A Virtual Private Network (VPN) establishes an encrypted, Internet-based communications tunnel between a user and a Virtual Private Cloud (VPC). With VPN, you can connect to a VPC and access service resources in it.
-
By default, ECSs in a VPC cannot communicate with your data center or private network. To enable communication between them, use a VPN.
-
A VPN consists of a VPN gateway and one or more VPN connections. A VPN gateway provides an Internet egress for a VPC and works together with the remote gateway in the local data center. A VPN connection uses the Internet- based encryption technology to connect the VPN gateway and the remote gateway to enable communication between the local data center and VPC. The VPN connection allows you to quickly build secure hybrid cloud environment.
-
Figure 1 shows the VPN networking.
-
Figure 1 VPN networking
+
What Is VPN?
+
Overview
Virtual Private Network (VPN) establishes secure, reliable, and cost-effective encrypted connections between your on-premises network or data center and a virtual network on the cloud.
+
VPN supports only non-cross-border connections.
+
+
- A VPN gateway provides an Internet egress for a Virtual Private Cloud (VPC) to connect to a customer gateway in your on-premises data center.
- A VPN connection connects a VPN gateway to a customer gateway through encrypted tunnels, enabling communication between a VPC and your on-premises data center. This helps quickly establish a secure hybrid cloud environment.
+
Figure 1 shows the VPN networking.
+
Figure 1 VPN networking
+
+
Components
- VPN gateway: a virtual gateway of VPN on the cloud. It establishes secure private connections with a customer gateway in your on-premises network or data center.
- Customer gateway: a resource that provides information to the cloud about your customer gateway device. It can be a physical device or software application in your on-premises data center.
- VPN connection: a secure channel between a VPN gateway and a customer gateway. VPN connections use the Internet Key Exchange (IKE) and IPsec protocols to encrypt the transmitted data.
+
+
+
\ No newline at end of file
diff --git a/docs/vpn/umn/en-us_topic_0035391412.html b/docs/vpn/umn/en-us_topic_0035391412.html
deleted file mode 100644
index 525c3e6a..00000000
--- a/docs/vpn/umn/en-us_topic_0035391412.html
+++ /dev/null
@@ -1,21 +0,0 @@
-
-
-
Application Scenarios
-
With the VPN between the VPC and your traditional data center, you can easily use the ECSs and block storage resources provided by the cloud platform.
-
Applications can be migrated to the cloud and additional web servers can be deployed to increase the computing capacity on a network. In this way, a hybrid cloud is built, which reduces IT O&M costs and protects enterprise core data from being leaked.
-
The VPN service allows you to set up site-to-site VPN connections or VPN connections from one site to multiple sites.
-
Site-to-site VPN connection
You can set up a VPN to connect a local data center to a VPC, thus building a hybrid cloud. Figure 1 shows a site-to-site VPN connection.
-
Figure 1 Site-to-site VPN connection
-
-
VPN connection from one site to multiple sites
You can also set up a VPN to connect multiple local data centers to a VPC, thus building a hybrid cloud. Figure 2 shows a VPN connection from one site to multiple sites.
-
The subnet CIDR blocks of each site involved in the VPN connection cannot overlap.
-
-
Figure 2 VPN connection from one site to multiple sites
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0035506845.html b/docs/vpn/umn/en-us_topic_0035506845.html
deleted file mode 100644
index 6c6bdabf..00000000
--- a/docs/vpn/umn/en-us_topic_0035506845.html
+++ /dev/null
@@ -1,59 +0,0 @@
-
-
-
Viewing a VPN
-
Scenarios
You can view details about an existing VPN.
-
-
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - On the console homepage, under Network, click Virtual Private Network.
- On the displayed Virtual Private Network page, view the target VPN. Table 1 describes the VPN status.
-
Table 1 VPN statusStatus
- |
-Description
- |
-
|---|
-
-Normal
- |
-Indicates that the VPN is successfully created and communication with the local data center through the VPN is normal.
- |
-
-Not connected
- |
-Indicates that the VPN is successfully created but has not been used for communication with the local data center.
- |
-
-Creating
- |
-Indicates that the VPN is being created.
- |
-
-Updating
- |
-Indicates that VPN information is being updated.
- |
-
-Deleting
- |
-Indicates that the VPN is being deleted.
- |
-
-Abnormal
- |
-Indicates that the VPN is abnormal.
- |
-
-Frozen
- |
-Indicates that the VPN is frozen.
- |
-
-
-
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0035616925.html b/docs/vpn/umn/en-us_topic_0035616925.html
deleted file mode 100644
index 47bc74b7..00000000
--- a/docs/vpn/umn/en-us_topic_0035616925.html
+++ /dev/null
@@ -1,14 +0,0 @@
-
-
-
Deleting a VPN
-
Scenarios
You can delete a VPN to release network resources if the VPN is no longer required.
-
-
Procedure
- Log in to the management console.
- Click
in the upper left corner and select a region and project. - On the console homepage, under Network, click Virtual Private Network.
- On the Virtual Private Network page, locate the target VPN and click Delete.
- Click Yes in the displayed dialog box.
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0035634996.html b/docs/vpn/umn/en-us_topic_0035634996.html
deleted file mode 100644
index 003c5969..00000000
--- a/docs/vpn/umn/en-us_topic_0035634996.html
+++ /dev/null
@@ -1,19 +0,0 @@
-
-
-
(Optional) Configure Security Group Rules
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0036149069.html b/docs/vpn/umn/en-us_topic_0036149069.html
deleted file mode 100644
index fd3a0e42..00000000
--- a/docs/vpn/umn/en-us_topic_0036149069.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
Do IPsec VPNs Support Automatic Negotiation?
-
The IPsec VPN tunnel works in passive mode, which triggers automatic negotiation only when traffic sent by the local end passes through the tunnel.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0041174633.html b/docs/vpn/umn/en-us_topic_0041174633.html
deleted file mode 100644
index 8d76a307..00000000
--- a/docs/vpn/umn/en-us_topic_0041174633.html
+++ /dev/null
@@ -1,106 +0,0 @@
-
-
-
A Change History
-
-
Release Date
- |
-What's New
- |
-
|---|
-
-2019-02-22
- |
-This release incorporates the following changes: Updated the region description in Table 2.
- |
-
-2019-02-18
- |
-Accepted in OTC-4.0/Agile-02.2019
- |
-
-2019-02-11
- |
-This release incorporates the following changes:
-- Deleted content about the firewall version from section Creating a VPN.
- Added Table 1.
- Updated the tag key and value requirements in
Table 3 and Table 1.
- - Updated content about searching for VPNs by tag key and value in section Managing VPN Tags.
- Adjusted the column width.
- |
-
-2019-02-02
- |
-This release incorporates the following changes:
-
- |
-
-2019-01-30
- |
-This release incorporates the following changes:
-
- |
-
-2019-01-23
- |
-This release incorporates the following changes:
-
- |
-
-2019-01-02
- |
-This release incorporates the following change:
-Added description about the PFS function to the section for configuring the IPsec policy of a VPN.
- |
-
-2018-04-30
- |
-This issue is the eighth official release, which incorporates the following change:
-Added description about how to add tags during VPN creation.
- |
-
-2017-08-30
- |
-This issue is the seventh official release, which incorporates the following change:
-Added description about VPC and subnet tags.
- |
-
-2017-07-30
- |
-This issue is the sixth official release, which incorporates the following change:
-- Added the best practice.
- Added description about the multi-project feature.
- |
-
-2017-04-28
- |
-This issue is the fifth official release, which incorporates the following change:
-- Changed the maximum number obtained by multiplying the number of local subnets and that of remote subnets of a VPN to 2500.
- |
-
-2017-03-30
- |
-This issue is the fourth official release, which incorporates the following change:
-- Added an example illustrating how to configure the remote device of a VPN.
- |
-
-2017-01-20
- |
-This issue is the third official release, which incorporates the following change:
-- Added description about the IPsec VPN created between multiple local gateways in different VPCs and the same remote gateway
- |
-
-2016-12-30
- |
-This issue is the second official release, which incorporates the following change:
-
- |
-
-2016-10-19
- |
-This issue is the first official release.
- |
-
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0044789110.html b/docs/vpn/umn/en-us_topic_0044789110.html
deleted file mode 100644
index 3756c14f..00000000
--- a/docs/vpn/umn/en-us_topic_0044789110.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
What Is the Limitation on the Number of Local and Remote Subnets of a VPN?
-
The maximum number obtained by multiplying the number of local subnets and that of remote subnets cannot exceed 2500.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0045305370.html b/docs/vpn/umn/en-us_topic_0045305370.html
deleted file mode 100644
index 5602b7c0..00000000
--- a/docs/vpn/umn/en-us_topic_0045305370.html
+++ /dev/null
@@ -1,13 +0,0 @@
-
-
-
Why Is Not Connected Displayed as the Status for a Successfully Created VPN?
-
After a VPN is created, its status changes to Normal only after the VMs or physical servers on the two sides of the VPN communicate with each other.
-
- IKE v1:
If no traffic goes through the VPN for a period of time, the VPN needs to be renegotiated. The negotiation time depends on the value of Lifecycle (s) in the IPsec policy. Generally, the value of Lifecycle (s) is 3600 (1 hour), indicating that the negotiation will be initiated in the fifty-fourth minute. If the negotiation succeeds, the connection remains to the next round of negotiation. If the negotiation fails, the status is set to be disconnected within one hour. The connection can be restored after the two sides of the VPN communicates with each other. The disconnection can be avoided by using a network monitoring tool, such as IP SLA, to generate packets.
- - IKE v2: If no traffic goes through the VPN for a period of time, the VPN remains in the connected status.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0051518174.html b/docs/vpn/umn/en-us_topic_0051518174.html
deleted file mode 100644
index 8e72032d..00000000
--- a/docs/vpn/umn/en-us_topic_0051518174.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
How Long Is Required for Issued VPN Configurations to Take Effect?
-
The time required for VPN configurations to take effect increases linearly with the number obtained by multiplying the number of local subnets and that of remote subnets.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0060118606.html b/docs/vpn/umn/en-us_topic_0060118606.html
deleted file mode 100644
index 1b9c9d47..00000000
--- a/docs/vpn/umn/en-us_topic_0060118606.html
+++ /dev/null
@@ -1,290 +0,0 @@
-
-
-
Creating a VPN
-
Overview
By default, ECSs in a VPC cannot communicate with your data center or private network. To enable communication between them, use a VPN. You need to create a VPN in your VPC and update the security group rules.
-
-
Description of a Simple IPsec VPN Intranet Topology
In Figure 1, a VPC has two subnets: 192.168.1.0/24 and 192.168.2.0/24. On your router deployed in your physical data center, you also have two subnets: 192.168.3.0/24 and 192.168.4.0/24. You can create a VPN to enable subnets in your VPC to communicate with those in your data center.
-
Figure 1 IPsec VPN
-
Currently, the site-to-site VPN and hub-spoke VPN are supported. You need to set up VPNs in both your data center and the VPC to establish the VPN connection.
-
Ensure that the VPN in your VPC and that in your data center use the same Internet Key Exchange (IKE) and IPsec policy configurations. Before creating a VPN, familiarize yourself with the protocols described in Table 1 and ensure that your device meets the requirements and configuration constraints of the involved protocols.
-
-
Table 1 Involved protocolsParameter
- |
-Description
- |
-Constraint
- |
-
|---|
-
-RFC 2409
- |
-Defines the IKE protocol, which negotiates and verifies key information to safeguard VPNs.
- |
-- Use the pre-shared key (PSK) to reach an IKE peer agreement.
- Use the main mode and aggressive mode for negotiation.
- |
-
-RFC 4301
- |
-Defines the IPsec architecture, the security services that IPsec offers, and the collaboration between components.
- |
-Use the IPsec tunnel to set up a VPN connection.
- |
-
-
-
-
-
-
Scenarios
Perform the following procedure to create a VPN that sets up a secure, isolated communication tunnel between your data center and cloud services.
-
-
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - On the console homepage, under Network, click Virtual Private Network.
- On the Virtual Private Network page, click Create VPN.
- Set the parameters as prompted and click Create Now.
Figure 2 Creating a VPN
-
-Table 2 Basic parametersParameter
- |
-Description
- |
-Example Value
- |
-
|---|
-
-Region
- |
-Specifies the desired region. Regions are geographic areas isolated from each other.
-Resources are region-specific and cannot be used across regions through internal network connections. For low network latency and quick resource access, select the nearest region.
- |
-eu-de
- |
-
-Name
- |
-Specifies the VPN name.
- |
-VPN-001
- |
-
-VPC
- |
-Specifies the VPC name.
- |
-VPC-001
- |
-
-Local Subnet
- |
-A local subnet is a VPC subnet that accesses a customer network through a VPN.
-- Select subnet: If you select this option, you can then select the subnets that need to communicate with your data center.
- Specify CIDR block: If you select this option, you can then enter the CIDR blocks that need to communicate with your data center.
- |
-192.168.1.0/24,192.168.2.0/24
- |
-
-Remote Gateway
- |
-Specifies the public IP address of the VPN in your data center or on the private network. This IP address is used for communicating with the VPN in the VPC.
- |
-N/A
- |
-
-Remote Subnet
- |
-A remote subnet is a subnet in the customer data center that accesses a VPC through a VPN. The remote and local subnets cannot have overlapping or matching CIDR blocks. The remote subnet CIDR block cannot overlap with CIDR blocks involved in existing VPC peering connections created for the local VPC.
- |
-192.168.3.0/24,192.168.4.0/24
- |
-
-PSK
- |
-Specifies the pre-shared key, which is a private key shared by two ends of a VPN connection. The PSK configurations for both ends of a VPN connection must be the same. This key is used for VPN connection negotiation.
-The value is a string of 6 to 128 characters.
- |
-Test@123
- |
-
-Confirm PSK
- |
-Specifies the confirm pre-shared key.
- |
-Test@123
- |
-
-Tag
- |
-Specifies the VPN tag, which consists of a key and value pair. You can add a maximum of ten tags to each VPN.
-The tag key and value must meet the requirements listed in Table 3.
- |
-- Key: vpn_key1
- Value: vpn-01
- |
-
-Advanced Settings
- |
-- Default: uses default IKE and IPsec policies.
- Existing: uses existing IKE and IPsec policies. This option is available only after you have created IKE and IPsec policies.
- Custom: uses custom IKE and IPsec policies. For details about the policies, see Table 4 and Table 5.
- |
-Custom
- |
-
-
-
-
Table 3 VPN tag key and value requirementsParameter
- |
-Requirement
- |
-Example Value
- |
-
|---|
-
-Key
- |
-- Cannot be left blank.
- Must be unique for the same VPN and can be the same for different VPNs.
- Contains a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-vpn_key1
- |
-
-Value
- |
-- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-vpn-01
- |
-
-
-
-
Table 4 IKE policyParameter
- |
-Description
- |
-Example Value
- |
-
|---|
-
-Authentication Algorithm
- |
-Specifies the authentication hash algorithm. The value can be SHA1, SHA2-256, SHA2-384, SHA2-512, or MD5.
