Help Center> Virtual Private Network> Getting Started> Configuring Enterprise Edition VPN to Connect an On-premises Data Center and a VPC> Overview
Updated on 2023-03-07 GMT+08:00
View PDF

Overview

Supported Regions

AP-Bangkok, CN-Hong Kong, AP-Singapore, AP-Jakarta, TR-Istanbul, and LA-Mexico City2

Scenario

To meet business development requirements, enterprise A needs to implement communication between its on-premises data center and its VPC. In this case, enterprise A can use the VPN service to create connections between the on-premises data center and the VPC, as shown in Figure 1.

Figure 1 VPN networking

This solution has the following requirements on the on-premises data center and customer gateway device:

  • The customer gateway device must support standard IKE and IPsec protocols.
  • The customer gateway has a static public IP address.
  • The on-premises data center subnets that need to access the VPC do not contain 100.64.0.0/10 or overlap with the VPC subnets.

    If the VPC uses Direct Cloud or Cloud Connect connections to communicate with other VPCs, the on-premises data center subnets cannot overlap with those of these VPCs.

Data Plan

Table 1 Data plan

Category

Item

Data

VPC

Subnet that needs to access the on-premises data center

192.168.0.0/16

VPN gateway

Interconnection subnet

This subnet is used by the VPN gateway for interconnection with the VPC, which cannot overlap with the VPC subnets in use.

192.168.2.0/24

EIP

EIPs are automatically generated when you buy them. By default, a VPN gateway uses two EIPs. In this example, the EIPs are as follows:

  • Active EIP: 11.xx.xx.11
  • Standby EIP: 11.xx.xx.12

VPN connection

Tunnel interface address

This address is used by a VPN gateway to establish an IPsec tunnel with a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.

  • VPN connection 1: 169.254.70.1/30
  • VPN connection 2: 169.254.71.1/30

On-premises data center

Subnet that needs to access the VPC

172.16.0.0/16

Customer gateway

Public IP address

This public IP address is assigned by a carrier. In this example, the public IP address is:

22.xx.xx.22

Tunnel interface address
  • VPN connection 1: 169.254.70.2/30
  • VPN connection 2: 169.254.71.2/30

Operation Process

Figure 2 shows the process of using the VPN service to enable communication between an on-premises data center and a VPC.

Figure 2 Operation process
Table 2 Operation process description

No.

Step

Description

1

Step 1: Creating a VPN Gateway

Bind two EIPs to the VPN gateway.

If you have purchased EIPs, you can directly bind them to the VPN gateway.

2

Step 2: Creating a Customer Gateway

Configure the VPN device in the on-premises data center as the customer gateway.

3

Step 3: Creating VPN Connection 1

Create a VPN connection between the active EIP of the VPN gateway and the customer gateway.

4

Step 4: Creating VPN Connection 2

Create a VPN connection between the standby EIP of the VPN gateway and the customer gateway.

It is recommended that the routing mode, PSK, IKE policy, and IPsec policy settings of the two VPN connections be the same.

5

Step 5: Configuring the Customer Gateway Device
  • The local and remote interface addresses configured on the customer gateway device must be the same as the customer and local interface addresses of the Huawei Cloud VPN connection, respectively.
  • The routing mode, PSK, IKE policy, and IPsec policy settings on the customer gateway device must be same as those of the Huawei Cloud VPN connection.

6

Step 6: Verifying Network Connectivity

Log in to an ECS and run the ping command to verify the network connectivity.