Help Center/ Virtual Private Network/ Best Practices/ Connecting an On-premises Data Center to a VPC on the Cloud Through VPN (Active-Active Mode)/ Planning Networks and Resources
Updated on 2023-10-20 GMT+08:00
View PDF

Planning Networks and Resources

Data Plan

Table 1 Data plan

Category

Item

Data

VPC

Subnet that needs to access the on-premises data center
  • 192.168.0.0/24
  • 192.168.1.0/24

VPN gateway

Interconnection subnet

This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

192.168.2.0/24

HA mode

Active-active

EIP

EIPs are automatically generated when you buy them. By default, a VPN gateway uses two EIPs. In this example, the EIPs are as follows:

  • Active EIP: 1.1.1.2
  • Active EIP 2: 2.2.2.2

VPN connection

Tunnel interface address

This address is used by a VPN gateway to establish an IPsec tunnel with a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.

  • VPN connection 1: 169.254.70.1/30
  • VPN connection 2: 169.254.71.1/30

On-premises data center

Subnet that needs to access the VPC

172.16.0.0/16

Customer gateway

Public IP address

This public IP address is assigned by a carrier. In this example, the public IP address is:

1.1.1.1

Tunnel interface address
  • VPN connection 1: 169.254.70.2/30
  • VPN connection 2: 169.254.71.2/30

IKE and IPsec policies

PSK

Test@123

IKE policy
  • Version: v2
  • Authentication algorithm: SHA2-256
  • Encryption algorithm: AES-128
  • DH algorithm: Group 15
  • Lifetime (s): 86400
  • Local ID: IP address
  • Peer ID: IP address

IPsec policy
  • Authentication algorithm: SHA2-256
  • Encryption algorithm: AES-128
  • PFS: DH Group15
  • Transfer protocol: ESP
  • Lifetime (s): 3600