-The default value is SHA1.
- |
-SHA1
- |
-
-Encryption Algorithm
- |
-Specifies the encryption algorithm. The value can be AES-128, AES-192,
-AES-256, or 3DES. The 3DES algorithm is not recommended because it is risky.
-The default value is AES-128.
- |
-AES-128
- |
-
-DH Algorithm
- |
-Specifies the Diffie-Hellman key exchange algorithm. The value can be Group 1, Group 2, Group 5, Group 14,
-Group 15, Group 16, Group 19, Group
-20, or Group 21.
-The DH group security level from the highest to lowest is as follows: Group 21> Group 20 > Group 19 > Group 16 > Group 15 > Group 14 > Group 5 > Group 2 > Group 1.
-The default value is Group 5.
- |
-Group 5
- |
-
-Version
- |
-Specifies the version of the IKE protocol. The value can be v1 or v2.
-The default value is v1.
- |
-v1
- |
-
-Lifecycle (s)
- |
-Specifies the lifetime of the security association (SA), in seconds.
-The SA will be renegotiated if its lifetime expires.
-The default value is 86400.
- |
-86400
- |
-
-Negotiation Mode
- |
-If the IKE policy version is v1, the negotiation mode can be configured. The value can only be Main.
-The default value is Main.
- |
-Main
- |
-
-
-
-
Table 5 IPsec policyParameter
- |
-Description
- |
-Example Value
- |
-
|---|
-
-Authentication Algorithm
- |
-Specifies the authentication hash algorithm. The value can be SHA1, SHA2-256, SHA2-384, SHA2-512, or MD5.
-The default value is SHA1.
- |
-SHA1
- |
-
-Encryption Algorithm
- |
-Specifies the encryption algorithm. The value can be AES-128, AES-192, AES-256, or 3DES. The 3DES algorithm is not recommended because it is risky.
-The default value is AES-128.
- |
-AES-128
- |
-
-PFS
- |
-Specifies the perfect forward secrecy (PFS), which is used to configure the IPsec tunnel negotiation.
-This function enables two parties to exchange the DH keys during the phase-two negotiation, improving key security. It is recommended that you enable this function.
-You can disable this function by selecting Disable from the drop- down list.
-The PFS used at the two sides of a VPN must be the same. Otherwise, the negotiation will fail. If you disable this function on the console, you also need to disable it at the customer side of the VPN.
-The value can be DH group 1, DH group 2, DH group 5, DH group 14, DH group 15, DH group 16, DH group 19, DH group 20, or DH group 21.
-The PFS group security level from the highest to lowest is as follows: DH group 21 > DH group 20 > DH group 19 > DH group 16 > DH group 15 > DH group 14 > DH group 5 > DH group 2 > DH group 1.
-The default value is DH group 5.
- |
-DH group 5
- |
-
-Transfer Protocol
- |
-Specifies the security protocol used for IPsec to transmit and encapsulate user data. The value can be AH, ESP, or AH-ESP.
-The default value is ESP.
- |
-ESP
- |
-
-Lifecycle (s)
- |
-Specifies the lifetime of the SA, in seconds.
-The SA will be renegotiated if its lifetime expires.
-The default value is 3600.
- |
-3600
- |
-
-
-
-
The IKE policy specifies the encryption and authentication algorithms to use in the negotiation phase of an IPsec tunnel. The IPsec policy specifies the protocol, encryption algorithm, and authentication algorithm to use in the data transmission phase of an IPsec tunnel. These parameters must be the same between the VPN in your VPC and that in your data center. If they are different, the VPN cannot be set up.
-
- - Click Submit.
After the IPsec VPN is created, a public network egress IP address is assigned to the IPsec VPN. The IP address is the local gateway address of a created VPN on the network console. When configuring the remote tunnel in your data center, you must set the remote gateway address to this IP address.
-Figure 3 Gateway egress IP address
- - Due to the symmetry of the tunnel, you also need to configure the IPsec VPN on your router or firewall in the data center.
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0066871940.html b/docs/vpn/umn/en-us_topic_0066871940.html
deleted file mode 100644
index f6ca2d46..00000000
--- a/docs/vpn/umn/en-us_topic_0066871940.html
+++ /dev/null
@@ -1,24 +0,0 @@
-
-
-
Connecting to a VPC Through a VPN
-
Scenarios
By default, ECSs in a VPC cannot communicate with your data center or private network. To enable communication between them, use a VPN. After a VPN is created, configure the security group and check the connectivity between the local and remote networks to ensure that the VPN is available. VPNs can be classified into the following two types:
-
- Site-to-site VPN: The local side is a VPC on the cloud service platform, and the remote side is a user data center. A site-to-site VPN is a communication tunnel between a user data center and a single VPC.
- Hub-and-spoke VPN: The local side is a VPC on the cloud service platform, and the remote side is user data centers. A hub-and-spoke VPN is a communication tunnel between user data centers and a VPC.
-
Ensure that the following requirements are met when configuring a VPN:
-
- The local and remote subnets cannot overlap.
- Different local subnets cannot overlap.
- The local and remote sides use the same IKE and IPsec policies and PSK.
- The local and remote subnet and gateway parameters must be symmetric.
- The security group used by ECSs in the VPC allows traffic from and to the remote side.
- After a VPN is created, its status changes to Normal only after the VMs or physical servers on the two sides of the VPN communicate with each other.
-
-
Prerequisites
You have created the VPC and subnet required by the VPN.
-
-
Procedure
- On the management console, select the appropriate IKE and IPsec policies to create a VPN.
- Check the IP address pools for the local and remote subnets.
In Figure 1, a VPC has two subnets: 192.168.1.0/24 and 192.168.2.0/24. On your router deployed in your physical data center, you also have two subnets: 192.168.3.0/24 and 192.168.4.0/24. You can create a VPN to enable subnets in your VPC to communicate with those in your data center.
-Figure 1 IPsec VPN
-The IP address pools for the local and remote subnets cannot overlap with each other. For example, if the local VPC has two subnets, 192.168.1.0/24 and 192.168.2.0/24, the IP address pool for the remote subnets cannot contain these two subnets.
- - Configure security group rules for the VPC.
- Check the security group of the VPC.
The security group must allow packets from the VPN to pass. You can run the ping command to check whether the security group of the VPC allows packets from the VPN to pass.
- - Check the remote LAN configuration (network configuration of the remote data center).
A route must be configured for the remote LAN to enable VPN traffic to be forwarded to network devices on the LAN. If the VPN traffic cannot be forwarded to the network devices, check whether the remote LAN has policies configured to refuse the traffic.
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0081947484.html b/docs/vpn/umn/en-us_topic_0081947484.html
deleted file mode 100644
index fc845e45..00000000
--- a/docs/vpn/umn/en-us_topic_0081947484.html
+++ /dev/null
@@ -1,12 +0,0 @@
-
-
-
Reference Standards and Protocols
-
The following standards and protocols are associated with the IPsec VPN:
-
- RFC 4301: Security Architecture for the Internet Protocol
- RFC 2403: The Use of HMAC-MD5-96 within ESP and AH
- RFC 2409: The Internet Key Exchange (IKE)
- RFC 2857: The Use of HMAC-RIPEMD-160-96 within ESP and AH
- RFC 3566: The AES-XCBC-MAC-96 Algorithm and its use with IPsec
- RFC 3625: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
- RFC 3664: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 3706: A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
- RFC 3748: Extensible Authentication Protocol (EAP)
- RFC 3947: Negotiation of NAT-Traversal in the IKE
- RFC 4109: Algorithms for Internet Key Exchange version 1 (IKEv1)
- RFC 3948: UDP Encapsulation of IPsec ESP Packets
- RFC 4305: Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 4306: Internet Key Exchange (IKEv2) Protocol
- RFC 4307: Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)
- RFC 4322: Opportunistic Encryption using the Internet Key Exchange (IKE)
- RFC 4359: The Use of RSA/SHA-1 Signatures within Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 4434: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4478: Repeated Authentication in Internet Key Exchange (IKEv2)
- RFC 5996: Internet Key Exchange Protocol Version 2 (IKEv2)
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0107396413.html b/docs/vpn/umn/en-us_topic_0107396413.html
deleted file mode 100644
index 447026b9..00000000
--- a/docs/vpn/umn/en-us_topic_0107396413.html
+++ /dev/null
@@ -1,55 +0,0 @@
-
-
-
Managing VPN Tags
-
Application Scenarios
A VPN tag identifies a VPN. Tags can be added to VPNs to facilitate VPN identification and administration. You can add a tag to a VPN when creating the VPN. Alternatively, you can add a tag to a created VPN on the VPN details page. A maximum of ten tags can be added to each VPN.
-
A tag consists of a key and value pair. Table 1 lists the tag key and value requirements.
-
-
Table 1 VPN tag key and value requirementsParameter
- |
-Requirement
- |
-Example Value
- |
-
|---|
-
-Key
- |
-- Cannot be left blank.
- Must be unique for the same VPN and can be the same for different VPNs.
- Contains a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-vpn_key1
- |
-
-Value
- |
-- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-vpn-01
- |
-
-
-
-
-
-
Procedure
Search for VPNs by Tag Key and Value on the Page Showing the VPN List.
-
- Log in to the management console.
- Click
in the upper left corner and select a region and project. - On the console homepage, under Network, click Virtual Private Network.
- In the upper right corner of the VPN list, click Search by Tag.
- In the displayed area, enter the tag key and value of the VPN you are looking for.
Both the tag key and value must be specified.
- - Click + to add the entered tag key and value.
You can add multiple tag keys and values to refine your search results. If you add more than one tag to search for VPCs, the VPCs containing all specified tags will be displayed.
- - Click Search.
The system displays the VPNs you are looking for based on the entered tag keys and values.
-
-
Add, Delete, Edit, and View Tags on the Tags Tab of a VPN.
-
- Log in to the management console.
- Click
in the upper left corner and select a region and project. - On the console homepage, under Network, click Virtual Private Network.
- On the Virtual Private Network page, locate the VPN whose tags are to be managed and click the VPN name.
The page showing details about the particular VPN is displayed.
- - Click the Tags tab and perform desired operations on tags.
- View tags.
On the Tags tab, you can view details about tags added to the current VPN, including the number of tags and the key and value of each tag.
- - Add a tag.
Click Add Tag in the upper left corner. In the displayed dialog box, enter the key and value of the tag to be added, and click OK.
- - Edit a tag.
Locate the row that contains the tag to be edited and click Edit in the Operation column. In the Edit Tag dialog box, change the tag value and click OK.
- - Delete a tag.
Locate the row that contains the tag to be deleted, and click Delete in the Operation column. In the displayed Delete Tag dialog box, click Yes.
-
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0109312453.html b/docs/vpn/umn/en-us_topic_0109312453.html
deleted file mode 100644
index 481ffea3..00000000
--- a/docs/vpn/umn/en-us_topic_0109312453.html
+++ /dev/null
@@ -1,54 +0,0 @@
-
-
-
How Do I Configure a Remote Device for a VPN?
-
Due to the symmetry of the tunnel, the VPN parameters configured on the cloud must be the same as those configured in your own data center. If they are different, a VPN cannot be established.
-
To set up a VPN, you also need to configure the IPsec VPN on the router or firewall in your own data center. The configuration method may vary depending on your network device in use. For details, see the configuration guide of your network device.
-
This section describes how to configure the IPsec VPN on a Huawei USG6600 series V100R001C30SPC300 firewall for your reference.
-
For example, the subnets of the data center are 192.168.3.0/24 and 192.168.4.0/24, the subnets of the VPC are 192.168.1.0/24 and 192.168.2.0/24, and the public IP address of the IPsec tunnel egress in the VPC is XXX.XXX.XX.XX, which can be obtained from the local gateway parameters of the IPsec VPN in the VPC.
-
Procedure
- Log in to the CLI of the firewall.
- Check firewall version information.
display version 17:20:502017/03/09
-Huawei Versatile Security Platform Software
-Software Version: USG6600 V100R001C30SPC300 (VRP (R) Software, Version 5.30)
- - Create an access control list (ACL) and bind it to the target VPN instance.
acl number 3065 vpn-instance vpn64
-rule 1 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
-rule 2 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
-rule 3 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
-rule 4 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
-q
- - Create an IKE proposal.
ike proposal 64
-dh group5
-authentication-algorithm sha1
-integrity-algorithm hmac-sha2-256
-sa duration 3600
-q
- - Create an IKE peer and reference the created IKE proposal. The peer IP address is 93.188.242.110.
ike peer vpnikepeer_64
-pre-shared-key ******** (******** specifies the pre-shared key.)
-ike-proposal 64
-undo version 2
-remote-address vpn-instance vpn64 93.188.242.110
-sa binding vpn-instance vpn64
-q
- - Create an IPsec protocol.
ipsec proposal ipsecpro64
-encapsulation-mode tunnel
-esp authentication-algorithm sha1
-q
- - Create an IPsec policy and reference the IKE policy and IPsec proposal.
ipsec policy vpnipsec64 1 isakmp
-security acl 3065
-pfs dh-group5
-ike-peer vpnikepeer_64
-proposal ipsecpro64
-local-address xx.xx.xx.xx
-q
- - Apply the IPsec policy to the subinterface.
interface GigabitEthernet0/0/2.64
-ipsec policy vpnipsec64
-q
- - Test the connectivity.
After you perform the preceding operations, you can test the connectivity between your ECSs in the cloud and the hosts in your data center. For details, see the following figure.
-
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0109676043.html b/docs/vpn/umn/en-us_topic_0109676043.html
deleted file mode 100644
index 0aaf8011..00000000
--- a/docs/vpn/umn/en-us_topic_0109676043.html
+++ /dev/null
@@ -1,34 +0,0 @@
-
-
-
Which Remote VPN Devices Are Supported?
-
Most devices that meet IPsec VPN standard and reference protocol requirements can be used as the remote VPN devices, for example, Cisco ASA firewalls, Huawei USG6xxxx series firewalls, USG9xxxx series firewalls, Hillstone firewalls, and Cisco ISR routers. Table 1 lists the supported Huawei USG6xxxx and USG9xxxx firewalls.
-
-
Table 1 Huawei VPN devicesSupported Remote VPN Device
- |
-Description
- |
-
|---|
-
-Huawei USG6000 series
- |
-USG6320/6310/6510-SJJ
-USG6306/6308/6330/6350/6360/6370/6380/6390/6507/6530/6550/6570:2048
-USG6620/6630/6650/6660/6670/6680
- |
-
-Huawei USG9000 series
- |
-USG9520/USG9560/USG9580
- |
-
-
-
-
-
Other devices that meet the requirements in the reference protocols described in section Reference Standards and Protocols can also be deployed. However, some devices may fail to add because of inconsistent protocol implementation methods of these devices. If the connection setup fails, rectify the fault by following the instructions provided in section What Do I Do If VPN Setup Fails? or contact customer service.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0114174493.html b/docs/vpn/umn/en-us_topic_0114174493.html
deleted file mode 100644
index 8d6df130..00000000
--- a/docs/vpn/umn/en-us_topic_0114174493.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
VPN Best Practice
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0122970066.html b/docs/vpn/umn/en-us_topic_0122970066.html
deleted file mode 100644
index 48f8840a..00000000
--- a/docs/vpn/umn/en-us_topic_0122970066.html
+++ /dev/null
@@ -1,183 +0,0 @@
-
-
-
(Optional) Create a VPC
-
Scenarios
A VPC provides an isolated virtual network for ECSs. You can configure and manage the network as required.
