Create and manage a VPN gateway

Limits

• The peak bandwidth for data transfer between a data center and a VPN gateway varies in the supported IPsec-VPN tunnel mode and bandwidth of the VPN gateway. The following table describes the details.

  Supported IPsec-VPN tunnel mode	Bandwidth of VPN gateway	Peak bandwidth for data transfer from a VPN gateway to a data center	Peak bandwidth for data transfer from a data center to a VPN gateway

  Supported IPsec-VPN tunnel mode	Bandwidth of VPN gateway	Peak bandwidth for data transfer from a VPN gateway to a data center	Peak bandwidth for data transfer from a data center to a VPN gateway
  Dual-tunnel mode	Greater than 10 Mbit/s	The bandwidth of the VPN gateway	The bandwidth of the VPN gateway
  	Less than or equal to 10 Mbit/s	The bandwidth of the VPN gateway	10 Mbit/s
  Single-tunnel mode	Greater than 100 Mbit/s	The bandwidth of the VPN gateway	The bandwidth of the VPN gateway
  	Less than or equal to 100 Mbit/s	The bandwidth of the VPN gateway	100 Mbit/s

• The maximum bandwidth supported by a VPN gateway varies in different regions. The maximum bandwidth in some regions can reach 1000 Mbit/s.

  Maximum bandwidth	Region

  Maximum bandwidth	Region
  1,000 Mbit/s	China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Heyuan), China (Guangzhou), China (Chengdu), China (Hong Kong), Singapore, Japan (Tokyo), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Thailand (Bangkok), South Korea (Seoul), Philippines (Manila), US (Silicon Valley), US (Virginia), Germany (Frankfurt), and UK (London)
  500 Mbit/s	China (Nanjing - Local Region), UAE (Dubai), and SAU (Riyadh - Partner Region) Important The SAU (Riyadh - Partner Region) region is operated by a partner.

Create a VPN gateway

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region in which you want to create a VPN gateway.

   Make sure that the VPN gateway resides in the same region as the VPC that you want to associate with the VPN gateway.

3. On the VPN Gateways page, click Create VPN Gateway.

4. On the buy page, configure the parameters described in the following table, click Buy Now, and then complete the payment.

   Parameter	Description

   Parameter	Description
   Instance Name	The name of the VPN gateway.
   Resource Group Select the resource group to which the cluster belongs. You can use resource groups to manage resources within your Alibaba Cloud account by category and group. You can manage permissions, deploy resources, and monitor resources based on groups without the need to separately process each resource. Default Resource Group	The resource group to which the VPN gateway belongs. If you leave this parameter empty, the VPN gateway belongs to the default resource group. You can manage the resource group to which the VPN gateway belongs and resource groups to which other cloud resources belong in the Resource Management console. For more information, see What is Resource Management?
   Region	The region in which you want to create the VPN gateway. Make sure that the VPN gateway and the VPC with which you want to associate the VPN gateway reside in the same region.
   Gateway Type	The type of VPN gateway that you want to create. Default value: Standard.
   Network Type	The network type of the VPN gateway. Valid values: Public: The VPN gateway can be used to establish VPN connections over the Internet. Private: The VPN gateway can be used to establish VPN connections over private networks. Note If you want to establish a VPN connection over a private network, you recommend that you associate a router with the private IPsec-VPN connection. For more information, see Create multiple private IPsec-VPN connections to implement load balancing.
   Tunnels	The tunnel mode of the VPN gateway. The system displays the tunnel modes that are supported in this region. Valid values: Single-tunnel Dual-tunnel For more information about the tunnel mode, see [Upgrade notice] IPsec-VPN connections support the dual-tunnel mode.
   VPC	The VPC with which you want to associate the VPN gateway.
   vSwitch	The vSwitch with which you want to associate the VPN gateway. Select a vSwitch from the selected VPC. If you select Single-tunnel, you need to specify only one vSwitch. If you select Dual-tunnel, you need to specify two vSwitches. After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) for each of the two vSwitches as an interface to communicate with the VPC over an IPsec-VPN connection. Each ENI occupies one IP address in the vSwitch. Note The system selects a vSwitch by default. You can change or use the default vSwitch. After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.
   vSwitch 2	The other vSwitch with which you want to associate the VPN gateway in the associated VPC if you select Dual-tunnel. Specify two vSwitches in different zones in the associated VPC to implement disaster recovery across zones for IPsec-VPN connections. For a region that supports only one zone, disaster recovery across zones is not supported. We recommend that you specify two vSwitches in the zone to implement high availability of IPsec-VPN connections. You can also select the same vSwitch as the first one. Regions that support only one zone China (Nanjing - Local Region), Thailand (Bangkok), South Korea (Seoul), Philippines (Manila), and UAE (Dubai)
   Peak Bandwidth	The maximum bandwidth of the VPN gateway. Unit: Mbit/s.
   Traffic	The metering method of the VPN gateway. Default value: Pay-by-data-transfer.
   IPsec-VPN	Specifies whether to enable the IPsec-VPN feature for the VPN gateway. Default value: Enable. You must enable this feature if you want to establish an IPsec-VPN connection.
   SSL-VPN	Specifies whether to enable the SSL-VPN feature for the VPN gateway. Default value: Disable. You do not need to enable this feature for the VPN gateway to establish an IPsec-VPN connection.
   Billing Cycle	The billing cycle of the VPN gateway. Default value: By Hour.
   Service-linked Role	Click Create Service-linked Role and the system automatically creates the service-linked role AliyunServiceRoleForVpn. VPN Gateway assumes this role to access other cloud resources. For more information, see AliyunServiceRoleForVpn. If Created is displayed, the service-linked role is created and you do not need to create it again.

   After the VPN gateway is created, the system assigns an IP address to the VPN gateway to establish an IPsec-VPN connection with the on-premises data center.

   What to do next

   After the VPN gateway is created, you must also create a customer gateway before you can establish an IPsec-VPN connection. The customer gateway is used to register the information about the gateway device of your data center with Alibaba Cloud. The information includes the IP address and autonomous system number (ASN) of the Border Gateway Protocol (BGP). For more information, see Create and manage a customer gateway.

Modify the name and description of a VPN gateway

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region in which the VPN gateway resides.

3. On the VPN Gateways page, find the VPN gateway that you want to manage and click its ID.

4. In the Basic Information section on the details page of the VPN gateway, modify the name and description of the VPN gateway.

   • Click Edit next to the Name parameter. In the dialog box that appears, modify the name of the VPN gateway and click OK.

   • Click Edit next to the Description field. In the dialog box that appears, modify the description and click OK.

Delete a VPN gateway

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region in which the VPN gateway resides.

3. On the VPN Gateways page, find the VPN gateway that you want to delete and click Delete in the Actions column.

4. In the Delete VPN Gateway message, click OK.

Create and manage VPN gateways by calling API operations

You can call API operations to create and manage VPN gateways by using tools such as Alibaba Cloud SDKs, Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS). We recommend that you use Alibaba Cloud SDKs. For more information about the related API operations, see the following topics:

• CreateVpnGateway: creates a VPN gateway.

• ModifyVpnGatewayAttribute: modifies the name and description of a VPN gateway.

• DeleteVpnGateway: deletes a VPN gateway.

• DescribeVpnGateway: queries the information about a VPN gateway.

• DescribeVpnGateways: queries the information about VPN gateways in a region.

• MoveVpnResourceGroup: modifies the resource group to which a VPN gateway belongs.