Help Center> Virtual Private Network> Best Practices> Connecting Multiple On-premises Branch Networks Through a VPN Hub> Planning Networks and Resources
Updated on 2023-10-23 GMT+08:00
View PDF

Planning Networks and Resources

Data Plan

Table 1 Data plan

Category

Item

Data

VPC

Subnet that needs to access the on-premises data centers
  • 192.168.0.0/24
  • 192.168.1.0/24

VPN gateway

Interconnection subnet

This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

192.168.2.0/24

HA Mode

Active-active

EIP

EIPs are automatically generated when you buy them. By default, a VPN gateway uses two EIPs. In this example, the EIPs are as follows:

  • Active EIP: 1.1.1.2
  • Active EIP 2: 2.2.2.2

VPN connection

Tunnel interface address

This address is used by a VPN gateway to establish an IPsec tunnel with a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.

  • VPN connections set up with on-premises data center 1
    • VPN connection 1: 169.254.70.1/30
    • VPN connection 2: 169.254.71.1/30
  • VPN connections set up with on-premises data center 2
    • VPN connection 3: 169.254.72.1/30
    • VPN connection 4: 169.254.73.1/30

On-premises data center 1

Subnet that needs to access the VPC

172.16.0.0/16

Customer gateway in on-premises data center 1

Public IP address

This public IP address is assigned by a carrier. In this example, the public IP address is:

1.1.1.1

Tunnel interface address
  • VPN connection 1: 169.254.70.2/30
  • VPN connection 2: 169.254.71.2/30

On-premises data center 2

Subnet that needs to access the VPC

10.10.0.0/16

Customer gateway in on-premises data center 2

Public IP address

This public IP address is assigned by a carrier. In this example, the public IP address is:

2.2.2.1

Tunnel interface address
  • VPN connection 3: 169.254.72.2/30
  • VPN connection 4: 169.254.73.2/30

IKE and IPsec policies

PSK

Test@123

IKE policy
  • Authentication algorithm: SHA2-256
  • Encryption algorithm: AES-128
  • DH algorithm: Group 15
  • Version: v2
  • Lifetime (s): 86400
  • Local ID: IP address
  • Peer ID: IP address

IPsec policy
  • Authentication algorithm: SHA2-256
  • Encryption algorithm: AES-128
  • PFS: DH Group15
  • Transfer protocol: ESP
  • Lifetime (s): 3600