Modifying a VPN Connection

Scenario

A VPN connection is an encrypted communications channel established between a VPN gateway in a VPC and a customer gateway in your on-premises data center. You can modify a VPN connection when required.

Procedure

Log in to the management console.
Click in the upper left corner and select the desired region and project.
Click in the upper left corner, select a region, and choose Network > Virtual Private Network.
In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Connections.
On the VPN Connection page, locate the VPN connection to modify, and click Modify VPN Connection or Modify Policy Settings.
Modify VPN connection parameters as prompted.
For VPN connections in policy template mode, you can modify the policy settings on the VPN Gateways page, instead of on the VPN Connection page. For details, see Modifying the Policy Template of a VPN Gateway.
Click OK.

If you change the PSK or modify the IKE or IPsec policy of a VPN connection, ensure that the new configurations are consistent with those on the customer gateway. Otherwise, the VPN connection will be interrupted.

Only some of the parameters take effect immediately after being modified, as described in Table 1.

**Table 1** Time when new parameter settings take effect
Item	Parameter	When New Settings Take Effect	How to Modify
-	PSK	When IKEv1 is used, the new setting takes effect in the next negotiation period. When IKEv2 is used, the new setting takes effect after the VPN connection is re-established. NOTE: This parameter is not available for VPN connections set up using SM series cryptographic algorithms.	When IKEv1 is used: Locate the VPN connection to modify, choose More > Reset PSK on the right, and change the PSK as prompted. When IKEv2 is used: Delete the current VPN connection. Create a new VPN connection.
IKEv1 policy	Encryption Algorithm	The new settings take effect in the next negotiation period. NOTE: The following parameters cannot be modified for VPN connections set up using SM series cryptographic algorithms: Encryption Algorithm, Authentication Algorithm, and Negotiation Mode. The following parameters are not available for VPN connections set up using SM series cryptographic algorithms: DH Algorithm, Local ID, and Customer ID.	Locate the VPN connection to modify, and click Modify VPN Configuration.
	Authentication Algorithm
	DH Algorithm
	Negotiation Mode
	Local ID
	Customer ID
	Lifetime (s)
	Version	The new settings take effect immediately. NOTE: This parameter is not available for VPN connections set up using SM series cryptographic algorithms.
IKEv2 policy	Encryption Algorithm	The new settings take effect in the next negotiation period.	Locate the VPN connection to modify, and click Modify VPN Configuration.
	Authentication Algorithm
	DH Algorithm
	Lifetime (s)
	Version	The new settings take effect immediately.
	Local ID	The new settings take effect after the VPN connection is re-established.	Delete the current VPN connection. Create a new VPN connection.
	Customer ID
IPsec policy	Encryption Algorithm	The new settings take effect in the next negotiation period. NOTE: Encryption Algorithm and Authentication Algorithm cannot be modified for VPN connections set up using SM series cryptographic algorithms. The PFS parameter is not available for VPN connections set up using SM series cryptographic algorithms.	Locate the VPN connection to modify, and click Modify VPN Configuration.
	Authentication Algorithm
	PFS
	Lifetime (s)
	Transfer Protocol	This parameter cannot be modified on the management console.

Table 2 describes the parameters related to VPN connection modification.

**Table 2** Parameters related to VPN connection modification
Parameter	Description	Modifiable or Not
Name	Name of a VPN connection. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).	Y
Customer Gateway	Gateway used for communicating with a VPC through VPN.	Y
Customer Subnet	Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud.	Y
Policy Settings	There are IKE and IPsec policies.	Y
PSK	The PSKs configured for the VPN gateway and customer gateway must be the same.	Y
VPN Gateway	VPN gateway that has been created.	N
Gateway IP Address	IP address used by the customer gateway to communicate with the VPN gateway. The value must be a static address. Ensure that UDP port 4500 is permitted in a firewall rule on the customer gateway in your on-premises data center or private network.	N
Interface IP Address Assignment	Mode in which IP addresses of the local and customer interfaces are assigned. The options include Manually specify and Automatically assign.	N
Link Detection	This function is used for route reliability detection in multi-link scenarios. NOTE: When enabling this function, ensure that the customer gateway supports ICMP and is correctly configured with the customer interface IP address of the VPN connection. Otherwise, VPN traffic will fail to be forwarded.	N
Policy	The settings include the source and destination CIDR blocks.	N