-
Create a VPC by following the procedure provided in this section. Then, create subnets, security groups, and VPNs, and assign EIPs by following the procedure provided in subsequent sections based on your actual network requirements.
-
-
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - On the console homepage, under Network, click Virtual Private Cloud.
- Click Create VPC.
- On the Create VPC page, set parameters as prompted.
During VPC creation, a default subnet will be created and you can also click Add Subnet to create more subnets for the VPC.
-
-Table 1 VPC parameter descriptionCatego ry
- |
-Parameter
- |
-Description
- |
-Example Value
- |
-
|---|
-
-Basic Information
- |
-Region
- |
-Specifies the desired region. Regions are geographic areas isolated from each other. Resources are region-specific and cannot be used across regions through internal network connections. For low network latency and quick resource access, select the nearest region.
- |
-eu-de
- |
-
-Basic Information
- |
-Name
- |
-Specifies the VPC name.
- |
-VPC-001
- |
-
-Basic Information
- |
-CIDR Block
- |
-Specifies the CIDR block for the VPC. The CIDR block of a subnet can be the same as the CIDR block for the VPC (for a single subnet in the VPC) or a subset (for multiple subnets in the VPC).
-The following CIDR blocks are supported:
-10.0.0.0 – 10.255.255.255
-172.16.0.0 –172.31.255.255
-192.168.0.0 –192.168.255.255
- |
-192.168.0.0/16
- |
-
-Basic Information
- |
-Tag
- |
-Specifies the VPC tag, which consists of a key and value pair. You can add a maximum of ten tags to each VPC.
-The tag key and value must meet the requirements listed in Table 2.
- |
-- Key: vpc_key1
- Value: vpc-01
- |
-
-Subnet Settings
- |
-Name
- |
-Specifies the subnet name.
- |
-Subnet
- |
-
-Subnet Settings
- |
-CIDR Block
- |
-Specifies the CIDR block for the subnet. This value
-must be within the VPC CIDR range.
- |
-192.168.0.0/24
- |
-
-Subnet Settings
- |
-Gateway
- |
-Specifies the gateway address of the subnet.
- |
-192.168.0.1
- |
-
-Subnet Settings
- |
-DNS Server Address
- |
-The external DNS server address is used by default. If you need to change the DNS server address, ensure that the configured DNS server address is available.
- |
-192.168.1.0
- |
-
-Subnet Settings
- |
-NTP Server Address
- |
-Specifies the NTP server IP address. A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
- |
-192.168.2.1
- |
-
-Subnet Settings
- |
-Tag
- |
-Specifies the subnet tag, which consists of a key and value pair. You can add a maximum of ten tags to each subnet.
-The tag key and value must meet the requirements listed in Table 3.
- |
-- Key: subnet_key1
- Value: subnet-01
- |
-
-
-
-
Table 2 VPC tag key and value requirementsParameter
- |
-Requirements
- |
-Example Value
- |
-
|---|
-
-Key
- |
-- Cannot be left blank.
- Must be unique for the same VPC and can be the same for different VPCs.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-vpc_key1
- |
-
-Value
- |
-- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-vpc-01
- |
-
-
-
-
Table 3 Subnet tag key and value requirementsParameter
- |
-Requirements
- |
-Example Value
- |
-
|---|
-
-Key
- |
-- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-subnet_key1
- |
-
-Value
- |
-- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-subnet-01
- |
-
-
-
-
- The external DNS server address is used by default. If you need to change the DNS server address, select Custom for Advanced Settings and configure the DNS server addresses. You must ensure that the configured DNS server addresses are available.
- Click Create Now.
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0122970067.html b/docs/vpn/umn/en-us_topic_0122970067.html
deleted file mode 100644
index e2b5766d..00000000
--- a/docs/vpn/umn/en-us_topic_0122970067.html
+++ /dev/null
@@ -1,104 +0,0 @@
-
-
-
(Optional) Create a Subnet for the VPC
-
Scenarios
You can add subnets during VPC creation. If required, you can also create subnets for an existing VPC.
-
The created subnet is configured with DHCP by default. After an ECS using this VPC starts, the ECS automatically obtains an IP address using DHCP.
-
-
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - On the console homepage, under Network, click Virtual Private Cloud.
- In the navigation pane on the left, click Virtual Private Cloud.
- On the Virtual Private Cloud page, locate the VPC for which a subnet is to be created and click the VPC name.
- On the displayed Subnets tab, click Create Subnet.
- In the Create Subnet area, set parameters as prompted.
Figure 1 Create Subnet
-
-Table 1 Parameter descriptionParameter
- |
-Description
- |
-Example Value
- |
-
|---|
-
-Name
- |
-Specifies the subnet name.
- |
-Subnet
- |
-
-CIDR Block
- |
-Specifies the CIDR block for the subnet. This value must be within the VPC CIDR range.
- |
-192.168.0.0/24
- |
-
-Gateway
- |
-Specifies the gateway address of the subnet.
- |
-192.168.0.1
- |
-
-NTP Server Address
- |
-Specifies the NTP server IP address. A maximum of four IP addresses can be configured. Multiple IP addresses must be separated using commas (,).
- |
-192.168.2.1
- |
-
-Tag
- |
-Specifies the subnet tag, which consists of a key and value pair. You can add a maximum of ten tags to each subnet.
-The tag key and value must meet the requirements listed in Table 2.
- |
-- Key: subnet_key1
- Value:
subnet-01
-
- |
-
-DNS Server Address
- |
-The external DNS server address is used by default. If you need to change the DNS server address, ensure that the configured DNS server address is available.
- |
--
- |
-
-
-
-
Table 2 Subnet tag key and value requirementsParameter
- |
-Requirements
- |
-Example Value
- |
-
|---|
-
-Key
- |
-- Cannot be left blank.
- Must be unique for each subnet.
- Can contain a maximum of 36 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-subnet_key1
- |
-
-Value
- |
-- Can contain a maximum of 43 characters.
- Can contain only the following character types:
- Uppercase letters
- Lowercase letters
- Digits
- Special characters, including hyphens (-) and underscores (_)
-
- |
-subnet-01
- |
-
-
-
-
- The external DNS server address is used by default. If you need to change the DNS server address, select Custom for Advanced Settings and configure the DNS server addresses. You must ensure that the configured DNS server addresses are available.
- Click OK.
-
-
Precautions
After a subnet is created, five IP addresses in the subnet will be reserved and cannot be used. For example, in a subnet with CIDR block 192.168.0.0/24, the following IP addresses are reserved:
-
- 192.168.0.0: Network address.
- 192.168.0.1: Gateway address.
- 192.168.0.253: Reserved for the system interface. This IP address is used by the VPC for external communication.
- 192.168.0.254: DHCP service address.
- 192.168.0.255: Network broadcast address.
-
If you set Advanced Settings to Custom during subnet creation, the reserved IP addresses may be different from the preceding default ones. The system will reserve five IP addresses based on your subnet settings.
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0142368417.html b/docs/vpn/umn/en-us_topic_0142368417.html
deleted file mode 100644
index bce4e86f..00000000
--- a/docs/vpn/umn/en-us_topic_0142368417.html
+++ /dev/null
@@ -1,12 +0,0 @@
-
-
-
What Can I Do If the VPN Fails or the Network Speed of the VPN Is Slow?
-
You can perform the following steps to handle the issues:
-
- Check the ECS specifications. Rate limiting is not performed for the VPN ingress on the cloud, so the issue may be caused by the ECS specifications.
- Rate limiting has been configured for the VPN egress on the cloud. Check whether your bandwidth has reached or exceeded the maximum limit allowed.
- Check your local network to see whether the network speed is slow.
- Check whether packets sent between the cloud and the customer data center have been lost.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0142373840.html b/docs/vpn/umn/en-us_topic_0142373840.html
deleted file mode 100644
index 90ee73a0..00000000
--- a/docs/vpn/umn/en-us_topic_0142373840.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
Are SSL VPNs Supported?
-
Currently, the VPN service does not support the SSL VPNs.
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0160974607.html b/docs/vpn/umn/en-us_topic_0160974607.html
deleted file mode 100644
index 629362b6..00000000
--- a/docs/vpn/umn/en-us_topic_0160974607.html
+++ /dev/null
@@ -1,41 +0,0 @@
-
-
-
IPsec VPN
-
The Internet Protocol Security (IPsec) VPN is an encrypted tunneling technology that uses encrypted security services to establish confidential and secure communication tunnels between different networks.
-
In Figure 1, a VPC has two subnets: 192.168.1.0/24 and 192.168.2.0/24. On your router deployed in your physical data center, you also have two subnets:192.168.3.0/24 and 192.168.4.0/24. You can use VPN to enable subnets in your VPC to communicate with those in your data center.
-
Figure 1 IPsec VPN
-
Currently, the site-to-site VPN and hub-spoke VPN are supported. You need to set up VPNs in both your data center and the VPC to establish the VPN connection.
-
You must ensure that the VPN in your VPC and that in your data center use the same IKE and IPsec policy configurations. Before creating a VPN, familiarize yourself with the protocols described in Table 1 and ensure that your device meets the requirements and configuration constraints of the involved protocols.
-
-
Table 1 Involved protocolsProtocol
- |
-Description
- |
-Constraint
- |
-
|---|
-
-RFC 2409
- |
-Defines the IKE protocol, which negotiates and verifies key information to safeguard VPNs.
- |
-- Use the pre-shared key (PSK) to reach an IKE peer agreement.
- Use the main mode for negotiation.
- |
-
-RFC 4301
- |
-Defines the IPsec architecture, the security services that IPsec offers, and the collaboration between components.
- |
-Use the IPsec tunnel to set up a VPN connection.
- |
-
-
-
-
-
-
-
diff --git a/docs/vpn/umn/en-us_topic_0185622695.html b/docs/vpn/umn/en-us_topic_0185622695.html
deleted file mode 100644
index 3578a999..00000000
--- a/docs/vpn/umn/en-us_topic_0185622695.html
+++ /dev/null
@@ -1,22 +0,0 @@
-
-
-
Region and AZ
-
Concept
A region and availability zone (AZ) identify the location of a data center. You can create resources in a specific region and AZ.
-
- A region is a physical data center, which is completely isolated to improve fault tolerance and stability. The region that is selected during resource creation cannot be changed after the resource is created.
- An AZ is a physical location where resources use independent power supplies and networks. A region contains one or more AZs that are physically isolated but interconnected through internal networks. Because AZs are isolated from each other, any fault that occurs in an AZ will not affect other AZs.
-
Figure 1 shows the relationship between regions and AZs.
-
Figure 1 Regions and AZs
-
-
Selecting a Region
Select a region closest to your target users for low network latency and quick access.
-
-
Selecting an AZ
When deploying resources, consider your applications' requirements on disaster recovery (DR) and network latency.
-
- For high DR capability, deploy resources in different AZs within the same region.
- For low network latency, deploy resources in the same AZ.
-
-
Regions and Endpoints
Before you use an API to call resources, specify its region and endpoint. For more details, see Regions and Endpoints.
