Planning Networks and Resources

VPC

Subnet that needs to access the on-premises data center

• 192.168.0.0/24
• 192.168.1.0/24

VPN gateway

Interconnection subnet

This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

192.168.2.0/24

HA mode

Active/Standby

EIP

EIPs are automatically generated when you buy them. By default, a VPN gateway uses two EIPs. In this example, the EIPs are as follows:

• Active EIP: 1.1.1.2
• Standby EIP: 2.2.2.2

VPN connection

Tunnel interface addresses under Connection 1's Configuration

IP addresses used to establish an IPsec tunnel between a VPN gateway and a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.

• Local tunnel interface address: 169.254.70.1/30
• Customer tunnel interface address: 169.254.70.2/30

Tunnel interface addresses under Connection 2's Configuration

• Local tunnel interface address: 169.254.71.1/30
• Customer tunnel interface address: 169.254.71.2/30

On-premises data center

Subnet that needs to access the VPC

172.16.0.0/16

Customer gateway

Public IP address

This public IP address is assigned by a carrier. In this example, the public IP addresses are as follows:

• 1.1.1.1
• 2.2.2.1

IKE and IPsec policies

PSK

Test@123

IKE policy

• Version: v2
• Authentication algorithm: SHA2-256
• Encryption algorithm: AES-128
• DH algorithm: Group 15
• Lifetime (s): 86400
• Local ID: IP address
• Peer ID: IP address

IPsec policy

• Authentication algorithm: SHA2-256
• Encryption algorithm: AES-128
• PFS: DH Group15
• Transfer protocol: ESP
• Lifetime (s): 3600