：Connect an Azure database to Alibaba Cloud

Scenario

In this example, an enterprise creates a VPC in the Germany (Frankfurt) region of Alibaba Cloud and a VPC in the Germany West Central region of Azure. The enterprise can establish IPsec-VPN connections to enable communication between the Alibaba Cloud VPC and the Azure VPC.

Prerequisites

• The Azure database resides in a VPC. For more information, contact Azure.

• A VPC is created in the Germany (Frankfurt) region of Alibaba Cloud. For more information, see Create a VPC with an IPv4 CIDR block.

• The CIDR blocks of the Azure VPC and the Alibaba Cloud VPC are obtained.

  Note

  You can plan the CIDR blocks by yourself. Make sure that the CIDR blocks of the two VPCs do not overlap each other.

  Resource	CIDR block	IP address
  Alibaba Cloud VPC	10.0.0.0/16,100.104.0.0/16	Private IP address of the Alibaba Cloud database
  Azure VPC	192.168.0.0/16	Private IP address of the Azure database

Procedure

1. Create a VPN gateway on Alibaba Cloud.

   Create a VPN gateway on Alibaba Cloud. For more information, see Step 1: Create a VPN gateway on Alibaba Cloud.

2. Deploy VPN resources on Azure.

   Deploy VPN resources on Azure. For more information, see Step 2: Deploy VPN resources on Azure.

3. Deploy the VPN gateway on Alibaba Cloud.

   Establish an IPsec-VPN connection between the Azure VPC and the Alibaba Cloud VPC. For more information, see Step 3: Deploy the VPN gateway on Alibaba Cloud.

Step 1: Create a VPN gateway on Alibaba Cloud

You must first create a VPN gateway on Alibaba Cloud. After the VPN gateway is created, the system assigns two IP addresses to the VPN gateway. The IP addresses are used to establish an IPsec-VPN connection to the Azure virtual network.

1. Log on to the VPN Gateway console.

2. In the top navigation bar, select the region where you want to create the VPN gateway.

   The region of the VPN gateway must be the same as that of the VPC to be associated.

3. On the VPN Gateway page, click Create VPN Gateway.

4. On the buy page, configure the following parameters, click Buy Now, and then complete the payment.

   The following table describes only the key parameters that you must configure. For other parameters, use the default values or leave them empty. For more information, see Create and manage a VPN gateway.

   Parameter	Description	Example
   Name	The name of the VPN gateway.	Enter VPN Gateway.
   Region	The region in which you want to create the VPN gateway.	Select Germany (Frankfurt).
   Gateway Type	The type of the VPN gateway.	Select Standard.
   Network Type	The network type of the VPN gateway.	Select Public.
   Tunnels	The tunnel mode of the VPN gateway. The system displays the tunnel modes that are supported in this region. Valid values: Dual-tunnel Single-tunnel For more information about the single-tunnel mode and dual-tunnel mode, see [Upgrade notice] IPsec-VPN connections support the dual-tunnel mode.	Use the default value Dual-tunnel.
   VPC	The VPC with which you want to associate the VPN gateway.	Select a VPC in the Germany (Frankfurt) region.
   VSwitch	The vSwitch with which you want to associate the VPN gateway in the associated VPC. If you select Single-tunnel, you need to specify only one vSwitch. If you select Dual-tunnel, you need to specify two vSwitches. After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) for each of the two vSwitches as an interface to communicate with the VPC over an IPsec-VPN connection. Each ENI occupies one IP address in the vSwitch. Note By default, the system selects a vSwitch. You can change or use the default vSwitch. After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.	Select a vSwitch in the associated VPC.
   vSwitch 2	The other vSwitch with which you want to associate the VPN gateway in the associated VPC. Specify two vSwitches in different zones in the associated VPC to implement disaster recovery across zones for IPsec-VPN connections. For a region that supports only one zone, disaster recovery across zones is not supported. We recommend that you specify two vSwitches in the zone to implement high availability of IPsec-VPN connections. You can also select the same vSwitch as the first one. Note If only one vSwitch is deployed in the VPC, create a vSwitch. For more information, see Create and manage a vSwitch.	Select another vSwitch in the associated VPC.
   IPsec-VPN	Specifies whether to enable IPsec-VPN for the VPN gateway. Default value: Enable.	Select Enable.
   SSL-VPN	Specifies whether to enable SSL-VPN for the VPN gateway. Default value: Disable.	Select Disable.

