Help Center/ Virtual Private Network/ User Guide/ Enterprise Edition VPN Gateway Management/ Creating a VPN Gateway
Updated on 2023-10-20 GMT+08:00
View PDF

Creating a VPN Gateway

Scenarios

To connect your on-premises data center or private network to your ECSs in a VPC, you need to create a VPN gateway before creating a VPN connection.

Context

The recommended networking varies according to the number of customer gateway IP addresses, as described in Table 1.
Table 1 Networking

Number of Customer Gateway IP Addresses

Recommended Networking

Description

1

It is recommended that the VPN gateway uses the active-active mode. In this case, one VPN connection group is used.

2

It is recommended that the VPN gateway uses the active-standby mode. In this case, two VPN connection groups are used.
  • If your on-premises data center has only one customer gateway configured with only one IP address, it is recommended that the VPN gateway uses the active-active mode. In this mode, you need to create a VPN connection between each of the active EIP and active EIP 2 of the VPN gateway and the IP address of the customer gateway. In this scenario, only one VPN connection group is used.
  • If your on-premises data center has two customer gateways or one customer gateway configured with two IP addresses, it is recommended that the VPN gateway uses the active-standby mode. In this mode, you need to create a VPN connection with each of the customer gateway IP addresses using the active and standby EIPs of the VPN gateway. In this scenario, two VPN connection groups are used.

Prerequisites

  • A VPC has been created. For details about how to create a VPC, see Creating a VPC and Subnet.
  • Security group rules have been configured for the VPC, and ECSs can communicate with other devices on the cloud. For details about how to configure security group rules, see Security Group Rules.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner and select the desired region and project.
  3. Click Service List and choose Networking > Virtual Private Network.
  4. In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Gateways.
  5. On the VPN Gateways page, click Buy VPN Gateway.
  6. Set parameters as prompted and click Next.

    Table 2 lists the VPN gateway parameters.

    Table 2 Description of VPN gateway parameters

    Parameter

    Description

    Example Value

    Billing Mode
    • Yearly/Monthly: You are billed by month or year when creating a VPN gateway. By default, 10 VPN connection groups are included free of charge with the purchase of a VPN gateway.
    • Pay-per-use: VPN gateways and VPN connection groups are billed by usage duration, and the billing cycle is 1 hour.

    Yearly/Monthly

    Region

    For low network latency and fast resource access, select the region nearest to your target users.

    Resources cannot be shared across regions.

    EU-Dublin

    Name

    Name of a VPN gateway.

    vpngw-001

    Network Type
    • Public network: A VPN gateway communicates with a customer gateway in an on-premises data center through the Internet.
    • Private network: A VPN gateway communicates with a customer gateway in an on-premises data center through a private network.

    Public network

    Associate With
    • VPC

      Through a VPC, the VPN gateway sends messages to the customer gateway or servers in the local subnet.

    VPC

    VPC

    Select a VPC.

    vpc-001(192.168.0.0/16)

    Interconnection Subnet

    This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

    192.168.66.0/24

    Local Subnet

    VPC subnets with which your on-premises data center needs to communicate through the customer gateway.

    • Select subnet

      Select subnets of the local VPC.

    • Enter CIDR block

      Enter subnets of the local VPC or subnets of the VPC that establishes a peering connection with the local VPC.

    192.168.1.0/24,192.168.2.0/24

    BGP ASN

    BGP ASN of the VPN gateway, which must be different from that of the customer gateway.

    64512

    Specification

    Forwarding bandwidth and maximum number of VPN connection groups supported by the VPN gateway.

    Two options are available: Professional 1 and Professional 2.

    Professional 1

    AZ

    An AZ is a geographic location with independent power supply and network facilities in a region. AZs in the same VPC are interconnected through private networks and are physically isolated.

    • If two or more AZs are available, select two AZs.

      The VPN gateway deployed in two AZs has higher availability. You are advised to select the AZs where resources in the VPC are located.

    • If only one AZ is available, select this AZ.

    AZ1, AZ2

    VPN Connection Groups

    This parameter is available only when Billing Mode is set to Yearly/Monthly.

    By default, 10 VPN connection groups are included free of charge with the purchase of a VPN gateway.

    • When the VPN gateway uses the active-active mode, only one VPN connection group is used.
    • When the VPN gateway uses the active-standby mode, two VPN connection groups are used.

