IPsec-VPN is a route-based technology that enables secure communication over the internet. After an IPsec-VPN connection is established, local clients can connect to services that are deployed in virtual private clouds (VPCs) over virtual private networks (VPNs). This topic describes how to use IPsec-VPN to connect a local client to the VPC of an office network in Elastic Desktop Service (EDS).
Preparations
Before you begin, read the Access a cloud computer over a private network topic and complete the following preparations:
Create a Cloud Enterprise Network (CEN) instance. For more information, see Create a CEN instance.
Create a VPC and attach it to the CEN instance. For more information, see Create a VPC and a vSwitch or Attach a network instance to a CEN instance.
Create an office network and attach its VPC to the CEN instance. For more information, see Create and manage convenience office networks and Create and manage an enterprise AD office network.
ImportantBefore you create an office network, you must plan the IPv4 CIDR block of the office network to prevent CIDR block conflicts between the office network and the CEN instance or between the office network and your data center. For more information, see Plan a CIDR block.
If you create a convenience office network, attach the convenience office network to the CEN instance.
If you deploy your AD system on an Elastic Compute Service (ECS) instance, you must attach the VPC of the AD server to the CEN instance. If you deploy your AD system on a local server, you must connect the local network to the cloud network. You can create an enterprise AD office network and implement connectivity between the local server and the cloud, and then configure the AD domain.
Create a cloud computer and an account. Then, assign the cloud computer to the account.
For more information about how to create an account, see Create a convenience account or Create and manage an enterprise AD office network.
For more information about how to create and assign cloud computers, see Create cloud computers and Assign cloud computers to users.
Obtain an Alibaba Cloud Workspace terminal to connect to and use the cloud computer. For more information, see Use a client.
NoteThe following Alibaba Cloud Workspace terminals are supported if you want to use IPsec-VPN to connect to cloud computers: Windows client and macOS client.
Sample CIDR blocks
You must plan CIDR blocks to prevent CIDR block conflicts between the networks used by local devices and cloud instances. In this section, the CIDR blocks described in the following table are used. The actual CIDR blocks shall prevail.
Configuration item | CIDR block/IP address | Description |
Office network VPC | 172.16.0.0/12 | The CIDR block of the VPC that is used by the office network in which the cloud computer resides. Alibaba Cloud PrivateLink (endpoint service) uses the CIDR block. |
User VPC | 192.168.0.0/16 | The CIDR block of the VPC that you create to establish a VPN connection. |
Data center | 192.10.0.0/16 | The CIDR block of a local network that the Alibaba Cloud Workspace client uses. A VPN connection is initiated from the CIDR block. |
Data center gateway | 115.XX.XX.154 | The public IP address of the gateway in the data center. |
The data center gateway must support standard IKEv1 and IKEv2 protocols to connect to VPN gateways. IKEv2 and IKEv1 are the two IKE iterations. To check whether the gateway supports IKEv1 and IKEv2 protocols, contact the gateway manufacturer.
Step 1: Configure IPsec-VPN
Create a VPN gateway and enable IPsec-VPN. For more information, see Create a VPN gateway.
Creates a customer gateway. For more information, see Create and manage a customer gateway.
Create an IPsec-VPN connection. For more information, see Create an IPsec-VPN connection.
Parameter
Description
Name
The name of the IPsec-VPN connection.
Resource Group
The resource group to which the VPN gateway belongs.
If you leave this parameter empty, the system displays the VPN gateways in all resource groups.
Associate Resource
The type of network resource to be associated with the IPsec-VPN connection. In this example, VPN Gateway is selected.
VPN Gateway
The VPN gateway to be associated with the IPsec-VPN connection.
Routing Mode
The routing mode of the IPsec-VPN connection. Default value: Destination Routing Mode. Valid values:
Destination Routing Mode: routes and forwards traffic based on the destination IP address.
Protected Data Flows: routes and forwards traffic based on the source and destination IP addresses.
If you select Protected Data Flows, you must configure the Local Network and Remote Network parameters. After the IPsec-VPN connection is configured, the system automatically adds policy-based routes to the route table of the VPN gateway.
By default, the policy-based routes are not advertised. You can determine whether to advertise the routes to the route table of the VPC based on your requirements. For more information, see the "Advertise a policy-based route" section of the Configure policy-based routes topic.
NoteIf the IPsec-VPN connection is associated with a VPN gateway and the VPN gateway is not of the latest version, you do not need to specify the routing mode.
Local Network
The CIDR block of the VPC to be connected to your data center. This CIDR block is used in Phase 2 negotiations.
Click
next to the field to add multiple CIDR blocks on the VPC side. NoteIf you specify multiple CIDR blocks, you must set the IKE version to ikev2.
Remote Network
The CIDR block of the data center to be connected to the VPC. This CIDR block is used in Phase 2 negotiations.
