Help Center> Virtual Private Network> Best Practices> Using VPN to Encrypt Data over Direct Connect Lines> Configuring VPN
Updated on 2023-10-23 GMT+08:00
View PDF

Configuring VPN

Prerequisites

  • Cloud side
    • A VPC has been created. For details about how to create a VPC, see Creating a VPC and Subnet.
    • Security group rules have been configured for the VPC, and ECSs can communicate with other devices on the cloud. For details about how to configure security group rules, see Security Group Rules.
    • An enterprise router has been created if you want to use it to connect to a VPN gateway. For details, see the enterprise router documentation.
  • Data center side
    • IPsec has been configured on the VPN device in the on-premises data center. For details, see Administrator Guide.

Procedure

Huawei Cloud VPNs support static routing mode, BGP routing mode, and policy-based mode. The following uses the static routing mode as an example.

  1. Log in to the Huawei Cloud console.
  2. Click Service List and choose Networking > Virtual Private Network.
  3. Configure a VPN gateway.

    1. Choose Virtual Private Network > Enterprise – VPN Gateways, and click Buy VPN Gateway.
    2. Set parameters as prompted.

      Table 1 only describes the key parameters for creating a VPN gateway.

      Table 1 Description of VPN gateway parameters

      Parameter

      Description

      Value

      Name

      Name of a VPN gateway.

      vpngw-001

      Network Type

      Select Private network.

      Private network

      Associate With

      Select VPC.

      If the VPN gateway is associated with an enterprise router, select Enterprise Router.

      VPC

      Enterprise Router

      Specify the associated enterprise router only when Associate With is set to Enterprise Router.

      er-001

      VPC

      Select the VPC where the subnet to be accessed by the on-premises data center is located.

      vpc-001(192.168.0.0/16)

      Interconnection Subnet

      This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

      192.168.2.0/24

      Local Subnet

      This parameter is available only when Associate With is set to VPC.

      • Enter CIDR block

        Enter the subnet that needs to access the on-premises data center. The subnet can belong to the associated VPC or not.

      • Select subnet

        Select a subnet that belongs to the associated VPC and needs to access the on-premises data center.

      192.168.0.0/24,192.168.1.0/24

      HA Mode

      Select Active-active.

      Active-active

      Advanced Settings

      Advanced settings are available only when Associate With is set to VPC and Network Type is set to Private network.

      -

      Access VPC
      • Same as the associated VPC

        Use the VPC associated with the VPN gateway as the access VPC.

      • Another VPC

        Select another VPC as the access VPC.

      Same as the associated VPC

      Access Subnet
      • When Access VPC is set to Same as the associated VPC:
        • Same as the interconnection subnet

          The private IP addresses of the VPN gateway are assigned from the interconnection subnet. The access subnet and interconnection subnet each require two IP addresses. As such, ensure that the access subnet has four or more available IP addresses.

        • Another subnet

          Ensure that the access subnet has two or more available IP addresses.

      • When Access VPC is set to a specific VPC:

        Ensure that the selected access subnet has two or more available IP addresses.

      Same as the interconnection subnet

      Gateway IP Address

      Select Manually-specified IP address and specify gateway IP addresses.
      • Private IP address 1: 192.168.2.100
      • Private IP address 2: 192.168.2.101

  4. Configure a customer gateway.

    1. Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.
    2. Set parameters as prompted.

      Table 2 only describes the key parameters for creating a customer gateway.

      Table 2 Description of customer gateway parameters

      Parameter

      Description

      Value

      Name

      Name of a customer gateway.

      cgw-fw

      Routing Mode

      Select Static.

      Static

      Gateway IP Address

      IP address used by the customer gateway to communicate with the Huawei Cloud VPN gateway.

      Ensure that UDP port 4500 is permitted on the customer gateway device in the on-premises data center.

      172.16.0.111

  5. Configure VPN connections.

    1. Choose Virtual Private Network > Enterprise – VPN Connections, and click Buy VPN Connection.
    2. Set parameters for VPN connection 1 and click Submit.

      Table 3 only describes the key parameters for creating a VPN connection.

      Table 3 Parameter settings for VPN connection 1

      Parameter

      Description

      Value

      Name

      Name of a VPN connection.

      vpn-001

      VPN Gateway

      VPN gateway for which the VPN connection is created.

      vpngw-001

      Gateway IP Address

      Private IP address bound to the VPN gateway.

      192.168.2.100

      Customer Gateway

      Name of a customer gateway.

      cgw-fw

      VPN Type

      Select Static routing.

      Static routing

      Customer Subnet

      Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud.

      • A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached.
      • Reserved VPC CIDR blocks such as 100.64.0.0/10 and 214.0.0.0/8 cannot be used as customer subnets.

      172.16.0.0/16

      Interface IP Address Assignment
      • Manually specify

        In this example, select Manually specify.

      • Automatically assign

      Manually specify

      Local Tunnel Interface IP Address

      Tunnel interface IP address configured on the VPN gateway.

      169.254.70.1

      Customer Tunnel Interface IP Address

      Tunnel interface IP address configured on the customer gateway device.

      169.254.70.2

      PSK, Confirm PSK

      The value must be the same as the PSK configured on the customer gateway device.

      Test@123

      Policy Settings

      The policy settings must be the same as those on the customer gateway device.

      Default
    3. Create VPN connection 2.

      For VPN connection 2, you are advised to use the same parameter settings as VPN connection 1, except the parameters listed in the following table.

      Table 4 Parameter settings for VPN connection 2

      Parameter

      Description

      Value

      Name

      Name of a VPN connection.

      vpn-002

      Gateway IP Address

      Another private IP address bound to the VPN gateway.

      192.168.2.101

      Local Tunnel Interface IP Address

      Tunnel IP address of the VPN gateway.

      169.254.71.1

      Customer Tunnel Interface IP Address

      Tunnel IP address of the customer gateway.

      169.254.71.2

  6. Configure the customer gateway device.

    The configuration procedures may vary according to the type of the customer gateway device. For details, see Administrator Guide.