VPN Gateway:Configure policy-based routes

Match rules for policy-based routes (including route priorities)

When a VPN gateway forwards traffic, the following match rules are applied:

1. Policy-based routes are matched against traffic in descending order of route priority. A smaller priority value indicates a higher priority. The VPN gateway forwards traffic based on the route that matches traffic.

   If your VPN gateway is configured with active/standby policy-based routes, the VPN gateway selects policy-based routes based on whether the IPsec-VPN connection of the route meets the following conditions: IPsec negotiations status and health check status.

   • If the active policy-based route passes both IPsec negotiations and health checks, the active policy-based route is used.

   • If the active policy-based route fails IPsec negotiations or health checks but the standby policy-based route passes IPsec negotiations and health checks, the standby policy-based route is used.

   • If both the active policy-based route and the standby policy-based route fail IPsec negotiations or health checks, the active policy-based route is used.

2. If multiple policy-based routes are assigned the same priority, traffic is matched against the policy-based routes based on their sequence numbers. The VPN gateway uses the first matched policy-based route to forward traffic.

   Each route is assigned a sequence number when it is applied to the system. In most cases, routes that are configured earlier are delivered to the system first and have higher priorities than routes that are configured later. However, this is not guaranteed. In some cases, routes that are configured later are delivered to the system first and have higher priorities than routes that are configured earlier.

Recommendations

To make sure that traffic can be forwarded as expected, we recommend that you configure a different priority for each policy-based route.

If you want to configure active/standby policy-based routes, we recommend that you configure the same priority for both the active and standby policy-based routes.

Examples

As shown in the preceding figure, Data Center_1 communicates with VPC_1 through IPsec-VPN Connection 1, and the Data Center_2 communicates with VPC_1 through IPsec-VPN Connection 2. The CIDR blocks of Data Center_1 to be connected to VPC_1 are 192.168.1.0/24 and 192.168.2.0/24, the CIDR block of Data Center_2 to be connected to VPC_1 is 192.168.5.0/24, and the CIDR block of VPC_1 to be connected to the data centers is 172.16.0.0/16.

When you configure policy-based routes, you need to first configure a route from VPC_1 to Data Center_2, and then aggregate the destination CIDR blocks of the route from VPC_1 to Data Center_1 into 192.168.0.0/21. Both policy-based routes have the same priority. After you complete the preceding configurations, the policy-based routes are not applied to the system in the order you configured them. This disrupts the sequence numbers of the destination CIDR blocks of the policy-based routes, as shown in the following table.

When the VPN gateway forwards traffic from VPC_1 to Data Center_2, network traffic is matched against the routes in sequence because both policy-based routes have the same priority. Traffic from VPC_1 to Data Center_2 matches the route whose sequence number is 1. As a result, traffic from VPC_1 to Data Center_2 is routed to Data Center_1 through IPsec-VPN Connection 1.

In the preceding scenario, you cannot control the time when policy-based routes are applied to the system. As a result, the policy-based routes are not sorted in the desired sequence and traffic is not forwarded by using the desired route. To prevent this issue, we recommend that you configure a different priority for each policy-based route. This way, traffic can match only one route without being affected by the sequence of policy-based routes.

In this example, we recommend that you configure routes as shown in the following table. The policy-based route with the sequence number 1 is first applied to the system, but has a lower priority. Therefore, when the VPN gateway forwards traffic from VPC_1 to Data Center_2, traffic matches the policy-based route with the sequence number 2 and traffic is forwarded to Data Center_2 as expected.

Match rules of policy-based routes (excluding route priorities)

When a VPN gateway forwards traffic, network traffic is matched against policy-based routes based on their sequence numbers instead of the longest prefix. If network traffic matches a policy-based route, the VPN gateway immediately uses the policy-based route to forward traffic.

• The sequence number of a policy-based route is determined by the time when the route is applied to the system. In most cases, routes that are configured earlier are applied to the system first and have higher priorities than routes that are configured later. However, this is not guaranteed. In some cases, routes that are configured later are applied to the system first and have higher priorities than routes that are configured earlier.

• If your VPN gateway is configured with active/standby policy-based routes, the VPN gateway selects policy-based routes based on whether the IPsec-VPN connection of the route meets the following conditions: IPsec negotiations status and health check status.

  • If the active policy-based route passes both IPsec negotiations and health checks, the active policy-based route is used.

  • If the active policy-based route fails IPsec negotiations or health checks but the standby policy-based route passes IPsec negotiations and health checks, the standby policy-based route is used.

  • If both the active policy-based route and the standby policy-based route fail IPsec negotiations or health checks, the active policy-based route is used.

Recommendations

To ensure that traffic is forwarded by using the desired route, we recommend that you specify smaller CIDR blocks for policy-based routes and make sure that traffic can be matched only by one policy-based route.

Examples

As shown in the preceding figure, Data Center_1 communicates with VPC_1 through IPsec-VPN Connection 1, and the Data Center_2 communicates with VPC_1 through IPsec-VPN Connection 2. The CIDR blocks of Data Center_1 to be connected to VPC_1 are 192.168.1.0/24 and 192.168.2.0/24, the CIDR block of Data Center_2 to be connected to VPC_1 is 192.168.5.0/24, and the CIDR block of VPC_1 to be connected to the data centers is 172.16.0.0/16.

When you create policy-based routes, you need to first create a route that forwards traffic from VPC_1 to Data Center_2. Then, you need to create a route that forwards traffic from VPC_1 to Data Center_1 and set the destination CIDR block of the route to 192.168.0.0/21. After the routes are created, the routes are not applied to the system in the sequence in which they are created. The following table describes the sequence numbers of the routes.

When the VPN gateway forwards traffic from VPC_1 to Data Center_2, network traffic is matched against the routes based on their sequence numbers. Traffic from VPC_1 to Data Center_2 matches the route whose sequence number is 1. As a result, traffic from VPC_1 to Data Center_2 is routed to Data Center_1 through IPsec-VPN Connection 1.

In the preceding scenario, you cannot control the time when policy-based routes are applied to the system. As a result, the policy-based routes are not sorted in the desired sequence and traffic is not forwarded by using the desired route. To prevent this issue, we recommend that you specify smaller CIDR blocks for policy-based routes to ensure that traffic can match only one route. This way, traffic can be routed without being affected by the sequence of policy-based routes.

In this example, you can configure the policy-based routes as shown in the following table. When the VPN gateway forwards traffic from VPC_1 to Data Center_2, traffic matches only the policy-based route whose sequence number is 2, and traffic is forwarded to Data Center_2 by using the desired route.