Help Center/ Virtual Private Network/ Administrator Guide/ S2C Enterprise Edition VPN/ Interconnection with an AR Router of Huawei (Active-Active Connections)/ Static Routing Mode/ Configuration on the Cloud Console
Updated on 2024-10-11 GMT+08:00
View PDF
Share

Configuration on the Cloud Console

Prerequisites

A VPC and its subnets have been created on the management console.

Procedure

  1. Log in to Huawei Cloud management console.
  2. Choose Networking > Virtual Private Network.
  3. Configure a VPN gateway.

    1. Choose Virtual Private Network > Enterprise – VPN Gateways. On the S2C VPN Gateways tab page, click Buy S2C VPN Gateway.
    2. Set parameters as prompted.

      Table 1 describes the parameters for creating a VPN gateway.

      Table 1 Parameters for creating a VPN gateway

      Parameter

      Description

      Value

      Name

      Name of a VPN gateway.

      vpngw-001

      Associate With

      Select VPC.

      VPC

      VPC

      Huawei Cloud VPC that the on-premises data center needs to access.

      vpc-001(192.168.0.0/16)

      Interconnection Subnet

      Subnet used for communication between the VPN gateway and the VPC of the on-premises data center. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

      192.168.2.0/24

      Local Subnet

      Subnets of the Huawei Cloud VPC that needs to communicate with the VPC of the on-premises data center.

      192.168.0.0/24

      192.168.1.0/24

      BGP ASN

      BGP AS number.

      64512

      HA Mode

      Working mode of the VPN gateway.

      Active-active

      Active EIP

      EIP 1 used by the VPN gateway to access the on-premises data center.

      1.1.1.2

      Active EIP 2

      EIP 2 used by the VPN gateway to access the on-premises data center.

      2.2.2.2

  4. Configure a customer gateway., that is, an AR router.

    1. Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.
    2. Set parameters as prompted.

      Table 2 describes the parameters for creating a customer gateway.

      Table 2 Parameters for creating a customer gateway

      Parameter

      Description

      Value

      Name

      Name of a customer gateway.

      cgw-ar

      Identifier

      Select IP Address, and enter the public IP address of the AR router.

      IP Address

      1.1.1.1

      BGP ASN

      ASN of your on-premises data center or private network.

      The value must be different from the BGP ASN of the VPN gateway.

      65000

  5. Configure VPN connections.

    In this scenario, a VPN connection is created between the AR router and each of the active EIP and active EIP 2 of the VPN gateway.
    1. Choose Virtual Private Network > Enterprise – VPN Connections, and click Create VPN Connection.
    1. Create VPN connection 1.

      Table 3 describes the parameters for creating a VPN connection.

      Table 3 Parameter settings for VPN connection 1

      Parameter

      Description

      Value

      Name

      Name of a VPN connection.

      vpn-001

      VPN Gateway

      VPN gateway for which the VPN connection is created.

      vpngw-001

      Gateway IP Address

      Active EIP bound to the VPN gateway.

      1.1.1.2

      Customer Gateway

      Name of a customer gateway.

      cgw-ar

      VPN Type

      Select Static routing.

      Static routing

      Customer Subnet

      Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud.

      • A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached.
      • Reserved VPC CIDR blocks such as 100.64.0.0/10 and 214.0.0.0/8 cannot be used as customer subnets.

      172.16.0.0/16

      Interface IP Address Assignment
      • Manually specify

        In this example, Manually specify is selected.

      • Automatically assign

      Manually specify

      Local Tunnel Interface Address

      Tunnel IP address of the VPN gateway.

      169.254.70.2/30

      Customer Tunnel Interface Address

      Tunnel IP address of the customer gateway.

      169.254.70.1/30

      Link Detection

      Whether to enable route reachability detection in multi-link scenarios. When NQA is enabled, ICMP packets are sent for detection and your device needs to respond to these ICMP packets.

      The VPN gateway can automatically perform NQA detection on the peer interface address that has been configured on the customer gateway.

      NQA enabled

      PSK, Confirm PSK

      The value must be the same as the PSK of the connection configured on the customer gateway device.

      Set this parameter based on the site requirements.

      Policy Settings

      The policy settings must be the same as those on the firewall.
      • IKE Policy
        • Version: v2
        • Authentication Algorithm: SHA2-256
        • Encryption Algorithm: AES-128
        • DH Algorithm: Group 14
        • Lifetime (s): 86400
        • Local ID: IP Address
        • Customer ID: IP Address
      • IPsec Policy
        • Authentication Algorithm: SHA2-256
        • Encryption Algorithm: AES-128
        • PFS: DH group 14
        • Transfer Protocol: ESP
        • Lifetime (s): 3600
    2. Create VPN connection 2.

      For VPN connection 2, you are advised to use the same parameter settings as VPN connection 1, except the parameters listed in the following table.

      Table 4 Parameter settings for VPN connection 2

      Parameter

      Description

      Value

      Name

      Name of a VPN connection.

      vpn-002

      Gateway IP Address

      Active EIP 2 bound to the VPN gateway.

      2.2.2.2

      Local Tunnel Interface Address

      Tunnel IP address of the VPN gateway.

      169.254.71.2/30

      Customer Tunnel Interface Address

      Tunnel IP address of the customer gateway.

      169.254.71.1/30

Parent topic: Static Routing Mode