    10

    HA Mode
    • Active-active: Both the active EIP and active EIP 2 establish a VPN connection with the customer gateway, but only one VPN connection is used for data transmission. When this VPN connection fails, traffic is switched to the other VPN connection.
    • Active-standby: Both the active and standby EIPs establish a VPN connection with the customer gateway. By default, traffic is transmitted only through the active link. If the active link fails, traffic is automatically switched to the standby link. After the active link recovers, traffic is switched back to the active link.

    Active-active

    Active EIP

    This parameter is available only when Network Type is set to Public network.

    EIP used by the VPN gateway to communicate with a customer gateway.

    • Create Now: Buy a new EIP. The billing mode of the new EIP is the same as that of the VPN gateway.
    • Use existing: Use an existing EIP. This EIP can share bandwidth with the EIPs of other network services.

    Create Now

    Billed By

    This parameter is available only when Billing Mode is set to Pay-per-use and Network Type is set to Public network.

    A pay-per-use VPN gateway can be billed by bandwidth or by traffic.

    • Bandwidth: You need to specify a bandwidth limit and pay for the amount of time you use the bandwidth.
    • Traffic: You need to specify a bandwidth limit and pay for the outbound traffic sent from your VPC.

    Traffic

    Bandwidth (Mbit/s)

    This parameter is available only when Network Type is set to Public network and Active EIP is set to Create Now.

    Bandwidth of the EIP, in Mbit/s.

    • All VPN connections created using the EIP share the bandwidth of the EIP. The total bandwidth consumed by all the VPN connections cannot exceed the bandwidth of the EIP.

      If network traffic exceeds the bandwidth of the EIP, network congestion may occur and VPN connections may be interrupted. As such, ensure that you configure enough bandwidth.

    • You can configure alarm rules on Cloud Eye to monitor the bandwidth.
    • You can customize the bandwidth within the allowed range.

    10 Mbit/s

    Bandwidth Name

    This parameter is available only when Network Type is set to Public network.

    EIP bandwidth name.

    Vpngw-bandwtidh1

    Active EIP 2

    This parameter is available only when the Network Type is set to Public network and HA Mode is set to Active-active.

    A VPN gateway needs to be bound to a group of EIPs (active EIP and active EIP 2). You can plan the bandwidth and billing mode for each EIP. The EIPs can share bandwidth with the EIPs of other network services.

    Create Now

    Standby EIP

    This parameter is available only when the Network Type is set to Public network and HA Mode is set to Active-standby.

    A VPN gateway needs to be bound to a group of EIPs (active EIP and standby EIP). You can plan the bandwidth and billing mode for each EIP. The EIPs can share bandwidth with the EIPs of other network services.

    Create Now

    Billed By

    This parameter is available only when Billing Mode is set to Pay-per-use and Network Type is set to Public network.

    A pay-per-use VPN gateway can be billed by bandwidth or by traffic.

    • Bandwidth: You need to specify a bandwidth limit and pay for the amount of time you use the bandwidth.
    • Traffic: You need to specify a bandwidth limit and pay for the outbound traffic sent from your VPC.

    Traffic

    Bandwidth (Mbit/s)

    This parameter is available only when Network Type is set to Public network and Active EIP 2 or Standby EIP is set to Create Now.

    Bandwidth of the EIP, in Mbit/s.

    • All VPN connections created using the EIP share the bandwidth of the EIP. The total bandwidth consumed by all the VPN connections cannot exceed the bandwidth of the EIP.

      If network traffic exceeds the bandwidth of the EIP, network congestion may occur and VPN connections may be interrupted. As such, ensure that you configure enough bandwidth.

    • You can configure alarm rules on Cloud Eye to monitor the bandwidth.
    • You can customize the bandwidth within the allowed range.

    10 Mbit/s

    Bandwidth Name

    This parameter is available only when Network Type is set to Public network.

    EIP bandwidth name.

    Vpngw-bandwtidh2

    Access VPC
    • This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.

    If a VPN gateway needs to connect to different VPCs in the southbound and northbound directions, set the VPC in the northbound direction as the access VPC. The VPC in the southbound direction is the VPC associated with the VPN gateway.

    Same as the associated VPC

    Access Subnet
    • This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.

    By default, a VPN gateway uses the interconnection subnet to connect to the associated VPC. Set this parameter when another subnet needs to be used.

    Same as the interconnection subnet

    Required Duration

    This parameter is available only when Billing Mode is set to Yearly/Monthly.

    If your account balance is sufficient and you select Auto-renew, the system automatically renews your service when the required duration elapses.

    • Monthly subscription: Your service is automatically renewed on a per-month basis.
    • Yearly subscription: Your service is automatically renewed on a per-year basis.

    6
  7. Confirm the order and click Pay Now.