-
-
-
-
diff --git a/docs/vpn/umn/en-us_image_0184026531.png b/docs/vpn/umn/figure/en-us_image_0000001542015014.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0184026531.png
rename to docs/vpn/umn/figure/en-us_image_0000001542015014.png
diff --git a/docs/vpn/umn/en-us_image_0107432228.png b/docs/vpn/umn/figure/en-us_image_0000001542015046.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0107432228.png
rename to docs/vpn/umn/figure/en-us_image_0000001542015046.png
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542174442.png b/docs/vpn/umn/figure/en-us_image_0000001542174442.png
new file mode 100644
index 00000000..0e4547df
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542174442.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542174462.png b/docs/vpn/umn/figure/en-us_image_0000001542174462.png
new file mode 100644
index 00000000..49d6b08f
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542174462.png differ
diff --git a/docs/vpn/umn/en-us_image_0152926732.png b/docs/vpn/umn/figure/en-us_image_0000001542334190.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0152926732.png
rename to docs/vpn/umn/figure/en-us_image_0000001542334190.png
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542334206.png b/docs/vpn/umn/figure/en-us_image_0000001542334206.png
new file mode 100644
index 00000000..0e4547df
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542334206.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542334214.png b/docs/vpn/umn/figure/en-us_image_0000001542334214.png
new file mode 100644
index 00000000..b63464b8
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542334214.png differ
diff --git a/docs/vpn/umn/en-us_image_0118696493.png b/docs/vpn/umn/figure/en-us_image_0000001542334238.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0118696493.png
rename to docs/vpn/umn/figure/en-us_image_0000001542334238.png
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542493866.jpg b/docs/vpn/umn/figure/en-us_image_0000001542493866.jpg
new file mode 100644
index 00000000..13fa7894
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542493866.jpg differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542494126.png b/docs/vpn/umn/figure/en-us_image_0000001542494126.png
new file mode 100644
index 00000000..0e4547df
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542494126.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001542494178.png b/docs/vpn/umn/figure/en-us_image_0000001542494178.png
new file mode 100644
index 00000000..8236d3cf
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001542494178.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001592573989.png b/docs/vpn/umn/figure/en-us_image_0000001592573989.png
new file mode 100644
index 00000000..2ce24f4a
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001592573989.png differ
diff --git a/docs/vpn/umn/en-us_image_0152727234.png b/docs/vpn/umn/figure/en-us_image_0000001592574041.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0152727234.png
rename to docs/vpn/umn/figure/en-us_image_0000001592574041.png
diff --git a/docs/vpn/umn/figure/en-us_image_0000001592694309.png b/docs/vpn/umn/figure/en-us_image_0000001592694309.png
new file mode 100644
index 00000000..9b9dc88c
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001592694309.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001592773953.png b/docs/vpn/umn/figure/en-us_image_0000001592773953.png
new file mode 100644
index 00000000..0e4547df
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001592773953.png differ
diff --git a/docs/vpn/umn/en-us_image_0118696764.png b/docs/vpn/umn/figure/en-us_image_0000001592773969.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0118696764.png
rename to docs/vpn/umn/figure/en-us_image_0000001592773969.png
diff --git a/docs/vpn/umn/figure/en-us_image_0000001592774029.png b/docs/vpn/umn/figure/en-us_image_0000001592774029.png
new file mode 100644
index 00000000..80a6105d
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001592774029.png differ
diff --git a/docs/vpn/umn/en-us_image_0118696766.png b/docs/vpn/umn/figure/en-us_image_0000001592879209.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0118696766.png
rename to docs/vpn/umn/figure/en-us_image_0000001592879209.png
diff --git a/docs/vpn/umn/en-us_image_0123091916.png b/docs/vpn/umn/figure/en-us_image_0000001592879265.png
similarity index 100%
rename from docs/vpn/umn/en-us_image_0123091916.png
rename to docs/vpn/umn/figure/en-us_image_0000001592879265.png
diff --git a/docs/vpn/umn/figure/en-us_image_0000001592879273.png b/docs/vpn/umn/figure/en-us_image_0000001592879273.png
new file mode 100644
index 00000000..ec23c730
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001592879273.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001592879305.png b/docs/vpn/umn/figure/en-us_image_0000001592879305.png
new file mode 100644
index 00000000..f0916b28
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001592879305.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001594572920.png b/docs/vpn/umn/figure/en-us_image_0000001594572920.png
new file mode 100644
index 00000000..f67072b4
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001594572920.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001609202724.png b/docs/vpn/umn/figure/en-us_image_0000001609202724.png
new file mode 100644
index 00000000..7d1d2343
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001609202724.png differ
diff --git a/docs/vpn/umn/en-us_image_0141273034.png b/docs/vpn/umn/figure/en-us_image_0000001628070572.png
similarity index 76%
rename from docs/vpn/umn/en-us_image_0141273034.png
rename to docs/vpn/umn/figure/en-us_image_0000001628070572.png
index 1909444d..57e8d5b5 100644
Binary files a/docs/vpn/umn/en-us_image_0141273034.png and b/docs/vpn/umn/figure/en-us_image_0000001628070572.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001651244201.png b/docs/vpn/umn/figure/en-us_image_0000001651244201.png
new file mode 100644
index 00000000..b60f433a
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001651244201.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001841927836.png b/docs/vpn/umn/figure/en-us_image_0000001841927836.png
new file mode 100644
index 00000000..5fbecc8f
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001841927836.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001841932888.png b/docs/vpn/umn/figure/en-us_image_0000001841932888.png
new file mode 100644
index 00000000..7ee442db
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001841932888.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001842101730.png b/docs/vpn/umn/figure/en-us_image_0000001842101730.png
new file mode 100644
index 00000000..af51b0d1
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001842101730.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001867256192.png b/docs/vpn/umn/figure/en-us_image_0000001867256192.png
new file mode 100644
index 00000000..888039ca
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001867256192.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001877145402.png b/docs/vpn/umn/figure/en-us_image_0000001877145402.png
new file mode 100644
index 00000000..036e0302
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001877145402.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001878270362.png b/docs/vpn/umn/figure/en-us_image_0000001878270362.png
new file mode 100644
index 00000000..692e4cd6
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001878270362.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001878346114.png b/docs/vpn/umn/figure/en-us_image_0000001878346114.png
new file mode 100644
index 00000000..95b64e8a
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001878346114.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001883151862.png b/docs/vpn/umn/figure/en-us_image_0000001883151862.png
new file mode 100644
index 00000000..813cb808
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001883151862.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001883323518.png b/docs/vpn/umn/figure/en-us_image_0000001883323518.png
new file mode 100644
index 00000000..97fcfe07
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001883323518.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001888091881.png b/docs/vpn/umn/figure/en-us_image_0000001888091881.png
new file mode 100644
index 00000000..10339bd1
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001888091881.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001888093441.png b/docs/vpn/umn/figure/en-us_image_0000001888093441.png
new file mode 100644
index 00000000..f6474c87
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001888093441.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001888117061.png b/docs/vpn/umn/figure/en-us_image_0000001888117061.png
new file mode 100644
index 00000000..2c98cae5
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001888117061.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001888252021.png b/docs/vpn/umn/figure/en-us_image_0000001888252021.png
new file mode 100644
index 00000000..3e503f51
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001888252021.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001903603225.png b/docs/vpn/umn/figure/en-us_image_0000001903603225.png
new file mode 100644
index 00000000..6c15d401
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001903603225.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001911324937.png b/docs/vpn/umn/figure/en-us_image_0000001911324937.png
new file mode 100644
index 00000000..7b53acd5
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001911324937.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001923096425.png b/docs/vpn/umn/figure/en-us_image_0000001923096425.png
new file mode 100644
index 00000000..09eb3a1d
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001923096425.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001924344277.png b/docs/vpn/umn/figure/en-us_image_0000001924344277.png
new file mode 100644
index 00000000..692e4cd6
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001924344277.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001929162353.png b/docs/vpn/umn/figure/en-us_image_0000001929162353.png
new file mode 100644
index 00000000..f9876318
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001929162353.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001960951864.png b/docs/vpn/umn/figure/en-us_image_0000001960951864.png
new file mode 100644
index 00000000..afe1ac0f
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001960951864.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001970660305.png b/docs/vpn/umn/figure/en-us_image_0000001970660305.png
new file mode 100644
index 00000000..3d3c59d8
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001970660305.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001972602221.png b/docs/vpn/umn/figure/en-us_image_0000001972602221.png
new file mode 100644
index 00000000..3936a646
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001972602221.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001972697961.png b/docs/vpn/umn/figure/en-us_image_0000001972697961.png
new file mode 100644
index 00000000..b018a7ab
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001972697961.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001972699077.png b/docs/vpn/umn/figure/en-us_image_0000001972699077.png
new file mode 100644
index 00000000..5443f913
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001972699077.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001976650417.png b/docs/vpn/umn/figure/en-us_image_0000001976650417.png
new file mode 100644
index 00000000..7267525c
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001976650417.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987376506.png b/docs/vpn/umn/figure/en-us_image_0000001987376506.png
new file mode 100644
index 00000000..975599da
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987376506.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987536262.png b/docs/vpn/umn/figure/en-us_image_0000001987536262.png
new file mode 100644
index 00000000..814c2985
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987536262.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987536950.png b/docs/vpn/umn/figure/en-us_image_0000001987536950.png
new file mode 100644
index 00000000..6e6e8f3b
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987536950.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987537386.png b/docs/vpn/umn/figure/en-us_image_0000001987537386.png
new file mode 100644
index 00000000..a910a0dd
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987537386.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987537886.png b/docs/vpn/umn/figure/en-us_image_0000001987537886.png
new file mode 100644
index 00000000..f500f182
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987537886.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987560070.png b/docs/vpn/umn/figure/en-us_image_0000001987560070.png
new file mode 100644
index 00000000..65f49897
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987560070.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000001987560190.png b/docs/vpn/umn/figure/en-us_image_0000001987560190.png
new file mode 100644
index 00000000..b756b900
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000001987560190.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000002023936425.png b/docs/vpn/umn/figure/en-us_image_0000002023936425.png
new file mode 100644
index 00000000..0284f7b2
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000002023936425.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000002023936993.png b/docs/vpn/umn/figure/en-us_image_0000002023936993.png
new file mode 100644
index 00000000..71046077
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000002023936993.png differ
diff --git a/docs/vpn/umn/figure/en-us_image_0000002024056937.png b/docs/vpn/umn/figure/en-us_image_0000002024056937.png
new file mode 100644
index 00000000..1306d7e9
Binary files /dev/null and b/docs/vpn/umn/figure/en-us_image_0000002024056937.png differ
diff --git a/docs/vpn/umn/public_sys-resources/ExpandCollapse.js b/docs/vpn/umn/public_sys-resources/ExpandCollapse.js
index 116ddaab..c281dc99 100644
--- a/docs/vpn/umn/public_sys-resources/ExpandCollapse.js
+++ b/docs/vpn/umn/public_sys-resources/ExpandCollapse.js
@@ -1 +1 @@
-var expandClassName="dropdownexpand";var collapseClassName="dropdowncollapse";var collapseTableClassName="dropdowncollapsetable";function ExpandorCollapseNode(a){a=a.parentNode;if(a.className==expandClassName){a.className=collapseClassName}else{a.className=expandClassName}}function ExpandorCollapseTableNode(a){a=a.parentNode;if(a.className==expandClassName){a.className=collapseTableClassName}else{a.className=expandClassName}}function ExpandorCollapseAllNodes(g,h,c){var a=g.getAttribute("title");var b=g.parentNode;if(a=="collapse"){g.setAttribute("title","expand");g.className="dropdownAllButtonexpand";g.innerHTML=h}else{g.setAttribute("title","collapse");g.className="dropdownAllButtoncollapse";g.innerHTML=c}var f=b.getElementsByTagName("*");for(var d=0;d
-1){ExpandForHref(a.substring(a.lastIndexOf("#")+1))}}catch(c){}};
\ No newline at end of file
+var collapseTableClassName="dropdowncollapsetable";var collapseClassName="dropdowncollapse";var expandClassName="dropdownexpand";function ExpandorCollapseNode(a){a=a.parentNode;if(a.className==expandClassName){a.className=collapseClassName}else{a.className=expandClassName}}function ExpandorCollapseTableNode(a){a=a.parentNode;if(a.className==expandClassName){a.className=collapseTableClassName}else{a.className=expandClassName}}function ExpandorCollapseAllNodes(g,h,c){var a=g.getAttribute("title");var b=g.parentNode;if(a=="collapse"){g.setAttribute("title","expand");g.className="dropdownAllButtonexpand";g.innerHTML=h}else{g.setAttribute("title","collapse");g.className="dropdownAllButtoncollapse";g.innerHTML=c}var f=b.getElementsByTagName("*");for(var d=0;d-1){ExpandForHref(a.substring(a.lastIndexOf("#")+1))}}window.onload=function(){var b=document.getElementsByTagName("div");for(var c=0;c-1){ExpandForHref(a.substring(a.lastIndexOf("#")+1))}}catch(c){}};
\ No newline at end of file
diff --git a/docs/vpn/umn/public_sys-resources/commonrtl.css b/docs/vpn/umn/public_sys-resources/commonrtl.css
index f261da75..947a9a03 100644
--- a/docs/vpn/umn/public_sys-resources/commonrtl.css