5. 1. Log on to the VPN Gateway console.

   2. In the top navigation bar, select the region where you want to create the VPN gateway.

      The region of the VPN gateway must be the same as that of the VPC to be associated.

   3. On the VPN Gateway page, click Create VPN Gateway.

   4. On the buy page, configure the following parameters, click Buy Now, and then complete the payment.

      The following table describes only the key parameters that you must configure. For other parameters, use the default values or leave them empty. For more information, see Create and manage a VPN gateway.

      Parameter	Description	Example
      Name	The name of the VPN gateway.	Enter VPN Gateway.
      Region	The region in which you want to create the VPN gateway.	Select Germany (Frankfurt).
      Gateway Type	The type of the VPN gateway.	Select Standard.
      Network Type	The network type of the VPN gateway.	Select Public.
      Tunnels	The tunnel mode of the VPN gateway. The system displays the tunnel modes that are supported in this region. Valid values: Dual-tunnel Single-tunnel For more information about the single-tunnel mode and dual-tunnel mode, see [Upgrade notice] IPsec-VPN connections support the dual-tunnel mode.	Use the default value Dual-tunnel.
      VPC	The VPC with which you want to associate the VPN gateway.	Select a VPC in the Germany (Frankfurt) region.
      VSwitch	The vSwitch with which you want to associate the VPN gateway in the associated VPC. If you select Single-tunnel, you need to specify only one vSwitch. If you select Dual-tunnel, you need to specify two vSwitches. After the IPsec-VPN feature is enabled, the system creates an elastic network interface (ENI) for each of the two vSwitches as an interface to communicate with the VPC over an IPsec-VPN connection. Each ENI occupies one IP address in the vSwitch. Note By default, the system selects a vSwitch. You can change or use the default vSwitch. After a VPN gateway is created, you cannot modify the vSwitch associated with the VPN gateway. You can view the vSwitch associated with the VPN gateway, the zone to which the vSwitch belongs, and the ENI in the vSwitch on the details page of the VPN gateway.	Select a vSwitch in the associated VPC.
      vSwitch 2	The other vSwitch with which you want to associate the VPN gateway in the associated VPC. Specify two vSwitches in different zones in the associated VPC to implement disaster recovery across zones for IPsec-VPN connections. For a region that supports only one zone, disaster recovery across zones is not supported. We recommend that you specify two vSwitches in the zone to implement high availability of IPsec-VPN connections. You can also select the same vSwitch as the first one. Note If only one vSwitch is deployed in the VPC, create a vSwitch. For more information, see Create and manage a vSwitch.	Select another vSwitch in the associated VPC.
      IPsec-VPN	Specifies whether to enable IPsec-VPN for the VPN gateway. Default value: Enable.	Select Enable.
      SSL-VPN	Specifies whether to enable SSL-VPN for the VPN gateway. Default value: Disable.	Select Disable.

   5. After the VPN gateway is created, view the VPN gateway on the VPN Gateway page.

      The newly created VPN gateway is in the Preparing state and changes to the Normal state after about 1 to 5 minutes. After the status changes to Normal, the VPN gateway is ready for use.

      The following table describes the two IP addresses assigned by the system to the VPN gateway.

      VPN gateway name	VPN gateway ID	IP address
      VPN Gateway	vpn-gw8dickm386d2qi2g****	IPsec address 1: 8.XX.XX.130, which is the IP address of the active tunnel by default.
      		IPsec address 2: 47.XX.XX.27, which is the IP address of the standby tunnel by default.

Step 2: Deploy VPN resources on Azure

To establish an IPsec-VPN connection between the Azure VPC and the Alibaba Cloud VPC, you must deploy VPN resources on Azure based on the following instructions. For more information, see Azure.

1. Create a gateway subnet in the virtual network. The subnet is required when you create a virtual network gateway.

   

2. Create a virtual network gateway.

   You must associate the virtual network gateway with the virtual network that needs to communicate with Alibaba Cloud. In this example, you must enable the active-active mode for the virtual network gateway and create two public IP addresses. Use the default values for other parameters.

   After the virtual network gateway is created, you can view the public IP addresses assigned by the system to the virtual network gateway on the Public IP addresses page. In this example, the public IP addresses assigned by the system are 4.XX.XX.224 and 4.XX.XX.166.

3. Create local network gateways.

   You must create two local network gateways on Azure. Each local network gateway must be configured with one IP address of the Alibaba Cloud VPN gateway. In addition, you must specify the CIDR block of the Alibaba Cloud VPC and the CIDR block 100.104.0.0/16 on each local network gateway.

   Note

   When you create a local network gateway, you must specify the CIDR block 100.104.0.0/16. DTS uses IP addresses in this CIDR block to migrate data.

   

4. Create Site-to-Site VPN connections.

   Important

   Both Alibaba Cloud and Azure IPsec-VPN connections support the dual-tunnel mode. By default, the two tunnels of an Azure IPsec-VPN connection are associated with the same local network gateway, and the two tunnels of an Alibaba Cloud IPsec-VPN connection have different IP addresses. Therefore, the two tunnels of Azure are connected to only one tunnel of Alibaba Cloud. To ensure that the two tunnels of the Alibaba Cloud IPsec-VPN connection are enabled at the same time, you must create two Site-to-Site VPN connections on Azure and associate the Site-to-Site VPN connections with different local network gateways.

   The following figure shows the configurations of one of the Site-to-Site VPN connections. When you create the VPN connection, select Site-to-site (IPsec) for the Connection type parameter and associate the VPN connection with the virtual network gateway that needs to establish a VPN connection with Alibaba Cloud. Then, select a local network gateway and specify the shared key. Use the default values for other parameters. Specify a different local network gateway for the other Site-to-Site VPN connection. Use the same values for other parameters.

   

Step 3: Deploy the VPN gateway on Alibaba Cloud

After you configure VPN resources on Azure, deploy a VPN gateway on Alibaba Cloud based on the following information to establish an IPsec-VPN connection between the Azure virtual network and the Alibaba Cloud VPC.

1. Creates customer gateways.

   1. Log on to the VPN Gateway console.

   2. In the left-side navigation pane, choose Interconnections > VPN > Customer Gateways.

   3. In the top navigation bar, select the region in which you want to create the customer gateway.

      Make sure that the customer gateway and the VPN gateway to be connected are deployed in the same region.

   4. On the Customer Gateways page, click Create Customer Gateway.

   5. In the Create Customer Gateway panel, configure the following parameters and click OK.

      You must create two customer gateways and use the two public IP addresses of the Azure virtual network gateway as customer gateway IP addresses to establish two encrypted tunnels. The following table describes only the parameters that are relevant to this topic. You can use the default values for other parameters or leave them empty. For more information, see Create and manage a customer gateway.

      Parameter	Description	Customer Gateway 1	Customer Gateway 2
      Name	The name of the customer gateway.	Enter Customer Gateway 1.	Enter Customer Gateway 2.
      IP Address	The public IP address of the Azure virtual network gateway.	Enter 4.XX.XX.224.	Enter 4.XX.XX.166.

2. Create an IPsec-VPN connection.

   1. In the left-side navigation pane, choose Interconnections > VPN > IPsec Connections.

   2. In the top navigation bar, select the region in which you want to create the IPsec-VPN connection.

      Make sure that the IPsec-VPN connection and the VPN gateway are in the same region.

   3. On the IPsec Connections page, click Create IPsec-VPN Connection.

   4. On the Create IPsec-VPN Connection page, configure the IPsec-VPN connection based on the following information and click OK.

