Planning Networks and Resources

VPC

Subnet that needs to access the on-premises data center

• 192.168.0.0/24
• 192.168.1.0/24

VPN gateway

Interconnection subnet

This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

192.168.2.0/24

HA Mode

Active/Standby

EIP

EIPs are automatically generated when you buy them. By default, a VPN gateway uses two EIPs. In this example, the EIPs are as follows:

• Active EIP: 1.1.1.2
• Standby EIP: 2.2.2.2

VPN connection

Tunnel interface address

This address is used by a VPN gateway to establish an IPsec tunnel with a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.

• VPN connection 1: 169.254.70.1/30
• VPN connection 2: 169.254.71.1/30

On-premises data center

Subnet that needs to access the VPC

172.16.0.0/16

Customer gateway

Public IP address

This public IP address is assigned by a carrier. In this example, the public IP address is:

• Public IP address 1: 1.1.1.1
• Public IP address 2: 2.2.2.1

Tunnel interface address

• VPN connection 1: 169.254.70.2/30
• VPN connection 2: 169.254.71.2/30

IKE and IPsec policies

PSK

Test@123

IKE policy

• Authentication algorithm: SHA2-256
• Encryption algorithm: AES-128
• DH algorithm: Group 15
• Version: v2
• Lifetime (s): 86400
• Local ID: IP address
• Peer ID: IP address

IPsec policy

• Authentication algorithm: SHA2-256
• Encryption algorithm: AES-128
• PFS: DH Group15
• Transfer protocol: ESP
• Lifetime (s): 3600