+++ b/docs/vpn/umn/public_sys-resources/commonrtl.css
@@ -1,2 +1,2 @@
-/*! Copyright (c) Huawei Technologies Co., Ltd. 2020-2022. All rights reserved. */.msgph{font-family:Courier New}.unresolved{background-color:#87ceeb}.noTemplate{background-color:#ff0}.base{background-color:#fff}/*! Add space for top level topics */.nested0,.p{margin-top:1em}/*! div with class=p is used for paragraphs that contain blocks, to keep the XHTML valid *//*! Default of italics to set apart figure captions */.figcap,.italic,.var{font-style:italic}.figdesc{font-style:normal}/*! Use @frame to create frames on figures */.figborder{padding-left:3px;padding-right:3px;margin-top:1em;border:2px solid Silver}.figsides{margin-top:1em;padding-left:3px;padding-right:3px;border-left:2px solid Silver;border-right:2px solid Silver}.figtop{border-top:2px solid Silver;margin-top:1em}.figbottom{border-bottom:2px solid Silver}.figtopbot{border-top:2px solid Silver;border-bottom:2px solid Silver;margin-top:1em}/*! Most link groups are created with . Ensure they have space before and after. */.ullinks,ul.simple{list-style-type:none}.attention,.danger,.ddexpand,.dlexpand,.example,.fastpath,.important,.liexpand,.linklist,.note,.notice,.olchildlink,.relconcepts,.relinfo,.relref,.reltasks,.remember,.restriction,.section,.sliexpand,.stepexpand,.substepexpand,.tip,.ulchildlink,.warning{margin-top:1em;margin-bottom:1em}.linklistwithchild,.sublinklist{margin-top:1em;margin-right:1.5em;margin-bottom:1em}.breadcrumb{font-size:smaller;margin-bottom:1em}.prereq{margin-right:20px}/*! Set heading sizes, getting smaller for deeper nesting */.topictitle1{font-size:1.34em;margin-top:0;margin-bottom:.1em}.topictitle2,.topictitle3,.topictitle4,.topictitle5,.topictitle6,.sectiontitle{font-size:1.17em}.topictitle2{margin-top:1pc;margin-bottom:.45em}.topictitle3{margin-top:1pc;margin-bottom:.17em;font-weight:700}.topictitle4{margin-top:.83em;font-weight:700}.topictitle5{font-weight:700}.topictitle6{font-style:italic}.sectiontitle{margin-top:1em;margin-bottom:0;color:#000;font-weight:700}/*! All note formats have the same default presentation */.attentiontitle,.bold,.cautiontitle,.dangertitle,.dlterm,.fastpathtitle,.firstcol,.importanttitle,.notelisttitle,.notetitle,.noticetitle,.parmname,.remembertitle,.restrictiontitle,.tiptitle,.uicontrol,.warningtitle{font-weight:700}.caution{font-weight:700;margin-bottom:1em}/*! Simple lists do not get a bullet *//*! Used on the first column of a table, when rowheader="firstcol" is used *//*! Various basic phrase styles */.boldItalic{font-weight:700;font-style:italic}.shortcut,.underlined{text-decoration:underline}/*! 2008-10-27 keyword采用跟随上下文的样式
+.msgph{font-family:Courier New}.unresolved{background-color:#87ceeb}.noTemplate{background-color:#ff0}.base{background-color:#fff}/*! Add space for top level topics */.nested0,.p{margin-top:1em}/*! div with class=p is used for paragraphs that contain blocks, to keep the XHTML valid *//*! Default of italics to set apart figure captions */.figcap,.italic,.var{font-style:italic}.figdesc{font-style:normal}/*! Use @frame to create frames on figures */.figborder{padding-left:3px;padding-right:3px;margin-top:1em;border:2px solid Silver}.figsides{margin-top:1em;padding-left:3px;padding-right:3px;border-left:2px solid Silver;border-right:2px solid Silver}.figtop{border-top:2px solid Silver;margin-top:1em}.figbottom{border-bottom:2px solid Silver}.figtopbot{border-top:2px solid Silver;border-bottom:2px solid Silver;margin-top:1em}/*! Most link groups are created with
. Ensure they have space before and after. */.ullinks,ul.simple{list-style-type:none}.attention,.danger,.ddexpand,.dlexpand,.example,.fastpath,.important,.liexpand,.linklist,.note,.notice,.olchildlink,.relconcepts,.relinfo,.relref,.reltasks,.remember,.restriction,.section,.sliexpand,.stepexpand,.substepexpand,.tip,.ulchildlink,.warning{margin-top:1em;margin-bottom:1em}.linklistwithchild,.sublinklist{margin-top:1em;margin-right:1.5em;margin-bottom:1em}.breadcrumb{font-size:smaller;margin-bottom:1em}.prereq{margin-right:20px}/*! Set heading sizes, getting smaller for deeper nesting */.topictitle1{font-size:1.34em;margin-top:0;margin-bottom:.1em}.topictitle2,.topictitle3,.topictitle4,.topictitle5,.topictitle6,.sectiontitle{font-size:1.17em}.topictitle2{margin-top:1pc;margin-bottom:.45em}.topictitle3{margin-top:1pc;margin-bottom:.17em;font-weight:700}.topictitle4{margin-top:.83em;font-weight:700}.topictitle5{font-weight:700}.topictitle6{font-style:italic}.sectiontitle{margin-top:1em;margin-bottom:0;color:#000;font-weight:700}/*! All note formats have the same default presentation */.attentiontitle,.bold,.cautiontitle,.dangertitle,.dlterm,.fastpathtitle,.firstcol,.importanttitle,.notelisttitle,.notetitle,.noticetitle,.parmname,.remembertitle,.restrictiontitle,.tiptitle,.uicontrol,.warningtitle{font-weight:700}.caution{font-weight:700;margin-bottom:1em}/*! Simple lists do not get a bullet *//*! Used on the first column of a table, when rowheader="firstcol" is used *//*! Various basic phrase styles */.boldItalic{font-weight:700;font-style:italic}.shortcut,.underlined{text-decoration:underline}/*! 2008-10-27 keyword采用跟随上下文的样式
*//*! Default of bold for definition list terms *//*! Use CSS to expand lists with @compact="no" */.dltermexpand{font-weight:700;margin-top:1em}[compact="yes"]>li{margin-top:0}[compact="no"]>li{margin-top:.53em}/*! Align images based on @align on topic/image */div.imageleft,.text-align-left{text-align:left}div.imagecenter,.text-align-center{text-align:center}div.imageright,.text-align-right{text-align:right}div.imagejustify,.text-align-justify{text-align:justify}.cellrowborder{border-right:0;border-top:0;border-left:1px solid;border-bottom:1px solid}.row-nocellborder{border-left:hidden;border-right:0;border-top:0;border-bottom:1px solid}.cell-norowborder{border-top:0;border-bottom:hidden;border-right:0;border-left:1px solid}.nocellnorowborder{border:0;border-left:hidden;border-bottom:hidden}pre.codeblock,pre.screen{padding:5px;border:outset;background-color:#ccc;margin-top:2px;margin-bottom:2px;white-space:pre}
\ No newline at end of file
diff --git a/docs/vpn/umn/public_sys-resources/imageclose.gif b/docs/vpn/umn/public_sys-resources/imageclose.gif
new file mode 100644
index 00000000..3a3344af
Binary files /dev/null and b/docs/vpn/umn/public_sys-resources/imageclose.gif differ
diff --git a/docs/vpn/umn/public_sys-resources/imageclosehover.gif b/docs/vpn/umn/public_sys-resources/imageclosehover.gif
new file mode 100644
index 00000000..8699d5e3
Binary files /dev/null and b/docs/vpn/umn/public_sys-resources/imageclosehover.gif differ
diff --git a/docs/vpn/umn/public_sys-resources/imagemax.gif b/docs/vpn/umn/public_sys-resources/imagemax.gif
new file mode 100644
index 00000000..99c07dc2
Binary files /dev/null and b/docs/vpn/umn/public_sys-resources/imagemax.gif differ
diff --git a/docs/vpn/umn/public_sys-resources/imagemaxhover.gif b/docs/vpn/umn/public_sys-resources/imagemaxhover.gif
new file mode 100644
index 00000000..d01d77d6
Binary files /dev/null and b/docs/vpn/umn/public_sys-resources/imagemaxhover.gif differ
diff --git a/docs/vpn/umn/public_sys-resources/macFFBgHack.png b/docs/vpn/umn/public_sys-resources/macFFBgHack.png
new file mode 100644
index 00000000..ec811470
Binary files /dev/null and b/docs/vpn/umn/public_sys-resources/macFFBgHack.png differ
diff --git a/docs/vpn/umn/public_sys-resources/popup.js b/docs/vpn/umn/public_sys-resources/popup.js
index a550862e..bae3e929 100644
--- a/docs/vpn/umn/public_sys-resources/popup.js
+++ b/docs/vpn/umn/public_sys-resources/popup.js
@@ -1 +1 @@
-var i=0;var dhtmlgoodies_tooltipFlag=false;var dhtmlgoodies_tooltip="";var dhtmlgoodies_tooltipShadow="";var dhtmlgoodies_shadowSize=3;var dhtmlgoodies_tooltipMaxWidth=500;var dhtmlgoodies_tooltipMinWidth=100;var dhtmlgoodies_iframe=false;var timeId;var clickFlag=false;var tooltip_is_msie=(navigator.userAgent.indexOf("MSIE")>=0&&navigator.userAgent.indexOf("opera")==-1&&document.all)?true:false;var xPos;var yPos;window.document.onmousemove=function(a){a=a||window.event;if(a.pageX){xPos=a.pageX;yPos=a.pageY}else{if(document.body!==null&&typeof document.body!=="undefined"){xPos=a.clientX+document.body.scrollLeft-document.body.clientLeft;yPos=a.clientY+document.body.scrollTop-document.body.clientTop}}};function showTooltip(e){if(document.body===null||typeof document.body==="undefined"){return}if(i==0){return}clickFlag=true;var f=Json.parse("jsonData."+e);var a=Math.max(document.body.clientWidth,document.documentElement.clientWidth)-20;if(!dhtmlgoodies_tooltipFlag){dhtmlgoodies_tooltip=document.createElement("DIV");dhtmlgoodies_tooltip.id="dhtmlgoodies_tooltip";dhtmlgoodies_tooltipShadow=document.createElement("DIV");dhtmlgoodies_tooltipShadow.id="dhtmlgoodies_tooltipShadow";document.body.appendChild(dhtmlgoodies_tooltip);document.body.appendChild(dhtmlgoodies_tooltipShadow);if(tooltip_is_msie){dhtmlgoodies_iframe=document.createElement("IFRAME");dhtmlgoodies_iframe.frameborder="5";dhtmlgoodies_iframe.style.backgroundColor="#FFFFFF";dhtmlgoodies_iframe.src="#";dhtmlgoodies_iframe.style.zIndex=100;dhtmlgoodies_iframe.style.position="absolute";document.body.appendChild(dhtmlgoodies_iframe)}}dhtmlgoodies_tooltip.style.display="block";dhtmlgoodies_tooltipShadow.style.display="block";if(tooltip_is_msie){dhtmlgoodies_iframe.style.display="block"}var b=Math.max(document.body.scrollTop,document.documentElement.scrollTop);if(navigator.userAgent.toLowerCase().indexOf("safari")>=0){b=0}var c=xPos+10;dhtmlgoodies_tooltip.style.width=null;dhtmlgoodies_tooltip.innerHTML=f;dhtmlgoodies_tooltip.style.left=c+"px";if(tooltip_is_msie){dhtmlgoodies_tooltip.style.top=yPos+20+b+"px"}else{dhtmlgoodies_tooltip.style.top=yPos+20+"px"}dhtmlgoodies_tooltipShadow.style.left=c+dhtmlgoodies_shadowSize+"px";if(tooltip_is_msie){dhtmlgoodies_tooltipShadow.style.top=yPos+20+b+dhtmlgoodies_shadowSize+"px"}else{dhtmlgoodies_tooltipShadow.style.top=yPos+20+dhtmlgoodies_shadowSize+"px"}if(dhtmlgoodies_tooltip.offsetWidth>dhtmlgoodies_tooltipMaxWidth){dhtmlgoodies_tooltip.style.width=dhtmlgoodies_tooltipMaxWidth+"px"}var d=dhtmlgoodies_tooltip.offsetWidth;if(d
a){dhtmlgoodies_tooltip.style.left=(dhtmlgoodies_tooltipShadow.style.left.replace("px","")-((c+d)-a))+"px";dhtmlgoodies_tooltipShadow.style.left=(dhtmlgoodies_tooltipShadow.style.left.replace("px","")-((c+d)-a)+dhtmlgoodies_shadowSize)+"px"}if(tooltip_is_msie){dhtmlgoodies_iframe.style.left=dhtmlgoodies_tooltip.style.left;dhtmlgoodies_iframe.style.top=dhtmlgoodies_tooltip.style.top;dhtmlgoodies_iframe.style.width=dhtmlgoodies_tooltip.offsetWidth+"px";dhtmlgoodies_iframe.style.height=dhtmlgoodies_tooltip.offsetHeight+"px"}}function hideTooltip(){i=0;clickFlag=false;if((dhtmlgoodies_tooltip!==null&&typeof dhtmlgoodies_tooltip!=="undefined")&&+(dhtmlgoodies_tooltip.style!==null&&typeof dhtmlgoodies_tooltip.style!=="undefined")){dhtmlgoodies_tooltip.style.display="none";dhtmlgoodies_tooltipShadow.style.display="none";if(tooltip_is_msie){dhtmlgoodies_iframe.style.display="none"}}if(timeId!==null&&typeof timeId!=="undefined"&&timeId!=""){clearTimeout(timeId)}}function showText(a){i=1;timeId=setTimeout(function(){showTooltip(a)},500)}function showText2(a){if(!clickFlag){i=1;showTooltip(a);i=0;if(timeId!==null&&typeof timeId!=="undefined"&&timeId!=""){clearTimeout(timeId)}}}function anchorScroll(b){var d=document.getElementsByName(b);if(d!=null&&d.length>0){var c=d[0];var a=c.getBoundingClientRect().left+(document.body.scrollLeft||(document.documentElement&&document.documentElement.scrollLeft));var e=c.getBoundingClientRect().top+(document.body.scrollTop||(document.documentElement&&document.documentElement.scrollTop));window.scrollTo(a,e-30)}};
\ No newline at end of file
+var i=0;var dhtmlgoodies_tooltip="";var dhtmlgoodies_tooltipFlag=false;var dhtmlgoodies_shadowSize=3;var dhtmlgoodies_tooltipShadow="";var dhtmlgoodies_tooltipMinWidth=100;var dhtmlgoodies_tooltipMaxWidth=500;var timeId;var dhtmlgoodies_iframe=false;var tooltip_is_msie=(navigator.userAgent.indexOf("MSIE")>=0&&navigator.userAgent.indexOf("opera")==-1&&document.all)?true:false;var clickFlag=false;var yPos;var xPos;window.document.onmousemove=function(a){a=a||window.event;if(a.pageX){yPos=a.pageY;xPos=a.pageX}else{if(document.body!==null&&typeof document.body!=="undefined"){yPos=a.clientY+document.body.scrollTop-document.body.clientTop;xPos=a.clientX+document.body.scrollLeft-document.body.clientLeft}}};function showTooltip(e){if(document.body===null||typeof document.body==="undefined"||i==0){return}clickFlag=true;var f=Json.parse("jsonData."+e);var a=Math.max(document.body.clientWidth,document.documentElement.clientWidth)-20;if(!dhtmlgoodies_tooltipFlag){dhtmlgoodies_tooltipShadow=document.createElement("DIV");dhtmlgoodies_tooltipShadow.id="dhtmlgoodies_tooltipShadow";dhtmlgoodies_tooltip=document.createElement("DIV");dhtmlgoodies_tooltip.id="dhtmlgoodies_tooltip";document.body.appendChild(dhtmlgoodies_tooltip);document.body.appendChild(dhtmlgoodies_tooltipShadow);if(tooltip_is_msie){dhtmlgoodies_iframe=document.createElement("IFRAME");dhtmlgoodies_iframe.style.backgroundColor="#FFFFFF";dhtmlgoodies_iframe.frameborder="5";dhtmlgoodies_iframe.src="#";dhtmlgoodies_iframe.style.position="absolute";dhtmlgoodies_iframe.style.zIndex=100;document.body.appendChild(dhtmlgoodies_iframe)}}dhtmlgoodies_tooltipShadow.style.display="block";dhtmlgoodies_tooltip.style.display="block";if(tooltip_is_msie){dhtmlgoodies_iframe.style.display="block"}var b=Math.max(document.body.scrollTop,document.documentElement.scrollTop);if(navigator.userAgent.toLowerCase().indexOf("safari")>=0){b=0}dhtmlgoodies_tooltip.style.width=null;dhtmlgoodies_tooltip.innerHTML=f;var c=xPos+10;dhtmlgoodies_tooltip.style.left=c+"px";if(tooltip_is_msie){dhtmlgoodies_tooltip.style.top=yPos+20+b+"px"}else{dhtmlgoodies_tooltip.style.top=yPos+20+"px"}dhtmlgoodies_tooltipShadow.style.left=c+dhtmlgoodies_shadowSize+"px";if(tooltip_is_msie){dhtmlgoodies_tooltipShadow.style.top=yPos+20+b+dhtmlgoodies_shadowSize+"px"}else{dhtmlgoodies_tooltipShadow.style.top=yPos+20+dhtmlgoodies_shadowSize+"px"}if(dhtmlgoodies_tooltip.offsetWidth>dhtmlgoodies_tooltipMaxWidth){dhtmlgoodies_tooltip.style.width=dhtmlgoodies_tooltipMaxWidth+"px"}var d=dhtmlgoodies_tooltip.offsetWidth;if(da){dhtmlgoodies_tooltip.style.left=(dhtmlgoodies_tooltipShadow.style.left.replace("px","")-((c+d)-a))+"px";dhtmlgoodies_tooltipShadow.style.left=(dhtmlgoodies_tooltipShadow.style.left.replace("px","")-((c+d)-a)+dhtmlgoodies_shadowSize)+"px"}if(tooltip_is_msie){dhtmlgoodies_iframe.style.top=dhtmlgoodies_tooltip.style.top;dhtmlgoodies_iframe.style.left=dhtmlgoodies_tooltip.style.left;dhtmlgoodies_iframe.style.height=dhtmlgoodies_tooltip.offsetHeight+"px";dhtmlgoodies_iframe.style.width=dhtmlgoodies_tooltip.offsetWidth+"px"}}function hideTooltip(){i=0;clickFlag=false;if((dhtmlgoodies_tooltip!==null&&typeof dhtmlgoodies_tooltip!=="undefined")&&+(dhtmlgoodies_tooltip.style!==null&&typeof dhtmlgoodies_tooltip.style!=="undefined")){dhtmlgoodies_tooltip.style.display="none";dhtmlgoodies_tooltipShadow.style.display="none";if(tooltip_is_msie){dhtmlgoodies_iframe.style.display="none"}}if(timeId!==null&&typeof timeId!=="undefined"&&timeId!=""){clearTimeout(timeId)}}function showText(a){i=1;timeId=setTimeout(function(){showTooltip(a)},500)}function showText2(a){if(!clickFlag){i=1;showTooltip(a);i=0;if(timeId!==null&&typeof timeId!=="undefined"&&timeId!=""){clearTimeout(timeId)}}}function anchorScroll(b){var d=document.getElementsByName(b);if(d!=null&&d.length>0){var c=d[0];var a=c.getBoundingClientRect().left+(document.body.scrollLeft||(document.documentElement&&document.documentElement.scrollLeft));var e=c.getBoundingClientRect().top+(document.body.scrollTop||(document.documentElement&&document.documentElement.scrollTop));window.scrollTo(a,e-30)}};
\ No newline at end of file
diff --git a/docs/vpn/umn/vpn_01_0000.html b/docs/vpn/umn/vpn_01_0000.html
new file mode 100644
index 00000000..c9b98246
--- /dev/null
+++ b/docs/vpn/umn/vpn_01_0000.html
@@ -0,0 +1,29 @@
+
+
+Overview
+
+
+
diff --git a/docs/vpn/umn/vpn_01_0002.html b/docs/vpn/umn/vpn_01_0002.html
new file mode 100644
index 00000000..ede6de73
--- /dev/null
+++ b/docs/vpn/umn/vpn_01_0002.html
@@ -0,0 +1,26 @@
+
+
+Product Advantages
+Enterprise Edition VPN has the following advantages:
+
- High security
- Data is encrypted using IKE/IPsec, ensuring high data security.
