Help Center/ Virtual Private Network/ Administrator Guide/ S2C Enterprise Edition VPN/ Interconnection with a Huawei AR Router (Dual Internet Lines in Active-Active Mode)/ Static Routing Mode/ Configuration on the Huawei Cloud Console
Updated on 2025-07-15 GMT+08:00
View PDF
Share

Configuration on the Huawei Cloud Console

Prerequisites

A VPC and its subnets have been created on the management console.

Procedure

  1. Log in to Huawei Cloud management console.
  2. Choose Networking > Virtual Private Network.
  3. Configure a VPN gateway.

    1. Choose Virtual Private Network > Enterprise – VPN Gateways, and click Buy S2C VPN Gateway.
    2. Set parameters as prompted and click Buy Now.

      Table 1 describes the parameters for creating a VPN gateway.

      Table 1 Description of VPN gateway parameters

      Parameter

      Description

      Value

      Name

      Name of a VPN gateway.

      vpngw-001

      Associate With

      Select VPC.

      VPC

      VPC

      Huawei Cloud VPC that the on-premises data center needs to access.

      vpc-001(192.168.0.0/16)

      Interconnection Subnet

      Subnet used for communication between the VPN gateway and the VPC of the on-premises data center. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

      192.168.2.0/24

      Local Subnet

      Huawei Cloud VPC subnet that needs to communicate with the VPC of the on-premises data center.

      192.168.0.0/24

      192.168.1.0/24

      BGP ASN

      BGP AS number.

      64512

      HA Mode

      Select Active/Standby.

      Active/Standby

      Active EIP

      EIP 1 used by the VPN gateway to communicate with the on-premises data center.

      1.1.1.2

      Standby EIP

      EIP 2 used by the VPN gateway to communicate with the on-premises data center.

      2.2.2.2

  4. Configure customer gateways.

    1. Choose Virtual Private Network > Enterprise – Customer Gateways, and click Create Customer Gateway.
    2. Set parameters to create the first customer gateway.

      Table 2 describes the parameter settings of the first customer gateway.

      Table 2 Parameter settings of the first customer gateway

      Parameter

      Description

      Value

      Name

      Name of a customer gateway.

      cgw-ar01

      Identifier

      One public IP address of the AR router.

      1.1.1.1
    3. Set parameters to create the second customer gateway.

      Table 3 describes the parameter settings of the second customer gateway.

      Table 3 Parameter settings of the second customer gateway

      Parameter

      Description

      Value

      Name

      Name of a customer gateway.

      cgw-ar02

      Identifier

      The other public IP address of the AR router.

      2.2.2.1

  5. Configure VPN connections.

    1. Choose Virtual Private Network > Enterprise – VPN Connections, and click Create VPN Connection.
    2. Set VPN connection parameters.

      Table 4 describes the key parameters for creating VPN connections.

      Table 4 Description of VPN connection parameters

      Parameter

      Description

      Value

      Name

      VPN connection name.

      vpn-001

      VPN Gateway

      VPN gateway for which VPN connections are created.

      vpngw-001

      VPN Gateway IP of Connection 1

      Active EIP of the VPN gateway.

      1.1.1.2

      Customer Gateway of Connection 1

      Customer gateway of connection 1.

      1.1.1.1

      VPN Gateway IP of Connection 2

      Standby EIP of the VPN gateway.

      2.2.2.2

      Customer Gateway of Connection 2

      Customer gateway of connection 2.

      2.2.2.1

      VPN Type

      Select Static routing.

      Static routing

      Customer Subnet

      Subnet in the on-premises data center that needs to access the VPC on Huawei Cloud.

      • A customer subnet cannot be included in any local subnet or any subnet of the VPC to which the VPN gateway is attached.
      • Reserved VPC CIDR blocks such as 100.64.0.0/10, 100.64.0.0/12, and 214.0.0.0/8 cannot be used as customer subnets. The reserved CIDR blocks vary according to regions and are subject to those displayed on the console.

        If you need to use 100.64.0.0/10 or 100.64.0.0/12, submit a service ticket.

      172.16.0.0/16

      Connection 1's Configuration

      Configure the IP address assignment mode of tunnel interfaces, local tunnel interface address, customer tunnel interface address, link detection, PSK, confirm PSK, and policies for connection 1.

      Set parameters based on the site requirements.

      Interface IP Address Assignment
      • Manually specify

        In this example, Manually specify is selected.

      • Automatically assign

      Manually specify

      Local Tunnel Interface Address

      Tunnel IP address of the VPN gateway.

      169.254.70.1/30

      Customer Tunnel Interface Address

      Tunnel IP address of the customer gateway.

      169.254.70.2/30

      Link Detection

      Whether to enable route reachability detection in multi-link scenarios. When NQA is enabled, ICMP packets are sent for detection and your device needs to respond to these ICMP packets.

      NOTE:

      When enabling this function, ensure that the customer gateway supports ICMP and is correctly configured with the customer interface IP address of the VPN connection. Otherwise, VPN traffic will fail to be forwarded.

      NQA enabled

      PSK, Confirm PSK

      The value must be the same as the PSK of the connection configured on the customer gateway.

      Test@123

      Policy Settings

      The policy settings must be the same as those on the firewall.
      • IKE Policy
        • Version: v2
        • Authentication Algorithm: SHA2-256
        • Encryption Algorithm: AES-128
        • DH Algorithm: Group 14
        • Lifetime (s): 86400
        • Local ID: IP Address
        • Customer ID: IP Address
      • IPsec Policy
        • Authentication Algorithm: SHA2-256
        • Encryption Algorithm: AES-128
        • PFS: DH group 14
        • Transfer Protocol: ESP
        • Lifetime (s): 3600

      Connection 2's Configuration

      Determine whether to enable Same as that of connection 1.

      NOTE:

      If you disable Same as that of connection 1, you are advised to use the same settings as connection 1 for connection 2, except the local and customer tunnel interface addresses.

      Disabled

      Local Tunnel Interface Address

      Tunnel IP address of the VPN gateway.

      169.254.71.1/30

      Customer Tunnel Interface Address

      Tunnel IP address of the customer gateway.

      169.254.71.2/30

Parent topic: Static Routing Mode