.g., 10.0.0.0/22 or 10.0.0.0/21). If the number of SSL-VPN connections is 500, use a /21 subnet or larger (e.g., 10.0.0.0/21 or 10.0.0.0/20). If the number of SSL-VPN connections is 1,000, use a /20 subnet or larger (e.g., 10.0.0.0/20 or 10.0.0.0/19). Important The subnet mask of the Client CIDR Block must have a prefix length between 16 and 29 bits. The client CIDR block must not overlap with the local CIDR block, the VPC CIDR block, or route CIDR blocks associated with the client. We recommend that you use 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or their subnets for the client CIDR block. If you must use a public IP address range, you must configure it as a user-defined CIDR block for the VPC to ensure proper routing. For more information, see VPC FAQ. After you create the SSL server, the system automatically adds a route for the Client CIDR Block to the route table of the VPC. Do not manually add this route to the VPC route table. Otherwise, SSL-VPN connections may be disrupted.
   Advanced Configuration
   Protocol	The protocol used by the SSL-VPN connection. Default value: TCP(Recommended). Valid values: UDP TCP(Recommended)
   Port	The port that is used by the SSL server. Valid values are in the range of 1 to 65535. Default value: 1194. Note The following ports are not supported: 22, 2222, 22222, 9000, 9001, 9002, 7505, 80, 443, 53, 68, 123, 4510, 4560, 500, and 4500.
   Encryption Algorithm	The encryption algorithm that is used by an SSL-VPN connection. If the client uses Tunnelblick or OpenVPN V2.4.0 or later, the SSL server dynamically negotiates with the client about the encryption algorithm and uses the most secure encryption algorithm that is supported by the SSL server and the client. The encryption algorithm that you specify for the SSL server does not take effect. If the client uses OpenVPN of a version that is earlier than 2.4.0, the SSL server and the client use the encryption algorithm that you specify for the SSL server. You can specify one of the following encryption algorithms for the SSL server: AES-128-CBC AES-192-CBC AES-256-CBC none A value of none indicates that no encryption algorithm is used.
   Compressed	Specifies whether to compress the data that is transmitted over the SSL-VPN connection. Default value: No. Valid values: Yes No (default)
   Two-factor Authentication	Specifies whether to enable two-factor authentication for the VPN gateway. By default, two-factor authentication is disabled. Two-factor authentication verifies the identity of a client by using the default SSL client certificate and the username and password of IDaaS EIAM before an SSL-VPN connection is established. The client must pass both authentications before the connection can be created. Two-factor authentication helps prevent user identity theft and unauthorized SSL-VPN connections. It efficiently improves the security of SSL-VPN connections and protects sensitive data in VPCs against data breaches. For more information, see SSL-VPN two-factor authentication. After two-factor authentication is enabled, you can select the IDaaS EIAM instance and IDaaS application ID used for authentication. Click to view the two-factor authentication procedure The client initiates an SSL-VPN connection request. After the VPN gateway receives the request, the VPN gateway verifies the SSL client certificate of the client. After the client passes the authentication, you need to enter the username and password on the client. Then, the VPN software passes the username and password to the VPN gateway. After the VPN gateway receives the username and password, it sends them to IDaaS for authentication. IDaaS verifies the username and password, and returns the authentication result to the VPN gateway. The VPN gateway accepts or denies the SSL-VPN connection request based on the authentication result. Note If you use the two-factor authentication feature for the first time, you must first authorize VPN to access cloud resources. When you create an SSL server in the UAE (Dubai) region, we recommend that you associate the SSL server with an IDaaS EIAM 2.0 instance in Singapore to reduce latency. You can no longer purchase IDaaS EIAM 1.0 instances. If your Alibaba Cloud account has an IDaaS EIAM 1.0 instance, you can still specify the IDaaS EIAM 1.0 instance after you enable the two-factor authentication feature. If your Alibaba Cloud account has no IDaaS EIAM 1.0 instance, you can specify only an IDaaS EIAM 2.0 instance after you enable the two-factor authentication feature. You may need to update the VPN gateway to associate it with an IDaaS EIAM 2.0 instance. For more information, see Announcement on the change of supporting IDaaS EIAM 2.0 instances for two-factor authentication of SSL-VPN connections.

What to do next

After the SSL server is created, you need to create an SSL client certificate based on the SSL server and install the SSL client certificate on the client for identity authentication and data encryption. For more information, see Create and manage SSL client certificates.