- A VPN gateway is exclusive to a tenant, isolating tenants from each other.
+ - High availability
- A VPN gateway provides two IP addresses to establish dual independent VPN connections with a customer gateway. If one VPN connection fails, traffic can be quickly switched to the other VPN connection.
- Active-active gateways are deployed in different availability zones (AZs) to ensure AZ-level high availability.
- Active/Standby mode: In normal cases, a VPN gateway communicates with a customer gateway through the active connection. If the active connection fails, traffic is automatically switched to the standby VPN connection. After the fault is rectified, traffic is switched back to the active VPN connection.
+ - Cost-effectiveness
- IPsec connections over the Internet provide a cost-effective alternative to Direct Connect.
- A VPN gateway can be bound to elastic IP addresses (EIPs) that share bandwidth, reducing bandwidth costs.
- The bandwidth can be adjusted when an EIP instance is created.
+
+
- Easy to use
- A VPN gateway supports multiple connection modes, including policy-based, static routing, and BGP routing, to meet different access requirements of customer gateways.
- A VPN gateway on the cloud can function as a VPN hub, enabling on-premises branch sites to access each other.
- A VPN connection can be created in a few simple steps on the VPN device in an on-premises data center and on the VPN console, and is ready to use immediately after being created.
- VPN can be used together with the enterprise router service, allowing enterprises to build more flexible cloud-based networks.
- Private VPN gateways are supported to encrypt traffic transmitted over Direct Connect connections, improving data transmission security.
+
+
Classic VPN has the following advantages:
+
- High security
Dedicated devices are used to encrypt data through IKE and IPsec protocols, offering carrier-class reliability and ensuring stable VPN connections from perspectives of hardware, software, and links.
+
+
+
+
+
Quotas and Limitations
+VPN Gateway
+
Table 1 Constraints on Enterprise Edition VPN gatewaysVPN Type
+ |
+Resource
+ |
+Default Quota
+ |
+
|---|
+
+Enterprise Edition VPN
+ |
+VPN gateways per tenant in each region
+ |
+50
+- If you have only one VPC, you can create a maximum of 50 VPN gateways for the VPC.
- If you have multiple VPCs, you can create a maximum of 50 VPN gateways for all these VPCs.
+ |
+
+Enterprise Edition VPN
+ |
+VPN connection groups per VPN gateway
+ |
+100
+ |
+
+Enterprise Edition VPN
+ |
+Local subnets per VPN gateway
+ |
+50
+ |
+
+Enterprise Edition VPN
+ |
+Number of BGP routes that a VPN gateway can receive from a customer gateway through a connection
+ |
+100
+ |
+
+
+
+
+
+
Table 2 Constraints on Classic VPNVPN Type
+ |
+Resource
+ |
+Default Quota
+ |
+
|---|
+
+Classic VPN
+ |
+VPNs per tenant in each region
+ |
+2
+Only one VPN can be created for a VPC.
+ |
+
+
+
+
+
- By default, the maximum length of TCP packets supported by a VPN gateway is 1300 bytes.
+
+
Customer Gateway
+
Table 3 Constraints on customer gatewaysVPN Type
+ |
+Resource
+ |
+Default Quota
+ |
+
|---|
+
+Enterprise Edition VPN
+ |
+Customer gateways per tenant in each region
+ |
+100
+ |
+
+
+
+
+
- Enable NAT traversal on the customer gateway based on the networking.
- If the customer gateway is connected to the Internet through a NAT device, enable NAT traversal on the customer gateway.
- If the customer gateway is directly connected to the Internet, you do not need to enabled NAT traversal on the customer gateway.
+ - Dead Peer Detection (DPD) must be enabled on a customer gateway.
- A customer gateway must support IPsec tunnel interfaces and be configured with a corresponding security policy.
- When Network Quality Analysis (NQA) is enabled for a connection in static routing mode, the IPsec tunnel interface of a customer gateway must have an IP address and be able to respond to ICMP requests.
- It is recommended that the maximum segment size (MSS) of TCP packets be set to a value less than 1399 on a customer gateway, so as to prevent fragmentation caused by addition of an IPsec header.
+
+
VPN Connection
+
Table 4 Constraints on Enterprise Edition VPN connectionsVPN Type
+ |
+Resource
+ |
+Default Quota
+ |
+How to Increase Quota
+ |
+
|---|
+
+Enterprise Edition VPN
+ |
+Policy rules per VPN connection
+ |
+5
+ |
+The quotas cannot be increased.
+ |
+
+Enterprise Edition VPN
+ |
+Customer subnets per VPN connection
+ |
+50
+ |
+This quota cannot be increased.
+ |
+
+
+
+
+
+
Table 5 Constraints on Classic VPN connectionsVPN Type
+ |
+Resource
+ |
+Default Quota
+ |
+How to Increase Quota
+ |
+
|---|
+
+Classic VPN
+ |
+VPN connections per tenant in each region
+ |
+12
+ |
+This quota cannot be increased.
+ |
+
+
+
+
+
- In multi-subnet scenarios, you are advised to use VPN connections in routing mode. For a VPN connection in policy-based or policy template mode, a VPN gateway creates a communications tunnel for each pair of the local and customer subnets by default. If there are multiple local or customer subnets for a VPN connection in policy-based or policy template mode, multiple communications tunnels are created.
Each IP address of a VPN gateway supports a maximum of 100 communications tunnels for connecting to customer gateways.
+- In routing mode, each VPN connection occupies only one communications tunnel of the corresponding VPN gateway IP address.
- In policy-based or policy template mode, each VPN connection occupies M x N communications tunnels of the corresponding VPN gateway IP address. M indicates the number of local subnets, and N indicates the number of customer subnets.
+If the number of communications tunnels occupied by all VPN connections in different modes established by a single gateway IP address has reached 100, excess VPN connections will fail to be created.
+ - When creating a VPN connection in policy-based mode and adding multiple policy rules, ensure that the source and destination CIDR blocks in different policy rules do not overlap. Otherwise, data flows may be incorrectly matched or IPsec tunnels may flap.
+
+
Reference Standards and Protocols
+The following standards and protocols are associated with VPN:
+
- RFC 2403: The Use of HMAC-MD5-96 within ESP and AH
- RFC 2404: The Use of HMAC-SHA-1-96 within ESP and AH
- RFC 2409: The Internet Key Exchange (IKE)
- RFC 2451: The ESP CBC-Mode Cipher Algorithms
- RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
- RFC 3566: The AES-XCBC-MAC-96 Algorithm and Its Use With IPsec
- RFC 3602: The AES-CBC Cipher Algorithm and Its Use with IPsec
- RFC 3664: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4106: The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP)
- RFC 4109: Algorithms for Internet Key Exchange version 1 (IKEv1)
- RFC 4434: The AES-XCBC-PRF-128 Algorithm for the Internet Key Exchange Protocol (IKE)
- RFC 4868: Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with IPsec
- RFC 4301: Security Architecture for the Internet Protocol
- RFC 4302: IP Authentication Header
- RFC 4303: IP Encapsulating Security Payload (ESP)
- RFC 4305: Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 4306: Internet Key Exchange (IKEv2)Protocol
- RFC 4307: Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)
- RFC 4308: Cryptographic Suites for IPsec
- RFC 5282: Using Authenticated Encryption Algorithms with the Encrypted Payload of the Internet Key Exchange version 2 (IKEv2) Protocol
- RFC 6989: Additional Diffie-Hellman Tests for the Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 7321: Cryptographic Algorithm Implementation Requirements and Usage Guidance for Encapsulating Security Payload (ESP) and Authentication Header (AH)
- RFC 8247: Algorithm Implementation Requirements and Usage Guidance for the Internet Key Exchange Protocol Version 2 (IKEv2)
- RFC 3947: Negotiation of NAT-Traversal in the IKE
- RFC 3948: UDP Encapsulation of IPsec ESP Packets
- RFC 3706: A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers
- RFC 4271: A Border Gateway Protocol 4 (BGP-4)
+
Permissions Management
+If you need to assign different permissions to personnel in your enterprise to access your VPN resources created on the cloud service platform, Identity and Access Management (IAM) is a good choice for fine-grained permissions management. IAM provides identity authentication, permissions management, and access control, helping you securely manage access to your resources.
+
With IAM, you can use your account to create IAM users, and assign permissions to the users to control their access to specific cloud resources. For example, some software developers in your enterprise need to use VPN resources but should not be allowed to delete them or perform any high-risk operations. In this scenario, you can create IAM users for the software developers and grant them only the permissions required for using VPN resources.
+
If your account does not need individual IAM users for permissions management, skip this section, which has no impact on using functions of VPN.
+
IAM is a free service. You only pay for the resources in your account.
+
For more information about IAM, see IAM Service Overview.
+
VPN Permissions
New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.
+
VPN is a project-level service deployed for specific regions. When you set Scope to Region-specific projects and select the specified projects in the specified regions, the users only have permissions for VPN in the selected projects. If you set Scope to All resources, users have permissions for VPN in all region-specific projects. When accessing VPN, the users need to switch to the authorized region.
+
You can grant permissions by using roles or policies.
+
- Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. There are only a limited number of roles for granting permissions to users. Some roles depend other roles to take effect. When you assign such roles to users, remember to assign the roles they depend on. However, roles are not an ideal choice for fine-grained authorization and secure access control.
- Policies: a type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, administrators can grant IAM users only permissions to manage VPN resources of a certain type.
+
Table 1 lists all system-defined permissions for VPN.
+
Table 1 System-defined permissions for VPNSystem Role/Policy Name
+ |
+Description
+ |
+Dependency
+ |
+
|---|
+
+VPN Administrator (not recommended)
+ |
+Administrator permissions for VPN. Users with these permissions can perform all operations on VPN.
+Users with these permissions have the VPC Administrator and Tenant Guest permissions by default.
+- VPC Administrator: project-level policy, which is selected in the same project as VPN Administrator.
- Tenant Guest: project-level policy, which is selected in the same project as VPN Administrator.
+ |
+-
+ |
+
+VPN FullAccess (recommended)
+ |
+Full permissions for VPN.
+ |
+The actions of global services and the region-level actions cannot be configured in the same policy. As such, the following global actions are added:
+"tms:predefineTags:list"
+"scm:cert:list"
+"scm:cert:get"
+"scm:cert:download"
+ |
+
+VPN ReadOnlyAccess
+ |
+Read-only permissions on VPN resources. Users who have these permissions can only view information about VPN resources.
+ |
+The actions of global services and the region-level actions cannot be configured in the same policy. As such, the following global actions are added:
+"tms:predefineTags:list"
+"scm:cert:list"
+"scm:cert:get"
+ |
+
+
+
+
+
+
Table 2 lists the common operations supported by system-defined permissions for VPN.
+
+
Table 2 Common operations supported by system-defined permissions for VPNOperation
+ |
+VPN Administrator (Not Recommended)
+ |
+VPN FullAccess (Recommended)
+ |
+VPN ReadOnlyAccess
+ |
+
|---|
+
+Creating a VPN gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+×
+ |
+
+Viewing a VPN gateway
+ |
+√
+ |
+√
+ |
+√
+ |
+
+Querying the VPN gateway list
+ |
+√
+ |
+√
+ |
+√
+ |
+
+Updating a VPN gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+×
+ |
+
+Deleting a VPN gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+×
+ |
+
+Creating a VPN connection
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: √
+ |
+×
+ |
+
+Viewing a VPN connection
+ |
+√
+ |
+√
+ |
+√
+ |
+
+Querying the VPN connection list
+ |
+√
+ |
+√
+ |
+√
+ |
+
+Updating a VPN connection
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: √
+ |
+×
+ |
+
+Deleting a VPN connection
+ |
+√
+ |
+- Enterprise Edition VPN: ×
- Classic VPN: √
+ |
+×
+ |
+
+Creating a customer gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: N/A
+ |
+×
+ |
+
+Viewing a customer gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: N/A
+ |
+√
+ |
+
+Querying the customer gateway list
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: N/A
+ |
+√
+ |
+
+Updating a customer gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: N/A
+ |
+×
+ |
+
+Deleting a customer gateway
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: N/A
+ |
+×
+ |
+
+Creating a VPN connection monitor
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+×
+ |
+
+Querying a VPN connection monitor
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+√
+ |
+
+Querying the VPN connection monitor list
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+√
+ |
+
+Deleting a VPN connection monitor
+ |
+√
+ |
+- Enterprise Edition VPN: √
- Classic VPN: ×
+ |
+×
+ |
+
+
+
+
+
+
+
+
VPN Gateway
+A VPN gateway is a virtual gateway of VPN on the cloud. It establishes secure private connections with a customer gateway in your on-premises network or data center.
+
A VPN gateway needs to work with a customer gateway in your on-premises data center.
+
VPN Connection
+A VPN connection is a secure channel between a VPN gateway and a customer gateway. VPN connections use the IKE and IPsec protocols to encrypt the transmitted data.
+
A VPN connection uses the IKE and IPsec protocols to encrypt transmitted data, ensuring data security and reliability.
+
VPN Gateway Bandwidth
+The bandwidth you purchased for a VPN gateway refers to outbound bandwidth, that is, bandwidth for traffic sent from a VPC on the cloud to a customer gateway in an on-premises data center.
+
- If the purchased bandwidth is 10 Mbit/s or less, the inbound bandwidth is limited to 10 Mbit/s.
- If the purchased bandwidth is greater than 10 Mbit/s, the inbound bandwidth is the same as the EIP bandwidth.
+
Local Subnet
+Local subnets are VPC subnets that need to communicate with an on-premises network through VPN. When you buy a VPN gateway, you can set Local Subnet to either of the following options:
+
- Select subnet: Select subnets from the drop-down list. This is recommended if all subnets that require VPN communication are in the VPC.
- Enter CIDR block: Enter a subnet using CIDR notation (example: 192.168.0.0/16). If multiple subnets are specified, separate them by a comma (,). This is recommended if the CIDR blocks requiring VPN communication are not in the VPC to which the VPN gateway belongs. For example, CIDR blocks (such as 0.0.0.0/0) that are connected using a VPC peering are not in the VPC to which the VPN gateway belongs.
+
Customer Gateway
+A customer gateway is a resource that provides information on the console about your customer gateway device, which can be a physical device or software application in your on-premises data center.
+
Customer Subnet
+Customer subnets are subnets in an on-premises data center that access a VPC on the cloud through a VPN. You need to enter subnets using CIDR notation (example: 192.168.0.0/16), and with each entry separated by a comma.
+
After configuring a customer subnet, you do not need to add a route for it. The VPN service will automatically deliver routes pointing to the customer subnet.
+
A customer subnet cannot be set to a Class D or Class E IP address or an IP address starting with 127.
