Creating a VPN Gateway
Scenario
To connect your on-premises data center or private network to your ECSs in a VPC, you need to create a VPN gateway before creating a VPN connection.
Context
Number of Customer Gateway IP Addresses |
Recommended Networking |
Description |
---|---|---|
1 |
|
It is recommended that the VPN gateway uses the active-active mode. In this case, one VPN connection group is used. |
2 |
|
It is recommended that the VPN gateway uses the active/standby mode. In this case, two VPN connection groups are used. |
- If your on-premises data center has only one customer gateway configured with only one IP address, it is recommended that the VPN gateway uses the active-active mode. In this mode, you need to create a VPN connection between each of the active EIP and active EIP 2 of the VPN gateway and the IP address of the customer gateway. In this scenario, only one VPN connection group is used.
- If your on-premises data center has two customer gateways or one customer gateway configured with two IP addresses, it is recommended that the VPN gateway uses the active/standby mode. In this mode, you need to create a VPN connection with each of the customer gateway IP addresses using the active and standby EIPs of the VPN gateway. In this scenario, two VPN connection groups are used.
Notes and Constraints
- A VPN gateway of a non-GM specification cannot be changed to a VPN gateway of the GM specification.
- When an enterprise router is associated, pay attention to the upper limit of entries in the routing table of the enterprise router.
- When creating a VPN gateway, you can create two EIPs with the same shared bandwidth.
- Access via non-fixed IP addresses is available only for some regions. This function is supported only when Billing Mode is set to Yearly/Monthly and Network Type is set to Public network.
- The HomeZones feature is available only for some regions, which is subject to the actual pages on the management console.
Prerequisites
- A VPC has been created. For details about how to create a VPC, see Creating a VPC and Subnet.
- Security group rules have been configured for the VPC, and ECSs can communicate with other devices on the cloud. For details about how to configure security group rules, see Security Group Rules.
- An enterprise router has been created if you want to use it to connect to a VPN gateway. For details, see the enterprise router documentation.
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- Click the S2C VPN Gateways tab.
- Click Buy S2C VPN Gateway.
- Set parameters as prompted and click Next.
Table 2 lists the VPN gateway parameters.
Table 2 Description of VPN gateway parameters Parameter
Description
Example Value
Billing Mode
- Yearly/Monthly: You are billed by month or year when creating a VPN gateway. By default, 10 VPN connection groups are included free of charge with the purchase of a VPN gateway.
- Pay-per-use: VPN gateways and VPN connection groups are billed by usage duration, and the billing cycle is 1 hour.
Yearly/Monthly
Pay-per-use
Region
For low network latency and fast resource access, select the region nearest to your target users.
Resources cannot be shared across regions.
AP-Singapore
AZ
An AZ is a geographic location with independent power supply and network facilities in a region. AZs in the same VPC are interconnected through private networks and are physically isolated. You are advised to select an AZ type based on the AZs where resources in the VPC are located. The following types of AZs are supported:
- General
- HomeZones
Set this parameter based on the site requirements.
Name
Name of a VPN gateway. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
vpngw-001
Network Type
- Public network: A VPN gateway establishes VPN connections through the Internet.
- Private network: A VPN gateway establishes VPN connections through a private network.
Public network
Protocol Type
The value can be IPv4 or IPv6.
IPv4
Associate With
- VPC
Through a VPC, the VPN gateway sends messages to the customer gateway or servers in the local subnet.
- Enterprise Router
Through an enterprise router, the VPN gateway sends messages to the customer gateway or servers in the subnets of all VPCs connected to the enterprise router.
NOTE:In this scenario, pay attention to the upper limit of entries in the routing table of the enterprise router. If the number of routes advertised by the customer gateway and VPN gateway exceeds this upper limit, the enterprise router cannot learn the excess routes. As a result, traffic will fail to be forwarded between the VPN gateway and the customer gateway.
VPC
VPC
This parameter is available only when Associate With is set to VPC.
Select a VPC.
vpc-001(192.168.0.0/16)
Enterprise Router
This parameter is available only when Associate With is set to Enterprise Router.
Select an enterprise router.
er-001
Interconnection Subnet
This parameter is available only when Associate With is set to VPC.
This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.
192.168.66.0/24
Local Subnet
This parameter is available only when Associate With is set to VPC.
Specify the VPC subnets with which your on-premises data center needs to communicate through the customer gateway.
192.168.1.0/24,192.168.2.0/24
BGP ASN
BGP ASN of the VPN gateway, which must be different from that of the customer gateway.
