Configuration on the Huawei Cloud Console
Prerequisites
A VPC and its subnets have been created on the management console.
Procedure
- Log in to Huawei Cloud management console.
- Choose .
- Configure a VPN gateway.
- Choose Virtual Private Network > Enterprise – VPN Gateways, and click Buy S2C VPN Gateway.
- Set parameters as prompted and click Buy Now.
Table 1 describes the parameters for creating a VPN gateway. For other parameters, use their default settings.
Table 1 Description of VPN gateway parameters Parameter
Description
Value
Name
Name of a VPN gateway.
vpngw-001
Associate With
Select VPC.
VPC
VPC
Huawei Cloud VPC that the on-premises data center needs to access.
vpc-001(192.168.0.0/16)
Interconnection Subnet
Subnet used for communication between the VPN gateway and the VPC of the on-premises data center. Ensure that the selected interconnection subnet has four or more assignable IP addresses.
192.168.2.0/24
Local Subnet
Huawei Cloud VPC subnet that needs to communicate with the VPC of the on-premises data center.
192.168.0.0/24
BGP ASN
BGP AS number.
64512
HA Mode
Working mode of the VPN gateway.
Active-active
Active EIP
EIP 1 used by the VPN gateway to communicate with the on-premises data center.
1.1.1.2
Active EIP 2
EIP 2 used by the VPN gateway to communicate with the on-premises data center.
2.2.2.2
- Configure a customer gateway.
- Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.
- Set parameters as prompted.
Table 2 describes the parameters for creating a customer gateway. For other parameters, use their default settings.
Table 2 Description of customer gateway parameters Parameter
Description
Value
Name
Name of a customer gateway.
cgw-tx
Identifier
- IP Address: Specify the IP address of the customer gateway.
- FQDN: Set the fully qualified domain name (FQDN) to a string of 1 to 128 case-sensitive characters that can contain letters, digits, and special characters (excluding &, <, >, [, ], \, ?, and spaces).
If the customer gateway does not have a fixed IP address, select FQDN.
NOTE:Ensure that an ACL rule has been configured on the customer gateway to permit UDP port 4500.
IP Address
1.1.1.1
- Configure VPN connections.
In this scenario, the customer gateway has only one IP address. It is recommended that the VPN gateway on Huawei Cloud use the active-active mode. In this case, a VPN connection needs to be created between each of the two active EIPs of the VPN gateway and the IP address of the customer gateway.
- Choose Virtual Private Network > Enterprise – VPN Connections, and click Create VPN Connection.
- Set parameters as prompted.
Table 3 only describes the key parameters for creating VPN connections. For other parameters, use their default settings.
Table 3 Description of VPN connection parameters Parameter
Description
Value
Name
VPN connection name.
vpn-001
VPN Gateway
VPN gateway for which VPN connections are created.
vpngw-001
VPN Gateway IP of Connection 1
Active EIP of the VPN gateway.
1.1.1.2
Customer Gateway of Connection 1
Customer gateway of connection 1.
1.1.1.1
VPN Gateway IP of Connection 2
Active EIP 2 of the VPN gateway.
2.2.2.2
Customer Gateway of Connection 2
Customer gateway of connection 2.
1.1.1.1
VPN Type
Select Static routing.
Static routing
Customer Subnet
Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud.
- A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached.
- Reserved VPC CIDR blocks such as 100.64.0.0/10, 100.64.0.0/12, and 214.0.0.0/8 cannot be used as customer subnets. The reserved CIDR blocks vary according to regions and are subject to those displayed on the console.
If you need to use 100.64.0.0/10 or 100.64.0.0/12, submit a service ticket.
172.16.0.0/24
Connection 1's Configuration
Configure the IP address assignment mode of tunnel interfaces, local tunnel interface address, customer tunnel interface address, link detection, PSK, confirm PSK, and policies for connection 1.
Set parameters based on the site requirements.
Interface IP Address Assignment
- Manually specify
In this example, Manually specify is selected.
- Automatically assign
Manually specify
Local Tunnel Interface Address
Tunnel IP address of the VPN gateway.
169.254.70.1/30
Customer Tunnel Interface Address
Tunnel IP address of the customer gateway.
169.254.70.2/30
Link Detection
Whether to enable route reachability detection in multi-link scenarios. When NQA is enabled, ICMP packets are sent for detection and your device needs to respond to these ICMP packets.
NQA enabled
PSK, Confirm PSK
The value must be the same as the PSK of the connection configured on the customer gateway.
Set parameters based on the site requirements.
Policy Settings
The policy settings must be the same as those on the firewall.
- IKE Policy
- Version: v2
- Authentication Algorithm: SHA2-256
- Encryption Algorithm: AES-128
- DH algorithm: group 14
- Lifetime (s): 86400
- Local ID: IP Address
- Peer ID: IP address
- IPsec Policy
- Authentication Algorithm: SHA2-256
- Encryption Algorithm: AES-128
- PFS: DH group 14
- Transfer Protocol: ESP
- Lifetime (s): 3600
Connection 2's Configuration
Determine whether to enable Same as that of connection 1.
NOTE:If you disable Same as that of connection 1, you are advised to use the same settings as connection 1 for connection 2, except the local and customer tunnel interface addresses.
Disabled
Local Tunnel Interface Address
Tunnel IP address of the VPN gateway.
169.254.71.1/30
Customer Tunnel Interface Address
Tunnel IP address of the customer gateway.
169.254.71.2/30
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot