Help Center/ Virtual Private Network/ Getting Started/
Updated on 2024-12-03 GMT+08:00
View PDF
Share

Buying a VPN Gateway

Scenarios

To connect your on-premises data center or private network to your ECSs in a VPC, buy a VPN gateway first. If you choose to buy a pay-per-use VPN gateway, a VPN connection will be created together with the VPN gateway.

Prerequisites

  • A VPC has been created. For details about how to create a VPC, see Creating a VPC and Subnet.
  • Security group rules have been configured for the VPC, and ECSs can communicate with other devices on the cloud. For details about how to configure security group rules, see Security Group Rules.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner and select the desired region and project.
  3. Click Service List and choose Networking > Virtual Private Network.
  4. In the navigation pane on the left, choose Virtual Private Network > Classic – VPN Gateways.

    If Enterprise Edition VPN is available for the selected region, choose Virtual Private Network > Classic.

  5. On the VPN Gateways page, click Buy VPN Gateway.
  6. Configure parameters based on Table 1, and click Buy Now.
    Table 1 Description of VPN gateway parameters

    Parameter

    Description

    Example Value

    Billing Mode

    Billing mode of a VPN gateway, which can be pay-per-use

    Pay-per-use: When you buy a pay-per-use VPN gateway, you must buy a VPN connection together with the VPN gateway.

    Pay-per-use

    Region

    Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across regions. For low network latency and fast resource access, select the region nearest to your target users.

    AP-Singapore

    Name

    Name of a VPN gateway.

    vpngw-001

    VPC

    Name of the VPC to which the VPN gateway connects.

    vpc-001

    Type

    VPN type. IPsec is selected by default.

    IPsec

    Billed By

    A pay-per-use VPN gateway can be billed by bandwidth or by traffic.

    The billing modes available for a region are subject to those displayed on the page.

    • Bandwidth: You need to specify a bandwidth limit and pay for the amount of time you use the bandwidth.
    • Traffic: You need to specify a bandwidth limit and pay for the traffic you generate.

    Traffic

    Bandwidth (Mbit/s)

    The bandwidth of the VPN gateway. The bandwidth is shared by all VPN connections created for the VPN gateway. The total bandwidth size used by all VPN connections created for a VPN gateway cannot exceed the VPN gateway bandwidth size.

    During the use of VPN, if the network traffic exceeds the VPN gateway bandwidth, network congestion may occur and VPN connections may be interrupted. As such, ensure that you configure enough bandwidth.

    You can configure alarm rules on Cloud Eye to monitor the bandwidth.

    10

    When you buy a pay-per-use VPN gateway, you also need to configure a VPN connection that will be created together with the gateway (excepting the CN South-Shenzhen region). For details, see Table 2.

    Table 2 Description of VPN connection parameters

    Parameter

    Description

    Example Value

    Name

    Name of a VPN connection.

    vpn-001

    VPN Gateway

    Name of the VPN gateway for which the VPN connection is created.

    vpcgw-001

    Local Subnet

    VPC subnets that will access your on-premises network through a VPN. You can set the local subnet using either of the following methods:

    • Select subnet: Select the subnets that need to access your on-premises data center or private network.
    • Specify CIDR block: Enter the CIDR blocks that need to access your on-premises data center or private network.
      NOTE:

      CIDR blocks of local subnets cannot overlap.

    192.168.1.0/24,

    192.168.2.0/24

    Remote Gateway

    The public IP address of the gateway in your data center or on the private network. This IP address is used for communicating with your VPC.

    N/A

    Remote Subnet

    The subnets of your on-premises network that will access a VPC through a VPN. The remote and local subnets cannot overlap with each other. The remote subnet cannot overlap with CIDR blocks involved in existing VPC peering, Direct Connect, or Cloud Connect connections created for the local VPC.

    NOTE:

    CIDR blocks of remote subnets cannot overlap.

    192.168.3.0/24,

    192.168.4.0/24

    PSK

    PSKs configured at both ends of a VPN connection must be the same.

    The PSK:

    • Contains 6 to 128 characters.
    • Can contain only:
      • Digits
      • Letters
      • Special characters: ~ ` ! @ # $ % ^ ( ) - _ + = [ ] { } | \ , . / : ;

    Test@123

    Confirm PSK

    Enter the PSK again.

    Test@123

    Advanced Settings
    • Default: Use default IKE and IPsec policies.
    • Custom: Use custom IKE and IPsec policies. For details, see Table 3 and Table 4.

    Custom
    Table 3 IKE policy

    Parameter

    Description

    Example Value

    Authentication Algorithm

    Hash algorithm used for authentication. The following algorithms are supported:

    • MD5 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • SHA1 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • SHA2-256
    • SHA2-384
    • SHA2-512

    The default algorithm is SHA2-256.

    SHA2-256

    Encryption Algorithm

    Encryption algorithm. The following algorithms are supported:

    • AES-128
    • AES-192
    • AES-256
    • 3DES (This algorithm is insecure. Exercise caution when using this algorithm.)

    The default algorithm is AES-128.

    AES-128

    DH Algorithm

    Diffie-Hellman key exchange algorithm. The following algorithms are supported:

    • Group 1 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • Group 2 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • Group 5 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • Group 14
    • Group 15
    • Group 16
    • Group 19
    • Group 20
    • Group 21

    The default value is Group 14.

    DH algorithms configured at both ends of a VPN connection must be the same. Otherwise, the negotiation will fail.

    Group 14

    Version

    Version of the IKE protocol. The value can be one of the following:

    • v1 (not recommended due to security risks)
    • v2

    The default value is v2.

    v2

    Lifetime (s)

    Lifetime of an SA, in seconds

    An SA will be renegotiated when its lifetime expires.

    The default value is 86400.

    86400
    Table 4 IPsec policy

    Parameter

    Description

    Example Value

    Authentication Algorithm

    Hash algorithm used for authentication. The following algorithms are supported:

    • SHA1 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • MD5 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • SHA2-256
    • SHA2-384
    • SHA2-512

    The default algorithm is SHA2-256.

    SHA2-256

    Encryption Algorithm

    Encryption algorithm. The following algorithms are supported:

    • AES-128
    • AES-192
    • AES-256
    • 3DES (This algorithm is insecure. Exercise caution when using this algorithm.)

    The default algorithm is AES-128.

    AES-128

    PFS

    Algorithm used by the Perfect forward secrecy (PFS) function.

    PFS supports the following algorithms:

    • DH group 1 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • DH group 2 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • DH group 5 (This algorithm is insecure. Exercise caution when using this algorithm.)
    • DH group 14
    • DH group 15
    • DH group 16
    • DH group 19
    • DH group 20
    • DH group 21

    The default algorithm is DH group 14.

    DH group 14

    Transfer Protocol

    Security protocol used in IPsec to transmit and encapsulate user data. The following protocols are supported:

    • ESP
    • AH
    • AH-ESP

    The default protocol is ESP.

    ESP

    Lifetime (s)

    Lifetime of an SA, in seconds

    An SA will be renegotiated when its lifetime expires.

    The default value is 3600.

    3600

    The following algorithms are not recommended because they are not secure enough:

    Authentication algorithms: SHA1 and MD5

    Encryption algorithm: 3DES

    DH algorithms: Group 1, Group 2, and Group 5

  7. Confirm the VPN gateway information and click Buy Now.

    After a VPN gateway is created, the system automatically assigns a public IP address, that is, the IP address displayed in the Gateway IP Address column in the VPN gateway list. The gateway IP address is also the remote gateway IP address configured on the on-premises VPN network.