64512
HA Mode
- Active-active
- When Associate With is set to VPC, the outgoing traffic from the VPN gateway to the customer subnet is preferentially forwarded through the first VPN connection (VPN connection 1) set up between the customer subnet and an EIP. If VPN connection 1 fails, the outgoing traffic is automatically switched to the other VPN connection (VPN connection 2) set up with the customer subnet. After VPN connection 1 recovers, the outgoing traffic is still transmitted through VPN connection 2 and will not be switched back to VPN connection 1.
- When Associate With is set to Enterprise Router, the outgoing traffic from the VPN gateway to the customer subnet is load balanced among all VPN connections set up with the customer subnet.
- Active/Standby
The outgoing traffic from the VPN gateway to the customer subnet is preferentially transmitted through the VPN connection (VPN connection 1) set up between the customer subnet and the active EIP. If VPN connection 1 fails, the outgoing traffic is automatically switched to the other VPN connection (VPN connection 2) set up between the customer subnet and the standby EIP. After VPN connection 1 recovers, the outgoing traffic is automatically switched back to VPN connection 1.
Active-active
Specification
Three options are available: Professional 1, Professional 2, and GM.
Professional 1 and Professional 2 support access via non-fixed IP addresses only when Billing Mode is Yearly/Monthly and Network Type is set to Public network.
For details about differences between these specifications, see Specifications.
Professional 1
VPN Connection Groups
This parameter is available only when Billing Mode is set to Yearly/Monthly.
By default, 10 VPN connection groups are included free of charge with the purchase of a VPN gateway.
- If an on-premises data center has only one egress gateway, all servers or user hosts in the data center connect to the Internet through this gateway. In this case, you need to configure a VPN connection group consisting of two VPN connections. That is, configure a VPN connection for each of the two EIPs of the VPN gateway to communicate with the egress gateway in the on-premises data center.
- If an on-premises data center has two egress gateways, the servers or user hosts in the data center connect to the Internet through the two egress gateways. In this case, you need to configure two VPN connection groups, each of which consisting of two VPN connections. That is, configure a VPN connection for each of the two EIPs of each VPN gateway to communicate with both egress gateways in the on-premises data center.
10
Shared Bandwidth
- When Billing Mode is set to Yearly/Monthly, the shared bandwidth is enabled by default.
- When Billing Mode is set to Pay-per-use, the shared bandwidth is disabled by default.
Disabled
EIP Type
Select the type of the EIP to be bound to the VPN gateway.
For more information about EIP types, see What Is Elastic IP?.
Set this parameter based on the site requirements.
HomeZones
This parameter is available only when EIP Type is set to HomeZones.
Set this parameter based on the site requirements.
Bandwidth Name
This parameter is available only when Network Type is set to Public network.
Specify the name of the EIP bandwidth.
- Bandwidth (Mbit/s): 5
- When Shared Bandwidth is toggled on, you can select the name of the shared bandwidth.
- A maximum of 20 EIPs can be added to shared bandwidth. For details about how to apply for more quota, see Increasing the Quota.
Vpngw-bandwidth2
Active EIP
This parameter is available only when Network Type is set to Public network.
EIP used by the VPN gateway to communicate with a customer gateway.
- Create now: Buy a new EIP. The billing mode of the new EIP is the same as that of the VPN gateway.
NOTE:
When shared bandwidth is used, you can only use EIPs created now.
- Use existing: Use an existing EIP. This EIP can share bandwidth with the EIPs of other network services.
Create Now
Billed By
This parameter is available only when Billing Mode is set to Pay-per-use and Network Type is set to Public network.
Pay-per-use billing supports two billing modes:
- Bandwidth: You need to specify a bandwidth limit and pay for the amount of time you use the bandwidth.
- Traffic: You need to specify a bandwidth limit and pay for the outbound traffic sent from your VPC.
Traffic
Bandwidth (Mbit/s)
This parameter is available only when Network Type is set to Public network.
Bandwidth of the EIP, in Mbit/s.
- All VPN connections created using the EIP share the bandwidth of the EIP. The total bandwidth consumed by all the VPN connections cannot exceed the bandwidth of the EIP.
If network traffic exceeds the bandwidth of the EIP, network congestion may occur and VPN connections may be interrupted. As such, ensure that you configure enough bandwidth.
- You can configure alarm rules on Cloud Eye to monitor the bandwidth.
- You can customize the bandwidth within the allowed range.
