Procedure

Cloud side
- A VPC has been created. For details about how to create a VPC, see Creating a VPC and Subnet.
- Security group rules have been configured for the VPC, and ECSs can communicate with other devices on the cloud. For details about how to configure security group rules, see Security Group Rules.
Data center side
- IPsec has been configured on the VPN device in the on-premises data center. For details, see Administrator Guide.

Huawei Cloud VPNs support static routing mode, BGP routing mode, and policy-based mode. The following uses the static routing mode as an example.

Configure a VPN gateway.

Choose Virtual Private Network > Enterprise – VPN Gateways, and click Buy VPN Gateway.

Set parameters as prompted.

Table 1 only describes the key parameters for creating a VPN gateway.

**Table 1** VPN gateway parameters
Parameter	Description	Value
Name	Name of a VPN gateway.	vpngw-001
Network Type	Select Public network.	Public network
Associate With	Select VPC. If the VPN gateway is associated with an enterprise router, select Enterprise Router.	VPC
VPC	Huawei Cloud VPC that the on-premises data center needs to access.	vpc-001(192.168.0.0/16)
Interconnection Subnet	This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.	192.168.2.0/24
Local Subnet	This parameter is available only when Associate With is set to VPC. Enter CIDR block Enter the subnet that needs to access the on-premises data center. The subnet can belong to the associated VPC or not. Select subnet Select a subnet that belongs to the associated VPC and needs to access the on-premises data center.	192.168.0.0/24,192.168.1.0/24
BGP ASN	BGP AS number.	64512
HA Mode	Select Active/Standby.	Active/Standby
Active EIP	Active EIP used by the VPN gateway to access the on-premises data center.	1.1.1.2
Standby EIP	Standby EIP used by the VPN gateway to access the on-premises data center.	2.2.2.2

Configure customer gateways.

Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.

Set parameters for the first customer gateway.

Table 2 only describes the key parameters for creating a customer gateway.

**Table 2** Description of customer gateway parameters
Parameter	Description	Value
Name	Name of a customer gateway.	cgw-ar01
Routing Mode	Select Static.	Static
Gateway IP Address	IP address used by the customer gateway to communicate with the Huawei Cloud VPN gateway. Ensure that UDP port 4500 is permitted on the customer gateway device in the on-premises data center.	1.1.1.1

Set parameters for the second customer gateway.

Table 3 only describes the key parameters for creating a customer gateway.

**Table 3** Parameters for the second customer gateway
Parameter	Description	Value
Name	Name of a customer gateway.	cgw-ar02
Routing Mode	Select Static.	Static
Gateway IP Address	IP address used by the customer gateway to communicate with the Huawei Cloud VPN gateway. Ensure that UDP port 4500 is permitted on the customer gateway device in the on-premises data center.	2.2.2.1

Configure VPN connections.

Choose Virtual Private Network > Enterprise – VPN Connections, and click Buy VPN Connection.

Set parameters for VPN connection 1 and click Submit.

Table 4 only describes the key parameters for creating a VPN connection.

**Table 4** Parameter settings for VPN connection 1
Parameter	Description	Value
Name	Name of a VPN connection.	vpn-001
VPN Gateway	VPN gateway for which the VPN connection is created.	vpngw-001
Gateway IP Address	Active EIP bound to the VPN gateway.	1.1.1.2
Customer Gateway	Name of a customer gateway.	cgw-ar01
VPN Type	Select Static routing.	Static routing
Customer Subnet	Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud. A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached. Reserved VPC CIDR blocks such as 100.64.0.0/10 and 214.0.0.0/8 cannot be used as customer subnets.	172.16.0.0/16
Interface IP Address Assignment	Manually specify In this example, select Manually specify. Automatically assign	Manually specify
Local Tunnel Interface Address	Tunnel interface IP address configured on the VPN gateway.	169.254.70.1
Customer Tunnel Interface Address	Tunnel interface IP address configured on the customer gateway device.	169.254.70.2
Link Detection	Whether to enable route reachability detection in multi-link scenarios. When NQA is enabled, ICMP packets are sent for detection and your device needs to respond to these ICMP packets.	NQA enabled
PSK, Confirm PSK	The value must be the same as the PSK configured on the customer gateway device.	Test@123
Policy Settings	The policy settings must be the same as those on the customer gateway device.	Default

Create VPN connection 2.

For VPN connection 2, you are advised to use the same parameter settings as VPN connection 1, except the parameters listed in the following table.

**Table 5** Parameter settings for VPN connection 2
Parameter	Description	Value
Name	Name of a VPN connection.	vpn-002
Gateway IP Address	Standby EIP bound to the VPN gateway.	2.2.2.2
Customer Gateway	Name of a customer gateway.	cgw-ar02
Local Tunnel Interface Address	Tunnel IP address of the VPN gateway.	169.254.71.1
Customer Tunnel Interface Address	Tunnel IP address of the customer gateway.	169.254.71.2

Configure the customer gateway device.

The configuration procedures may vary according to the type of the customer gateway device. For details, see Administrator Guide.

About 5 minutes later, check states of the VPN connections.
Choose Virtual Private Network > Enterprise – VPN Connections. The states of the two VPN connections are both Available.
Verify that servers in the on-premises data center and ECSs in the Huawei Cloud VPC subnet can ping each other.

Parent topic: Using VPN to Connect to the Cloud Through Two Internet Lines