      Parameter	Description	Example
      Name	The name of the IPsec-VPN connection.	Enter IPsec-VPN Connection.
      Resource Group	The resource group to which the VPN gateway belongs.	Select the default resource group.
      Associate Resource	The type of the network resource that you want to associate with the IPsec-VPN connection.	Select VPN Gateway.
      VPN Gateway	The VPN gateway that you want to associate with the IPsec-VPN connection.	Select the VPN gateway that you created.
      Routing Mode	The routing mode of the traffic. Valid values: Destination Routing Mode: forwards traffic based on the destination IP address. Protected Data Flows: forwards traffic based on the source and destination IP addresses.	Select Protected Data Flows.
      Local Network	The CIDR block of the VPC with which the VPN gateway is associated.	In this example, enter the following two CIDR blocks: CIDR block of the VPC: 10.0.0.0/16 CIDR block of DTS servers: 100.104.0.0/16 Important You must add the CIDR block used by DTS to the local CIDR block. This way, DTS can access the peer database by using the VPN gateway. For more information about the CIDR blocks used by DTS, see Add the CIDR blocks of DTS servers.
      Remote Network	The peer CIDR block that the VPC associated with the VPN gateway wants to access.	Enter 192.168.0.0/16.
      Effective Immediately	Specifies whether to immediately start negotiations for the connection. Valid values: Yes: starts negotiations after the configuration is complete. No: starts negotiations when inbound traffic is detected.	Select Yes.
      Enable BGP	Specifies whether to enable Border Gateway Protocol (BGP). If you want to use BGP routing for the IPsec-VPN connection, turn on Enable BGP. By default, Enable BGP is turned off.	Turn off Enable BGP.
      Tunnel 1	Configure VPN parameters for the active tunnel. By default, Tunnel 1 serves as the active tunnel and Tunnel 2 serves as the standby tunnel. You cannot modify this configuration.
      Customer Gateway	The customer gateway that you want to associate with the active tunnel.	Select Customer Gateway 1.
      Pre-Shared Key	The pre-shared key of the active tunnel that is used to verify identities. The pre-shared key must be 1 to 100 characters in length, and can contain digits, letters, and the following characters: ~ ` ! @ # $ % ^ & * ( ) _ - + = { } [ ] \ | ; : ' , . < > / ? If you do not specify a pre-shared key, the system generates a random 16-character string as the pre-shared key. Important The tunnel and the peer gateway device must use the same pre-shared key. Otherwise, the system cannot establish an IPsec-VPN connection.	Use the same pre-shared key as the key of the Azure tunnel to be connected.
      Encryption Configuration	Configure the parameters for the Internet Key Exchange (IKE), IPsec, dead peer detection (DPD), and NAT traversal features.	Use the default encryption settings. For more information, see Create and manage IPsec-VPN connections in dual-tunnel mode.
      Tunnel 2	Configure VPN parameters for the standby tunnel.
      Customer Gateway	The customer gateway that you want to associate with the standby tunnel.	Select Customer Gateway 2.
      Pre-Shared Key	The pre-shared key of the standby tunnel that is used to verify identities.	Use the same pre-shared key as the key of the Azure tunnel to be connected.
      Encryption Configuration	Configure the parameters for the IKE, IPsec, DPD, and NAT traversal features.	Use the default encryption settings. For more information, see Create and manage IPsec-VPN connections in dual-tunnel mode.
      Tags	The tags of the IPsec-VPN connection.	Leave this parameter empty.

   5. In the Created message, click OK.

3. Advertise the route of the VPN gateway.

   After you create the IPsec-VPN connection, you must advertise the route of the VPN gateway. If you select Protected Data Flows as Routing Mode, the system creates a policy-based route for the VPN gateway after the IPsec-VPN connection is created. The route is in the Unpublished state. You must advertise the policy-based route of the VPN gateway to the VPC.

   1. In the left-side navigation pane, choose Interconnections > VPN > VPN Gateways.

   2. In the top navigation bar, select the region in which the VPN gateway resides.

   3. On the VPN Gateways page, find the VPN gateway that you want to manage and click its ID.

   4. On the details page of the VPN gateway, click the Policy-based Route Table tab, find the route that you want to manage, and then click Advertise in the Actions column.

   5. In the Advertise Route message, click OK.