- Some regions support only 300 Mbit/s bandwidth by default. If higher bandwidth is required, apply for 300 Mbit/s bandwidth and then submit a service ticket for capacity expansion.
10 Mbit/s
Active EIP 2
This parameter is available only when the Network Type is set to Public network and HA Mode is set to Active-active.
A VPN gateway needs to be bound to a group of EIPs (active EIP and active EIP 2). You can plan the bandwidth and billing mode for each EIP. The EIPs can share bandwidth with the EIPs of other network services.
NOTE:When shared bandwidth is used, you can only create an EIP now, and the EIP cannot be changed after being created.
Create Now
Standby EIP
This parameter is available only when the Network Type is set to Public network and HA Mode is set to Active/Standby.
A VPN gateway needs to be bound to a group of EIPs (active EIP and standby EIP). You can plan the bandwidth and billing mode for each EIP. The EIPs can share bandwidth with the EIPs of other network services.
NOTE:When Billing Mode of the VPN gateway is Pay-per-use and the backup EIP is billed by traffic, you are advised to configure alarm rules on Cloud Eye to monitor the backup EIP. This prevents traffic fee overrun caused by VPN connection switching due to a fault of the active VPN connection.
For details about how to configure alarm rules on Cloud Eye, see Creating an Alarm Rule.
Create Now
Enterprise Project
Enterprise project to which the VPN belongs.
An enterprise project facilitates project-level management and grouping of cloud resources and users. The default project is default.
For details about how to create and manage enterprise projects, see Enterprise Management User Guide.
default
Advanced Settings
Parameters under Advanced Settings are available only when Network Type is set to Private network and Associate With is set to VPC.
- Select: This option applies to the scenario where VPCs of the same tenant are connected. Select the access VPC, access subnet, and gateway IP address of the current tenant.
- Enter: This option applies to the scenario where a VPC of the current tenant is connected to that of another tenant. Enter the access project, access domain, access VPC, access subnet, and gateway IP address of the other tenant.
Select
Access Project
This parameter is available only when you select Enter for Advanced Settings.
Enter an access project ID. For details about how to obtain the project ID, see How Do I Obtain an Enterprise Project ID.
Set this parameter based on the site requirements.
Access Domain
This parameter is available only when you select Enter for Advanced Settings.
Enter an access domain ID. For details about how to obtain the domain ID, see Viewing or Modifying IAM User Information.
Set this parameter based on the site requirements.
Access VPC
- This parameter is available only when Associate With is set to Enterprise Router.
- This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.
If a VPN gateway needs to connect to different VPCs in the southbound and northbound directions, set the VPC in the northbound direction as the access VPC. The VPC in the southbound direction is the VPC associated with the VPN gateway.
Same as the associated VPC
Access Subnet
- This parameter is available only when Associate With is set to Enterprise Router.
- This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.
By default, a VPN gateway uses the interconnection subnet to connect to the associated VPC. Set this parameter when another subnet needs to be used.
Same as the interconnection subnet
Gateway IP Address
This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.
- Self-assigned IP address (default)
An IP address on the access subnet will be automatically assigned to the VPN gateway.
You can view the automatically assigned IP address on the VPN Gateways page.
- Manually-specified IP address
Manually configure IP addresses on the access subnet for the VPN gateway.
When you select Select for Advanced Settings, you can click View In-Use IP Address on the right to check the IP addresses in use. The refresh and fuzzy search functions are supported in the View In-Use IP Address dialog box.
When HA Mode is set to Active/Standby for the VPN gateway, enter the active and standby IP addresses in sequence. When HA Mode is set to Active-active for the VPN gateway, enter the active IP address and active IP address 2 in sequence.
Self-assigned IP address
Advanced Settings > Tags
Tag of a VPN resource. The value consists of a key and a value. A maximum of 20 tags can be added.
You can select predefined tags or customize tags.
To view predefined tags, click View predefined tags.
-
Required Duration
This parameter is available only when Billing Mode is set to Yearly/Monthly.
If your account balance is sufficient and you select Auto-renew, the system automatically renews your service when the required duration elapses.
- Monthly subscription: Your service is automatically renewed on a per-month basis.
- Yearly subscription: Your service is automatically renewed on a per-year basis.
6
- Confirm the order and click Pay Now.
- (Optional) For a VPN gateway of the GM specification, upload the VPN gateway certificate after the VPN gateway is created. Otherwise, the VPN gateway cannot set up a VPN connection.
For details, see Uploading Certificates for a VPN Gateway.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot