VPN Gateway:Use IPsec-VPN to connect Alibaba Cloud VPCs to Amazon VPCs

Step 3: Deploy the VPN gateway on Alibaba Cloud

After you configure VPN resources on AWS, deploy a VPN gateway on Alibaba Cloud based on the following information to establish IPsec-VPN connections between the Amazon VPC and the Alibaba Cloud VPC.

1. Create customer gateways.

   1. Log on to the VPN Gateway console.

   2. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

   3. In the top navigation bar, select the region in which you want to create the customer gateway.

      Make sure that the customer gateway and the VPN gateway to be connected are deployed in the same region.

   4. On the Customer Gateways page, click Create Customer Gateway.

   5. In the Create Customer Gateway panel, configure the following parameters and click OK.

      You must create two customer gateways on Alibaba Cloud and use the external IP addresses of the tunnels of the AWS Site-to-Site VPN connections as the IP addresses of the customer gateways. The following table describes only the parameters that are relevant to this topic. You can use the default values for other parameters or leave them empty. For more information, see Create and manage a customer gateway.

      Important

      Use only the external IP address of Tunnel 1 of each Site-to-Site VPN connection as the IP address of a customer gateway. By default, the external IP address of Tunnel 2 of each Site-to-Site VPN connection is not used. After the IPsec-VPN connections are created, Tunnel 2 of each Site-to-Site VPN connection is unavailable.

      Parameter	Description	Customer Gateway 1	Customer Gateway 2
      Name	The name of the customer gateway.	Enter Customer Gateway 1.	Enter Customer Gateway 2.
      IP Address	The external IP address of the AWS tunnel.	Enter 18.XX.XX.161.	Enter 3.XX.XX.9.

2. Create an IPsec-VPN connection.

   1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

   2. In the top navigation bar, select the region in which you want to create the IPsec-VPN connection.

      Make sure that the IPsec-VPN connection and the VPN gateway are in the same region.

   3. On the IPsec Connections page, click Create IPsec-VPN Connection.

   4. On the Create IPsec-VPN Connection page, configure the IPsec-VPN connection based on the following information and click OK.

      Parameter	Description	Example
      Name	The name of the IPsec-VPN connection.	Enter IPsec-VPN Connection.
      Resource Group	The resource group to which the VPN gateway belongs.	Select the default resource group.
      Associate Resource	The type of the network resource that you want to associate with the IPsec-VPN connection.	Select VPN Gateway.
      VPN Gateway	The VPN gateway that you want to associate with the IPsec-VPN connection.	Select the VPN gateway that you created.
      Routing Mode	The routing mode of the traffic. Valid values: Destination Routing Mode: forwards traffic based on the destination IP address. Protected Data Flows: forwards traffic based on the source and destination IP addresses.	Select Protected Data Flows.
      Local Network	The CIDR block of the VPC with which the VPN gateway is associated.	Enter 10.0.0.0/16.
      Remote Network	The peer CIDR block that the VPC associated with the VPN gateway wants to access.	Enter 192.168.0.0/16.
      Effective Immediately	Specifies whether to immediately start negotiations for the connection. Valid values: Yes: starts negotiations after the configuration is complete. No: starts negotiations when inbound traffic is detected.	Select Yes.
      Enable BGP	Specifies whether to enable Border Gateway Protocol (BGP). If you want to use BGP routing for the IPsec-VPN connection, turn on Enable BGP. By default, Enable BGP is turned off.	Turn off Enable BGP.
      Tunnel 1	Configure VPN parameters for the active tunnel. By default, Tunnel 1 serves as the active tunnel and Tunnel 2 serves as the standby tunnel. You cannot modify this configuration.
      Customer Gateway	The customer gateway that you want to associate with the active tunnel.	Select Customer Gateway 1.
      Pre-Shared Key	The pre-shared key of the active tunnel that is used to verify identities. The pre-shared key must be 1 to 100 characters in length, and can contain digits, letters, and the following characters: ~ ` ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | ; : ' , . < > / ? If you do not specify a pre-shared key, the system generates a random 16-character string as the pre-shared key. Important The tunnel and the peer gateway device must use the same pre-shared key. Otherwise, the system cannot establish an IPsec-VPN connection.	Use the same pre-shared key as the key of the AWS tunnel to be connected.
      Encryption Configuration	Configure the parameters for the Internet Key Exchange (IKE), IPsec, dead peer detection (DPD), and NAT traversal features.	The value of the SA Life Cycle (seconds) parameter in the IKE Configurations section must be the same as the value specified on AWS. In this example, the value is set to 28800. The value of the SA Life Cycle (seconds) parameter in the IPsec Configurations section must be the same as the value specified on AWS. In this example, the value is set to 3600. Use the default values for other parameters. For more information, see Create and manage IPsec-VPN connections in dual-tunnel mode.
      Tunnel 2	Configure VPN parameters for the standby tunnel.
      Customer Gateway	The customer gateway that you want to associate with the standby tunnel.	Select Customer Gateway 2.
      Pre-Shared Key	The pre-shared key of the standby tunnel that is used to verify identities.	Use the same pre-shared key as the key of the AWS tunnel to be connected.
      Encryption Configuration	Configure the parameters for the IKE, IPsec, DPD, and NAT traversal features.	The value of the SA Life Cycle (seconds) parameter in the IKE Configurations section must be the same as the value specified on AWS. In this example, the value is set to 28800. The value of the SA Life Cycle (seconds) parameter in the IPsec Configurations section must be the same as the value specified on AWS. In this example, the value is set to 3600. Use the default values for other parameters. For more information, see Create and manage IPsec-VPN connections in dual-tunnel mode.
      Tags	The tags of the IPsec-VPN connection.	Leave this parameter empty.

