Help Center/ Virtual Private Network/ Administrator Guide/ S2C Enterprise Edition VPN/ Interconnection with strongSwan/ Policy-based Mode/ Configuration on the Huawei Cloud Console
Updated on 2025-08-19 GMT+08:00
View PDF
Share

Configuration on the Huawei Cloud Console

Prerequisites

A VPC and its subnets have been created on the management console.

Procedure

  1. Log in to Huawei Cloud management console.
  2. Choose Networking > Virtual Private Network.
  3. Configure a VPN gateway.

    1. Choose Virtual Private Network > Enterprise – VPN Gateways, and click Buy S2C VPN Gateway.
    2. Set parameters as prompted and click Buy Now.

      Table 1 describes the parameters for creating a VPN gateway.

      Table 1 Description of VPN gateway parameters

      Parameter

      Description

      Value

      Name

      Name of a VPN gateway.

      vpngw-001

      Associate With

      Select VPC.

      VPC

      VPC

      Huawei Cloud VPC that the on-premises data center needs to access.

      vpc-001(192.168.0.0/16)

      Local Subnet

      Huawei Cloud VPC subnet that needs to communicate with the VPC of the on-premises data center.

      192.168.0.0/24

      192.168.1.0/24

      Interconnection Subnet

      Subnet used for communication between the VPN gateway and the VPC of the on-premises data center. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

      192.168.2.0/24

      BGP ASN

      BGP AS number.

      64512

      Active EIP

      EIP 1 used by the VPN gateway to communicate with the on-premises data center.

      1.1.1.2

      Standby EIP

      EIP 2 used by the VPN gateway to communicate with the on-premises data center.

      2.2.2.2

  4. Configure a customer gateway.

    1. Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.
    2. Set parameters as prompted.

      Table 2 describes the parameters for creating a customer gateway.

      Table 2 Description of customer gateway parameters

      Parameter

      Description

      Value

      Name

      Name of a customer gateway.

      cgw-strongswan

      Identifier
      • IP Address: Specify the IP address of the customer gateway.
      • FQDN: Set the fully qualified domain name (FQDN) to a string of 1 to 128 case-sensitive characters that can contain letters, digits, and special characters (excluding &, <, >, [, ], \, ?, and spaces).

        If the customer gateway does not have a fixed IP address, select FQDN.

      NOTE:

      Ensure that an ACL rule has been configured on the customer gateway to permit UDP port 4500.

      1.1.1.1

  5. Configure VPN connections.

    In this scenario, strongSwan has only one public IP address. A VPN connection needs to be created between the public IP address of strongSwan and each of the active and standby EIPs of the Huawei Cloud VPN gateway.
    1. Choose Virtual Private Network > Enterprise – VPN Connections, and click Create VPN Connection.
    1. Configure VPN connections as prompted.

      Table 3 only describes the key parameters for creating VPN connections. For other parameters, use their default settings.

      Table 3 Description of VPN connection parameters

      Parameter

      Description

      Value

      Name

      VPN connection name.

      vpn-001

      VPN Gateway

      VPN gateway for which VPN connections are created.

      vpngw-001

      VPN Gateway IP of Connection 1

      Active EIP of the VPN gateway.

      1.1.1.2

      Customer Gateway of Connection 1

      Customer gateway of connection 1.

      1.1.1.1

      VPN Gateway IP of Connection 2

      Standby EIP of the VPN gateway.

      2.2.2.2

      Customer Gateway of Connection 2

      Customer gateway of connection 2.

      1.1.1.1

      VPN Type

      Select Policy-based.

      Policy-based

      Customer Subnet

      Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud.

      • A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached.
      • Reserved VPC CIDR blocks such as 100.64.0.0/10, 100.64.0.0/12, and 214.0.0.0/8 cannot be used as customer subnets. The reserved CIDR blocks vary according to regions and are subject to those displayed on the console.

        If you need to use 100.64.0.0/10 or 100.64.0.0/12, submit a service ticket.

      172.16.0.0/16

      Connection 1's Configuration

      Configure the PSK, confirm PSK, and policies for the VPN gateway IP address of connection 1.

      Set parameters based on the site requirements.

      PSK, Confirm PSK

      The value must be the same as the PSK of the connection configured on the customer gateway.

      Test@123

      Policy

      A policy rule defines the data flow that enters the encrypted VPN connection between the local and customer subnets. You need to configure the source and destination CIDR blocks in each policy rule.

      • Source CIDR Block

        The source CIDR block must contain some local subnets. 0.0.0.0/0 indicates any address.

      • Destination CIDR Block

        The destination CIDR block must contain all customer subnets.
      • Source CIDR block 1: 192.168.0.0/24
      • Destination CIDR block 1: 172.16.0.0/16
      • Source CIDR block 2: 192.168.1.0/24
      • Destination CIDR block 2: 172.16.0.0/16

      Policy Settings

      The policy settings must be the same as those of strongSwan.
      • IKE Policy
        • Encryption Algorithm: AES-128
        • Authentication Algorithm: SHA1
        • DH Algorithm: Group 2
        • Version: v2
        • Lifetime (s): 86400
        • Local ID: IP Address
        • Customer ID: IP Address
      • IPsec Policy
        • Encryption Algorithm: AES-128
        • Authentication Algorithm: SHA1
        • PFS: DH group 2
        • Transfer Protocol: ESP
        • Lifetime (s): 86400

      Connection 2's Configuration

      Determine whether to enable Same as that of connection 1.

      NOTE:

      It is recommended that the configuration of connection 2 be the same as that of connection 1.

      Enabled

Parent topic: Policy-based Mode