Help Center/ Virtual Private Network/ Best Practices/ S2C Enterprise Edition VPN/ Using VPN to Encrypt Data over Direct Connect Lines/ Planning Networks and Resources
Updated on 2023-10-23 GMT+08:00
View PDF
Share

Planning Networks and Resources

Data Plan

Table 1 Data plan

Category

Item

Data

On-premises data center

Service subnet to be interconnected

Subnet to which the IP address of the customer gateway in VPN belongs.

172.16.0.0/16

Access subnet

Subnet to which the IP address of the Direct Connect remote gateway belongs. The access subnet can be the same as the service subnet. In this example, the access subnet and service subnet are the same.

172.16.0.0/16

VPC to which service subnets belong

VPC name

tenant_vpc

Direct Connect virtual gateway

VPC

Same as the access VPC of the VPN gateway.

tenant_vpc

Local subnet

Same as the access subnet of the VPN gateway.

192.168.2.0/24

Direct Connect virtual interface

IP address of the local gateway

This address is used by the Direct Connect virtual gateway to communicate with the Direct Connect remote gateway. At both ends, the configured local and remote gateway addresses must be reversed.

1.1.1.1/30

IP address of the remote gateway

2.2.2.2/30

Remote subnet

Access subnet to which the Direct Connect remote gateway belongs.

172.16.0.0/16

VPN gateway

VPC

VPC to which service subnets belong

tenant_vpc

Interconnection subnet

This subnet is used for communication between the VPN gateway and the VPC to which service subnets belong. Ensure that the selected interconnection subnet has four or more assignable IP addresses.

192.168.2.0/24

Local subnet

Subnet used by the VPC to communicate with the on-premises data center.

  • 192.168.0.0/24
  • 192.168.1.0/24

HA mode

Active-active

Access VPC

It can be the same as or different from the VPC to which service subnets belong.

In this example, the access VPC and the VPC to which service subnets belong are the same.

tenant_vpc

Access subnet
  • If the access VPC and the VPC to which service subnets belong are the same and the access subnet and the interconnection subnet are also the same, ensure that the interconnection subnet has four or more assignable IP addresses. This scenario is used as an example.

    192.168.2.0/24

  • If the access VPC and the VPC to which service subnets belong are the same and the access subnet and the interconnection subnet are different, ensure that the access subnet has two or more assignable IP addresses.
  • If the access VPC and the VPC to which service subnets belong are different, ensure that the access subnet has two or more assignable IP addresses.

Gateway IP Address

Manually specify the gateway IP addresses.

  • Private IP address 1: 192.168.2.100
  • Private IP address 2: 192.168.2.101

VPN connection

Tunnel interface address

This address is used by a VPN gateway to establish an IPsec tunnel with a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.

  • VPN connection 1: 169.254.70.1/30
  • VPN connection 2: 169.254.71.1/30

Customer gateway in VPN

Gateway IP address

This IP address is planned and configured by the administrator of the on-premises data center.

172.16.0.111

Tunnel interface address
  • VPN connection 1: 169.254.70.2/30
  • VPN connection 2: 169.254.71.2/30

IKE and IPsec policies

PSK

Test@123

IKE policy
  • Version: v2
  • Authentication algorithm: SHA2-256
  • Encryption algorithm: AES-128
  • DH algorithm: Group 15
  • Lifetime (s): 86400
  • Local ID: IP address
  • Peer ID: IP address

IPsec policy
  • Authentication algorithm: SHA2-256
  • Encryption algorithm: AES-128
  • PFS: DH Group15
  • Transfer protocol: ESP
  • Lifetime (s): 3600