   5. In the Created message, click OK.

3. Advertise the route of the VPN gateway.

   After you create the IPsec-VPN connection, you must advertise the route of the VPN gateway. If you select Protected Data Flows as Routing Mode, the system creates a policy-based route for the VPN gateway after the IPsec-VPN connection is created. The route is in the Unpublished state. You must advertise the policy-based route of the VPN gateway to the VPC.

   1. In the left-side navigation pane, choose Interconnections > VPN > VPN Gateways.

   2. In the top navigation bar, select the region in which the VPN gateway resides.

   3. On the VPN Gateways page, find the VPN gateway that you want to manage and click its ID.

   4. On the details page of the VPN gateway, click the Policy-based Route Table tab, find the route that you want to manage, and then click Advertise in the Actions column.

   5. In the Advertise Route message, click OK.

Step 4: Test the connectivity

After the configuration is complete, an IPsec-VPN connection is established between the Alibaba Cloud VPC and the Amazon VPC. The following example uses an ECS instance to access an Amazon EC2 instance to test the connectivity between the VPCs.

1. Log on to an ECS instance in the Alibaba Cloud VPC. For more information about how to log on to an ECS instance, see Connection method overview.

2. Run the ping command on the ECS instance to access the Amazon EC2 instance and check the connectivity.

   If the ECS instance receives a response from the Amazon EC2 instance, the VPCs can communicate with each other.

   ping <Private IP address of the Amazon EC2 instance>

   

3. Test the high availability of the IPsec-VPN connection.

   An IPsec-VPN connection in dual-tunnel mode provides high service availability. If the active tunnel is down, the standby tunnel automatically takes over to ensure the data transfer. The following section describes how to verify the high availability of an IPsec-VPN connection in dual-tunnel mode.

   1. Log on to the ECS instance in the Alibaba Cloud VPC.

   2. Run the following command on the ECS instance to access the Amazon EC2 instance:

      ping <Private IP address of the Amazon EC2 instance> -c 10000

   3. Interrupt the active tunnel of the IPsec-VPN connection.

      In this example, the pre-shared key of the active tunnel on the Alibaba Cloud side is modified to interrupt the active tunnel. If the pre-shared keys of the two sides of an active tunnel are inconsistent, the active tunnel is interrupted.

   4. Check the traffic of the ECS instance. In this example, the traffic of the ECS instance is temporarily interrupted and then restored, which indicates that the standby tunnel takes over when the active tunnel is interrupted.

      You can view the monitoring data of the tunnels on the Monitor tab of the IPsec-VPN connection. For more information, see Monitor an IPsec-VPN connection.