Click
next to the field to add multiple CIDR blocks on the data center side. NoteIf you specify multiple CIDR blocks, you must set the IKE version to ikev2.
Effective Immediately
Specifies whether to immediately start IPsec-VPN negotiations. Default value: Yes. Valid values:
Yes: immediately starts IPsec-VPN negotiations after the IPsec-VPN connection is created.
No: starts IPsec-VPN negotiations when inbound traffic is detected.
Customer Gateway
The customer gateway to be associated with the IPsec-VPN connection.
Pre-Shared Key
The pre-shared key that is used for authentication between the VPN gateway and the data center.
The pre-shared key must be 1 to 100 characters in length and can contain digits, letters, and the following characters:
~ ' ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | ; : , . < > / ?. The pre-shared key cannot contain spaces.If you do not specify a pre-shared key, the system randomly generates a 16-character string as the pre-shared key. After an IPsec-VPN connection is created, you can click Edit in the Actions column of the IPsec-VPN connection to view the pre-shared key that is generated for the IPsec-VPN connection. For more information, see the Modify an IPsec-VPN connection section of this topic.
ImportantThe pre-shared keys must be the same on both sides. Otherwise, the system cannot establish an IPsec-VPN connection.
Enable BGP
Specifies whether to enable the BGP dynamic routing feature for the IPsec-VPN connection. By default, Enable BGP is turned off.
Before you use the BGP dynamic routing feature, we recommend that you understand how it works and its limits. For more information, see the Configure BGP dynamic routing.
Local ASN
The autonomous system number (ASN) of the IPsec-VPN connection on the Alibaba Cloud side. Default value: 45104. Valid values: 1 to 4294967295.
You can enter the ASN in two segments and separate the first 16 bits from the following 16 bits with a period (.). Enter the number in each segment in decimal format.
For example, if you enter 123.456, the ASN is 123 × 65536 + 456 = 8061384.
NoteWe recommend that you use a private ASN to establish a connection to Alibaba Cloud over BGP. For more information about the valid values of a private ASN, see the relevant documentation.
Publish the peer CIDR block to CEN.
Log on to the VPC console.
In the left-side navigation pane, click Route Tables.
On the Route Tables page, find the route table of the user VPC and click the ID of the route table.
On the route table details page, select the Route Entry List tab and click the Custom Route tab.
Find the peer CIDR block (the CIDR block of the private network used by the data center) that you configured and click Publish in the Actions column.
If the value in the Status column of the CIDR block is Published, the CIDR block is published.
Step 2: Load the VPN configurations to the data center gateway
Log on to the VPC console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region of the IPsec-VPN connection.
On the IPsec Connections page, find the IPsec-VPN connection and click Generate Peer Configuration in the Actions column.
Load the IPsec-VPN connection configurations that you downloaded to the data center gateway.
For more information, see Configure an H3C firewall.
Step 3: Configure the route and DNS settings for cloud services
Configure routing for cloud services.
The CIDR block of the cloud services in Alibaba Cloud that can be accessed over a VPC is 100.64.0.0/10. This CIDR block is a reserved CIDR block defined in RFC 6598. To ensure that you can call the EDS API from the Alibaba Cloud Workspace client as expected, configure a route for the CIDR block 100.64.0.0/10 in the data center network to forward requests destined for the CIDR block to the user VPC in the cloud
(Optional) Before you configure Domain Name System (DNS), run the following command to test whether the domain name can be resolved:
nslookup ecd-vpc.cn-hangzhou.aliyuncs.comIf an IP address is returned, the domain name can be resolved. In this case, you can skip the next step. If no IP address is returned, perform the following step to configure DNS.
(Optional) Configure DNS.
To access cloud computers over a private network, DNS is required to resolve the domain names involved in the EDS API and streaming gateways that reside in the private network. In this example, use the following IP addresses for your DNS server:
100.100.2.136
100.100.2.138
You can use one of the following methods to configure DNS addresses:
Add the preceding DNS addresses to the Dynamic Host Configuration Protocol (DHCP) service of the data center.
Configure transit routers on the DNS server of the data center to route domain name resolution requests that end with
aliyuncs.comto 100.100.2.136 or 100.100.2.138.
Step 4: Check whether the cloud computer can be connected over the private network
In this section, the Windows client of Alibaba Cloud Workspace V7.2.2 is used as an example to check whether the cloud computer can be connected over the private network. The actual type of the Alibaba Cloud Workspace client that you use shall prevail.
Launch the Windows client.
In the lower part of the logon page, choose and select Alibaba Cloud VPC.
Enter the logon credentials, including an office network ID or organization ID, username, and password, sent to your email address. Then, click the Next icon to proceed.
Find the cloud computer from the resource list. Then, start and connect to it.
NoteIf errors such as network request timeout occur, network connectivity is not established. Check whether the preceding network settings are correctly configured. Then, re-log on to the client and connect to the cloud computer.