Configuration on the Cloud Console

Prerequisites

A VPC and its subnets have been created on the management console.

Procedure

Create a VPN gateway.

Choose Virtual Private Network > Enterprise – VPN Gateways, and click Buy VPN Gateway.

Set parameters as prompted and click Next.

Table 1 only describes the key parameters for creating a VPN gateway. For other parameters, use their default settings.

**Table 1** VPN gateway parameters
Parameter	Description	Value
Name	Name of a VPN gateway.	vpngw-001
Associate With	Select VPC.	VPC
VPC	VPC that the on-premises data center needs to access.	vpc-001(192.168.0.0/16)
Interconnection Subnet	Subnet used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.	192.168.2.0/24
Local Subnet	VPC subnets that the on-premises data center needs to access.	192.168.0.0/24,192.168.1.0/24
BGP ASN	BGP AS number.	64512
HA Mode	Working mode of the VPN gateway.	Active-active
Active EIP	EIP 1 used by the VPN gateway to access the on-premises data center.	1.1.1.2
Active EIP 2	EIP 2 used by the VPN gateway to access the on-premises data center.	2.2.2.2

Create a customer gateway, that is, an AR router.

Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.

Set parameters as prompted.

Table 2 only describes the key parameters for creating a customer gateway.

**Table 2** Customer gateway parameters
Parameter	Description	Value
Name	Enter the name of a customer gateway.	cgw-ar
Identifier	Select IP Address, and enter the public IP address of the AR router.	IP Address 1.1.1.1

Create VPN connections.

In this scenario, a VPN connection is created between the AR router and each of the active EIP and active EIP 2 of the VPN gateway.

Choose Virtual Private Network > Enterprise – VPN Connections, and click Buy VPN Connection.

Create VPN connection 1.

Table 3 only describes the key parameters for creating a VPN connection.

**Table 3** Parameter settings for VPN connection 1
Parameter	Description	Value
Name	Name of a VPN connection.	vpn-001
VPN Gateway	VPN gateway for which the VPN connection is created.	vpngw-001
Gateway IP Address	Active EIP bound to the VPN gateway.	1.1.1.2
Customer Gateway	Name of a customer gateway.	cgw-ar
VPN Type	Select Policy-based.	Policy-based
Customer Subnet	Customer-side subnet that needs to access the VPC on the cloud through VPN connections. A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached. Reserved VPC CIDR blocks such as 100.64.0.0/10 and 214.0.0.0/8 cannot be used as customer subnets.	172.16.0.0/16
PSK, Confirm PSK	The value must be the same as the PSK configured on the AR router.	Set this parameter based on the site requirements.
Policy	Defines the data flow that enters the encrypted VPN tunnel between the local and customer subnets. You need to configure the source and destination CIDR blocks in each policy rule. Source CIDR Block The source CIDR block must contain some CIDR blocks of the local subnets, that is, subnets of the VPC. 0.0.0.0/0 indicates any IP address. Destination CIDR Block The destination CIDR block must contain all the CIDR blocks of the customer subnets, that is, subnets of the on-premises data center.	Source CIDR block 1: 192.168.0.0/24 Destination CIDR block 1: 172.16.0.0/16 Source CIDR block 2: 192.168.1.0/24 Destination CIDR block 2: 172.16.0.0/16
Policy Settings	The policy settings must be the same as those on the AR router.	IKE Policy Version: v2 Authentication Algorithm: SHA2-256 Encryption Algorithm: AES-128 DH Algorithm: Group 14 Lifetime (s): 86400 Local ID: IP Address Customer ID: IP Address IPsec Policy Authentication Algorithm: SHA2-256 Encryption Algorithm: AES-128 PFS: DH group 14 Transfer Protocol: ESP Lifetime (s): 3600