+
+
PSK
+A pre-shared key (PSK) is a key configured for a VPN connection on the cloud. It is used for IKE negotiation between VPN devices at both ends of a VPN connection. Ensure that the PSK configurations at both ends of the VPN connection are the same. Otherwise, the IKE negotiation will fail.
+
+
Identity Authentication and Access Control
+A VPN connection supports authentication of a customer gateway using a pre-shared key (PSK).
+
The identity authentication succeeds and the VPN connection can be set up only when the PSK configured on the customer gateway is the same as that configured for the VPN connection.
+
Data Protection Technologies
+
+
PFS
Perfect Forward Secrecy (PFS) ensures that the compromise of the keys of an IPsec tunnel does not affect the security of other tunnels by leveraging that the keys of these tunnels are irrelevant to each other. By default, the PFS function is enabled for VPN.
+
Each IPsec VPN connection consists of at least one IPsec tunnel, each of which uses an independent set of keys to protect user traffic.
+
VPN supports the following algorithms:
+
- DH group 1 (This algorithm is insecure. Exercise caution when using it.)
- DH group 2 (This algorithm is insecure. Exercise caution when using it.)
- DH group 5 (This algorithm is insecure. Exercise caution when using it.)
- DH group 14
- DH group 15
- DH group 16
- DH group 19
- DH group 20
- DH group 21
+
+
Anti-replay
Anti-replay uses sequence numbers to protect IPsec encrypted packets against replay attacks, which are initiated by repeatedly sending intercepted data packets. By default, the anti-replay function is enabled for the VPN service.
+
+
Resource Isolation
A VPN gateway is exclusive to a tenant. As such, tenants are isolated from each, ensuring tenant data security.
+
+
Audit and Logs
+VPN records the create, delete, and modify operations performed on all resources initiated by your account, and sends the records to Cloud Trace Service (CTS) in log files for query, audit, and source tracing.
+
Figure 1 Audit and logs
+
Service Resilience
+VPN provides the dual-AZ disaster recovery function. You can create a VPN gateway in two AZs in the same region, and create a VPN connection between the customer gateway and each AZ.
+
If the VPN gateway or VPN connection in an AZ is faulty, traffic is automatically switched to the other VPN connection, ensuring normal service running.
+
Region and AZ
+Concepts
Regions and availability zones (AZs) identify the locations of data centers. You can create resources in regions and AZs.
+
- A region is a physical data center location. Each region is completely independent, maximizing the fault tolerance capability and stability. After you create resources in a region, the region cannot be changed.
- An AZ is a physical location with independent power supplies and network in a region. A region can contain multiple AZs that are physically isolated but internally interconnected. Faults that occur in one AZ will not affect other AZs. The inter-AZ connections are low-latency and unexpensive.
+
Figure 1 shows the relationship between regions and AZs.
+
Figure 1 Regions and AZs
+
+
+
Selecting a Region
You are advised to select a region close to you or your target users to reduce network latency and improve the access speed.
+
+
Selecting an AZ
When selecting a region to deploy resources, consider your applications' requirements on disaster recovery (DR) and network latency.
+
- For robust DR, deploy resources in different AZs within the same region.
- For a low network latency, deploy resources in the same AZ.
+
+
Regions and Endpoints
Before you use an API to call resources, specify its region and endpoint. For more information, see Regions and Endpoints.
+
+
Application Scenarios
+Hybrid Cloud Deployment
You can use a VPN to connect your on-premises data center to a VPC and use the elastic and fast scaling capabilities of the cloud to expand application computing capabilities.
Figure 1 shows the hybrid cloud deployment.
Figure 1 Hybrid cloud deployment
+
+
+
Cross-Region Interconnection Between VPCs
With VPNs, you can connect VPCs in different regions to enable connectivity between user services in these regions, as shown in Figure 2.
+
Figure 2 Cross-region interconnection between VPCs
+
+
Enterprise Branch Interconnection
A VPN gateway functions as a VPN hub to connect enterprise branches, as shown in Figure 3. This eliminates the need to configure VPN connections between every two branches.
+
Figure 3 Enterprise branch interconnection
+
+
Backup Between VPN and Direct Connect
For high reliability purposes, you can connect your on-premises data center to a VPC on the cloud through Direct Connect and VPN that back up each other, as shown in Figure 4.
+
Figure 4 Backup between VPN and Direct Connect
+
+
Differences between Enterprise Edition VPN and Classic VPN
+
+
Table 1 Differences between Enterprise Edition VPN and Classic VPNCategory
+ |
+Item
+ |
+Enterprise Edition VPN
+ |
+Classic VPN
+ |
+
|---|
+
+Tenant isolation
+ |
+Tenant-exclusive gateway
+ |
+Supported
+ |
+Not supported
+ |
+
+Features
+ |
+Policy-based mode
+ |
+Supported
+ |
+Supported
+ |
+
+Features
+ |
+Routing mode
+ |
+Static routing and BGP routing
+ |
+Not supported
+ |
+
+Features
+ |
+VPN hub
+ |
+Supported
+ |
+Not supported
+ |
+
+Features
+ |
+Enterprise router
+ |
+Supported
+ |
+Not supported
+ |
+
+Features
+ |
+Network type
+ |
+Public network and private network
+ |
+Public network
+ |
+
+Capacity
+ |
+Number of subnets
+ |
+- Route-based mode: 50
- Policy-based mode: 5
+ |
+Policy-based mode: 5
+ |
+
+Capacity
+ |
+For more information, see Table 1.
+ |
+-
+ |
+-
+ |
+
+Reliability
+ |
+Gateway protection mode
+ |
+Active/Standby or active-active
+ |
+-
+ |
+
+Reliability
+ |
+Cross-AZ gateway deployment
+ |
+Supported
+ |
+Not supported
+ |
+
+Reliability
+ |
+Active-active VPN connections
+ |
+Supported
+ |
+Not supported
+ |
+
+Reliability
+ |
+Backup with Direct Connect
+ |
+Supported
+ |
+Not supported
+ |
+
+
+
+
+
Basic Concepts
+
+
+
diff --git a/docs/vpn/umn/vpn_01_0035.html b/docs/vpn/umn/vpn_01_0035.html
new file mode 100644
index 00000000..5b80bebb
--- /dev/null
+++ b/docs/vpn/umn/vpn_01_0035.html
@@ -0,0 +1,21 @@
+
+
+IPsec VPN
+Internet Protocol Security (IPsec) VPN uses a secure network protocol suite that authenticates and encrypts the packets of data to provide secure encrypted communication between different networks.
+
In the example shown in Figure 1, assume that you have created a VPC with two subnets (192.168.1.0/24 and 192.168.2.0/24) on the cloud, and the router in your on-premises data center also has two subnets (192.168.3.0/24 and 192.168.4.0/24). In this case, you can create a VPN to connect the VPC subnets and the data center subnets.
+
Figure 1 IPsec VPN
+
Site-to-site VPN is supported to enable communication between VPC subnets and on-premises data center subnets.
+
Product Specifications
+ - The specification of a VPN gateway can be changed between Basic and Professional 1.
- The specification of a VPN gateway can be changed between Professional 1 and Professional 2.
- The preceding specification changes are subject to the console.
+
+
+
Table 1 VPN specificationsItem
+ |
+Basic
+ |
+Professional 1
+ |
+Professional 2
+ |
+
|---|
+
+Exclusive gateway resources
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Dual connections
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Active-active gateways
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Active/Standby gateways
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Policy-based mode
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Routing mode: static routing
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Routing mode: BGP routing
+ |
+Supported
+ |
+Supported
+ |
+Supported
+ |
+
+Policy template mode
+ |
+Not supported
+ |
+Not supported
+ |
+Not supported
+ |
+
+Maximum forwarding bandwidth
+ |
+100 Mbit/s
+ |
+300 Mbit/s
+ |
+1 Gbit/s
+ |
+
+Maximum number of VPN connection groups
+ |
+10
+ |
+100
+ |
+100
+ |
+
+Interconnection with an enterprise router
+ |
+Not supported
+ |
+Supported
+ |
+Supported
+ |
+
+Private network
+ |
+Not supported
+ |
+Supported
+ |
+Supported
+ |
+
+Supported regions
+ |
+Subject to the regions available on the console
+ |
+Subject to the regions available on the console
+ |
+Subject to the regions available on the console
+ |
+
+
+
+
+
Getting Started
+
+
+
diff --git a/docs/vpn/umn/vpn_03_0004.html b/docs/vpn/umn/vpn_03_0004.html
new file mode 100644
index 00000000..fdfbbe76
--- /dev/null
+++ b/docs/vpn/umn/vpn_03_0004.html
@@ -0,0 +1,249 @@
+
+
+Creating a VPN
+Overview
By default, ECSs in a VPC cannot communicate with devices in your on-premises data center or private network. To enable communication between them, you can use a VPN by creating it in your VPC and updating security group rules.
+
+
IPsec VPN Topology
In Figure 1, the VPC has subnets 192.168.1.0/24 and 192.168.2.0/24. Your on-premises data center has subnets 192.168.3.0/24 and 192.168.4.0/24. You can use VPN to enable subnets in the VPC to communicate with those in your data center.
+
Figure 1 IPsec VPN
+
Site-to-site VPN is supported to enable communication between VPC subnets and on-premises data center subnets. Before establishing an IPsec VPN, ensure that the on-premises data center where the VPN is to be established meets the following conditions:
+
- On-premises devices that support the standard IPsec protocol are available.
- The on-premises devices have fixed public IP addresses, which can be statically configured or translated by NAT.
- The on-premises subnets do not conflict with VPC subnets, and devices in the on-premises subnets can communicate with the on-premises devices.
+
If the preceding conditions are met, ensure that the IKE policies and IPsec policies at both ends are consistent and the subnets at both ends are matched pairs when configuring IPsec VPN.
+
After the configuration is complete, VPN negotiation needs to be triggered by private network data flows.
+
+
Scenarios
You need a VPN that sets up a secure, isolated communications tunnel between your on-premises data center and cloud services.
+
+
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click Service List and choose .
- In the navigation pane on the left, choose Virtual Private Network.
If Enterprise Edition VPN is available for the selected region, choose Virtual Private Network > Classic.
+ - On the Virtual Private Network page, click Create VPN.
If Enterprise Edition VPN is available for the selected region, click Create VPN on the Classic page.
+ - Configure required parameters and click Create Now.
Table 1, Table 2, and Table 3 describe the parameters.
+
+Table 1 Basic parametersParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Region
+ |
+Regions are geographic areas that are physically isolated from each other. The networks inside different regions are not connected to each other, so resources cannot be shared across regions. For low network latency and fast resource access, select the region nearest to your target users.
+ |
+
+ eu-de
+ |
+
+Name
+ |
+The VPN name
+ |
+VPN-001
+ |
+
+VPC
+ |
+The VPC name
+ |
+VPC-001
+ |
+
+Local Subnet
+ |
+VPC subnets that will access your on-premises network through a VPN.
+ |
+192.168.1.0/24,
+192.168.2.0/24
+ |
+
+Remote Gateway
+ |
+The public IP address of the gateway in your data center or on the private network. This IP address is used for communicating with your VPC.
+ |
+N/A
+ |
+
+Remote Subnet
+ |
+The subnets of your on-premises network that will access a VPC through a VPN. The remote and local subnets cannot overlap with each other. The remote subnets cannot overlap with CIDR blocks involved in existing VPC peering connections created for the VPC.
+ |
+192.168.3.0/24,
+192.168.4.0/24
+ |
+
+PSK
+ |
+Private key shared by two ends of a VPN connection for negotiation. PSKs configured at both ends of the VPN connection must be the same.
+The PSK can contain 6 to 128 characters.
+ |
+Test@123
+ |
+
+Confirm PSK
+ |
+Enter the PSK again.
+ |
+Test@123
+ |
+
+Advanced Settings
+ |
+- Default: Use default IKE and IPsec policies.
- Custom: Use custom IKE and IPsec policies. For details, see Table 2 and Table 3.
+ |
+Custom
+ |
+
+Advanced Settings > Tags
+ |
+Configure Tags in Advanced Settings.
+ |
+-
+ |
+
+
+
+
Table 2 IKE policyParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Authentication Algorithm
+ |
+Hash algorithm used for authentication. The following algorithms are supported:
+- MD5(Insecure. Not recommended.)
- SHA1(Insecure. Not recommended.)
- SHA2-256
- SHA2-384
- SHA2-512
+The default value is SHA2-256.
+ |
+SHA2-256
+ |
+
+Encryption Algorithm
+ |
+Encryption algorithm. The following algorithms are supported:
+- AES-128
- AES-192
- AES-256
- 3DES(Insecure. Not recommended.)
+The default value is AES-128.
+ |
+AES-128
+ |
+
+DH Algorithm
+ |
+Diffie-Hellman key exchange algorithm. The following algorithms are supported:
+- DH group 1(Insecure. Not recommended.)
- DH group 2(Insecure. Not recommended.)
- DH group 5(Insecure. Not recommended.)
- DH group 14
- Group 15
+- Group 16
- Group 19
- Group 20
- Group 21
+The default value is Group 14.
+ |
+Group 14
+ |
+
+Version
+ |
+Version of the IKE protocol. The value can be one of the following:
+- v1 (For security reasons, IKEv1 is not recommended. If your devices support IKEv2, select IKEv2.)
- v2
+The default value is v2.
+ |
+v2
+ |
+
+Lifetime (s)
+ |
+Lifetime of an SA, in seconds
+An SA will be renegotiated when its lifetime expires.
+The default value is 86400.
+ |
+86400
+ |
+
+Negotiation Mode
+ |
+The value is Main. This parameter is available only when Version is set to v1.
+The default value is Main.
+ |
+Main
+ |
+
+
+
+
Table 3 IPsec policyParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Authentication Algorithm
+ |
+Hash algorithm used for authentication. The following algorithms are supported:
+- SHA1(Insecure. Not recommended.)
- MD5(Insecure. Not recommended.)
- SHA2-256
- SHA2-384
- SHA2-512
+The default value is SHA2-256.
+ |
+SHA2-256
+ |
+
+Encryption Algorithm
+ |
+Encryption algorithm. The following algorithms are supported:
+- AES-128
- AES-192
- AES-256
- 3DES(Insecure. Not recommended.)
+The default value is AES-128.
+ |
+AES-128
+ |
+
+PFS
+ |
+Algorithm used by the Perfect forward secrecy (PFS) function.
+PFS supports the following algorithms:
+- Disable
- DH group 1(Insecure. Not recommended.)
- DH group 2(Insecure. Not recommended.)
- DH group 5(Insecure. Not recommended.)
- DH group 14
- DH group 15
- DH group 16
- DH group 19
- DH group 20
- DH group 21
+The default value is DH group 14.
+ |
+DH group 14
+ |
+
+Transfer Protocol
+ |
+Security protocol used in IPsec to transmit and encapsulate user data. The following protocols are supported:
+
+The default value is ESP.
+ |
+ESP
+ |
+
+Lifetime (s)
+ |
+Lifetime of an SA, in seconds
+An SA will be renegotiated when its lifetime expires.
+The default value is 3600.
+ |
+3600
+ |
+
+
+
+
An IKE policy specifies the encryption and authentication algorithms to be used in the negotiation phase of an IPsec tunnel. An IPsec policy specifies the protocol, encryption algorithm, and authentication algorithm to be used in the data transmission phase of an IPsec tunnel. The IKE and IPsec policies must be the same at both ends of a VPN connection. Otherwise, the VPN connection cannot be set up.
+
+ - Submit your application.
After the IPsec VPN is created, a public IP address is assigned to the VPN. The IP address is the local gateway address of the created VPN. When configuring the remote tunnel in your data center, you must set the remote gateway address to this IP address.
Figure 2 Gateway IP address
+
- You need to configure an IPsec VPN tunnel on the router or firewall in your on-premises data center.
+
+
+
Step 1: Creating a VPN Gateway
+Prerequisites
- A VPC has been created. For details about how to create a VPC, see the Virtual Private Cloud User Guide.
- Security group rules have been configured for ECSs in the VPC, and allow the customer gateway in the on-premises data center to access VPC resources. For details about how to configure security group rules, see Security Group Rules.
+
+
Procedure
- Log in to the management console.
- Click
in the upper left corner of the page, and choose . - In the navigation pane on the left, choose .
- Set parameters as prompted, click , and complete the payment.
- The following describes only key parameters.
+
Table 1 Key VPN gateway parametersParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Region
+ |
+Select the region nearest to you.
+ |
+eu-de
+ |
+
+Name
+ |
+Name a VPN gateway.
+ |
+vpngw-001
+ |
+
+Network Type
+ |
+Select Public network.
+ |
+Public network
+ |
+
+Associate With
+ |
+Select VPC.
+ |
+VPC
+ |
+
+VPC
+ |
+Select the VPC that needs to access the on-premises data center.
+ |
+vpc-001(192.168.0.0/16)
+ |
+
+Interconnection Subnet
+ |
+This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.
+ |
+192.168.2.0/24
+ |
+
+Local Subnet
+ |
+Specify the VPC subnet that needs to access the on-premises data center.
+You can manually enter a CIDR block or select a subnet from the drop-down list box.
+ |
+192.168.0.0/24
+ |
+
+BGP ASN
+ |
+BGP AS number.
+ |
+64512
+ |
+
+Specification
+ |
+Select Professional 1 and deselect Access via a non-fixed IP address.
+ |
+Professional 1
+ |
+
+AZ
+ |
+AZ1 and AZ2 are supported.
+ |
+AZ1, AZ2
+ |
+
+Gateway IP Address
+ |
+This parameter is available only when Network Type is set to Private network.
+- Self-assigned IP address (default)
An IP address on the access subnet will be automatically assigned to the VPN gateway.
+You can view the automatically assigned IP address on the VPN Gateways page.
+ - Manually-specified IP address
Manually configure IP addresses on the access subnet for the VPN gateway.
+
+ |
+Self-assigned IP address
+ |
+
+Advanced Settings > Tags
+ |
+Configure Tags in Advanced Settings.
+ |
+-
+ |
+
+HA Mode
+ |
+Select Active-active.
+ |
+Active-active
+ |
+
+Active EIP
+ |
+You can buy a new EIP or use an existing EIP.
+ |
+11.xx.xx.11
+ |
+
+Active EIP 2
+ |
+You can buy a new EIP or use an existing EIP.
+ |
+11.xx.xx.12
+ |
+
+
+
+
+
+
Verification
Check the created VPN gateway on the VPN Gateways page. The initial state of the VPN gateway is Creating. When the VPN gateway state changes to Normal, the VPN gateway is successfully created.
+
+
Step 4: Creating VPN Connection 2
+Procedure
- In the navigation pane on the left, choose .
- On the VPN Connections page, click Create VPN Connection.
For VPN connection 2, you are advised to use the same settings as VPN connection 1, except the connection name, gateway IP address, local tunnel interface IP address, and customer tunnel interface IP address.
+
+Table 1 Parameter settings for VPN connection 2Parameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Name
+ |
+Enter the name of VPN connection 2.
+ |
+vpn-002
+ |
+
+VPN Gateway
+ |
+Select the VPN gateway created in Step 1: Creating a VPN Gateway.
+ |
+vpngw-001
+ |
+
+Gateway IP Address
+ |
+Select active EIP 2 of the VPN gateway.
+ |
+11.xx.xx.12
+ |
+
+Customer Gateway
+ |
+Select the customer gateway created in Step 2: Creating a Customer Gateway.
+ |
+cgw-001
+ |
+
+VPN Type
+ |
+Select Static routing.
+ |
+Static routing
+ |
+
+Customer Subnet
+ |
+Enter the subnet of the on-premises data center that needs to access the VPC.
+ NOTE: - The customer subnet can overlap with the local subnet but cannot be the same as the local subnet.
- A customer subnet cannot be included in the existing subnets of the VPC associated with the VPN gateway. It also cannot be the destination address in the route table of the VPC associated with the VPN gateway.
- Customer subnets cannot be the reserved CIDR blocks of VPCs, for example, 100.64.0.0/10 or 214.0.0.0/8.
- If the interconnection subnet is associated with an ACL rule, ensure that the ACL rule permits the TCP port for traffic between all local and customer subnets.
- Address groups cannot be used to configure the source and destination subnets in a policy on customer gateway devices.
+
+ |
+172.16.0.0/16
+ |
+
+Interface IP Address Assignment
+ |
+The options include Manually specify and Automatically assign.
+ |
+Manually specify
+ |
+
+Local Tunnel Interface Address
+ |
+Specify the tunnel interface address configured on the VPN gateway.
+ NOTE: The local and remote interface addresses configured on the customer gateway device must be the same as the values of Customer Tunnel Interface IP Address and Local Tunnel Interface IP Address, respectively.
+
+ |
+169.254.71.2/30
+ |
+
+Customer Tunnel Interface Address
+ |
+Specify the tunnel interface address configured on the customer gateway device.
+ |
+169.254.71.1/30
+ |
+
+Link Detection
+ |
+This function is used for route reliability detection in multi-link scenarios.
+ NOTE: When enabling this function, ensure that the customer gateway supports ICMP and is correctly configured with the customer interface IP address of the VPN connection. Otherwise, VPN traffic will fail to be forwarded.
+
+ |
+NQA enabled
+ |
+
+PSK, Confirm PSK
+ |
+Specify the negotiation key of the VPN connection.
+The PSKs configured on the VPN console and the customer gateway device must be the same.
+ |
+Test@123
+ |
+
+Policy Settings
+ |
+Configure the IKE and IPsec policies, which define the encryption algorithms used by the VPN tunnel.
+The policy settings on the VPN console and the customer gateway device must be the same.
+ |
+Default
+ |
+
+
+
+
+
+
Verification
Check the created VPN connection on the VPN Connections page. The initial state of the VPN connection is Creating. As the customer gateway device has not been configured, no VPN connection can be established. After about 2 minutes, the VPN connection state changes to Not connected.
+
+
Step 5: Configuring the Customer Gateway Device
+Procedure
In this example, the customer gateway device is an AR router.
+
+
- Log in to the AR router.
- Enter the system view.
<AR651>system-view
+ - Configure an IP address for the WAN interface. In this example, the WAN interface of the AR router is GigabitEthernet 0/0/8.
[AR651]interface GigabitEthernet 0/0/8
+[AR651-GigabitEthernet0/0/8]ip address 22.xx.xx.22 255.255.255.0
+[AR651-GigabitEthernet0/0/8]quit
+ - Configure a default route.
[AR651]ip route-static 0.0.0.0 0.0.0.0 22.xx.xx.1
+In this command, 22.xx.xx.1 is the gateway address of the AR router's public IP address. Replace it with the actual gateway address.
+ - Enable the SHA-2 algorithm to be compatible with the standard RFC algorithms.
[AR651]IPsec authentication sha2 compatible enable
+ - Configure an IPsec proposal.
[AR651]IPsec proposal hwproposal1
+[AR651-IPsec-proposal-hwproposal1]esp authentication-algorithm sha2-256
+[AR651-IPsec-proposal-hwproposal1]esp encryption-algorithm aes-128
+[AR651-IPsec-proposal-hwproposal1]quit
+ - Configure an IKE proposal.
[AR651]ike proposal 2
+[AR651-ike-proposal-2]encryption-algorithm aes-128
+[AR651-ike-proposal-2]dh group14
+[AR651-ike-proposal-2]authentication-algorithm sha2-256
+[AR651-ike-proposal-2]authentication-method pre-share
+[AR651-ike-proposal-2]integrity-algorithm hmac-sha2-256
+[AR651-ike-proposal-2]prf hmac-sha2-256
+[AR651-ike-proposal-2]quit
+ - Configure IKE peers.
[AR651]ike peer hwpeer1
+[AR651-ike-peer-hwpeer1]undo version 1
+[AR651-ike-peer-hwpeer1]pre-shared-key cipher Test@123
+[AR651-ike-peer-hwpeer1]ike-proposal 2
+[AR651-ike-peer-hwpeer1]local-address 22.xx.xx.22
+[AR651-ike-peer-hwpeer1]remote-address 11.xx.xx.11
+[AR651-ike-peer-hwpeer1]rsa encryption-padding oaep
+[AR651-ike-peer-hwpeer1]rsa signature-padding pss
+[AR651-ike-peer-hwpeer1]ikev2 authentication sign-hash sha2-256
+[AR651-ike-peer-hwpeer1]quit
+[AR651]ike peer hwpeer2
+[AR651-ike-peer-hwpeer2]undo version 1
+[AR651-ike-peer-hwpeer2]pre-shared-key cipher Test@123
+[AR651-ike-peer-hwpeer2]ike-proposal 2
+[AR651-ike-peer-hwpeer2]local-address 22.xx.xx.22
+[AR651-ike-peer-hwpeer2]remote-address 11.xx.xx.12
+[AR651-ike-peer-hwpeer2]rsa encryption-padding oaep
+[AR651-ike-peer-hwpeer2]rsa signature-padding pss
+[AR651-ike-peer-hwpeer2]ikev2 authentication sign-hash sha2-256
+[AR651-ike-peer-hwpeer2]quit
+The commands are described as follows:
+- pre-shared-key cipher: configures a PSK, which must be the same as that configured on the VPN console.
- local-address: specifies the public IP address of the AR router.
- remote-address: specifies the active EIP or active EIP 2 of the VPN gateway.
+ - Configure an IPsec profile.
[AR651]IPsec profile hwpro1
+[AR651-IPsec-profile-hwpro1]ike-peer hwpeer1
+[AR651-IPsec-profile-hwpro1]proposal hwproposal1
+[AR651-IPsec-profile-hwpro1]pfs dh-group14
+[AR651-IPsec-profile-hwpro1]quit
+[AR651]IPsec profile hwpro2
+[AR651-IPsec-profile-hwpro2]ike-peer hwpeer2
+[AR651-IPsec-profile-hwpro2]proposal hwproposal1
+[AR651-IPsec-profile-hwpro2]pfs dh-group14
+[AR651-IPsec-profile-hwpro2]quit
+ - Configure virtual tunnel interfaces.
[AR651]interface Tunnel0/0/1
+[AR651-Tunnel0/0/1]mtu 1400
+[AR651-Tunnel0/0/1]ip address 169.254.70.1 255.255.255.252
+[AR651-Tunnel0/0/1]tunnel-protocol IPsec
+[AR651-Tunnel0/0/1]source 22.xx.xx.22
+[AR651-Tunnel0/0/1]destination 11.xx.xx.11
+[AR651-Tunnel0/0/1]IPsec profile hwpro1
+[AR651-Tunnel0/0/1]quit
+[AR651]interface Tunnel0/0/2
+[AR651-Tunnel0/0/2]mtu 1400
+[AR651-Tunnel0/0/2]ip address 169.254.71.1 255.255.255.252
+[AR651-Tunnel0/0/2]tunnel-protocol IPsec
+[AR651-Tunnel0/0/2]source 22.xx.xx.22
+[AR651-Tunnel0/0/2]destination 11.xx.xx.12
+[AR651-Tunnel0/0/2]IPsec profile hwpro2
+[AR651-Tunnel0/0/2]quit
+The commands are described as follows:
+
+ - Configure NQA.
[AR651]nqa test-instance IPsec_nqa1 IPsec_nqa1
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]test-type icmp
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]destination-address ipv4 169.254.70.2
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]source-address ipv4 169.254.70.1
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]frequency 15
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]ttl 255
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]start now
+[AR651-nqa-IPsec_nqa1-IPsec_nqa1]quit
+[AR651]nqa test-instance IPsec_nqa2 IPsec_nqa2
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]test-type icmp
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]destination-address ipv4 169.254.71.2
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]source-address ipv4 169.254.71.1
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]frequency 15
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]ttl 255
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]start now
+[AR651-nqa-IPsec_nqa2-IPsec_nqa2]quit
+The commands are described as follows:
+
+ - Configure association between the static route and NQA.
[AR651]ip route-static 192.168.0.0 255.255.255.0 Tunnel0/0/1 track nqa IPsec_nqa1 IPsec_nqa1
+[AR651]ip route-static 192.168.0.0 255.255.255.0 Tunnel0/0/2 track nqa IPsec_nqa2 IPsec_nqa2
+The parameters are described as follows:
+- 192.168.0.0 indicates the local subnet of the VPC.
- Tunnelx and IPsec_nqax in the same command correspond to the same VPN connection.
+
+
+
Verification
- Log in to the management console.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
Verify that the states of the two VPN connections are both Normal.
+
+
+
Step 6: Verifying Network Connectivity
+Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click Service List and choose .
- Log in to an ECS.
In this example, use VNC provided on the management console to log in to an ECS.
+ - Run the following command on the ECS:
ping 172.16.0.100
+172.16.0.100 is the IP address of a server in the on-premises data center. Replace it with an actual server IP address.
+If information similar to the following is displayed, the VPC on the cloud and the on-premises data center can communicate with each other.
+Reply from xx.xx.xx.xx: bytes=32 time=28ms TTL=245
+Reply from xx.xx.xx.xx: bytes=32 time=28ms TTL=245
+Reply from xx.xx.xx.xx: bytes=32 time=28ms TTL=245
+Reply from xx.xx.xx.xx: bytes=32 time=27ms TTL=245
+
+
+
Management
+
+
+
diff --git a/docs/vpn/umn/vpn_04_0002.html b/docs/vpn/umn/vpn_04_0002.html
new file mode 100644
index 00000000..c0223c0a
--- /dev/null
+++ b/docs/vpn/umn/vpn_04_0002.html
@@ -0,0 +1,71 @@
+
+
+Viewing Created VPNs
+Scenarios
You can view details about an existing VPN.
+
+
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click Service List and choose Networking > Virtual Private Network.
- In the navigation pane on the left, choose Virtual Private Network.
If Enterprise Edition VPN is available for the selected region, choose Virtual Private Network > Classic.
+ - On the Virtual Private Network page, view the target VPN.
If Enterprise Edition VPN is available for the selected region, view the target VPN on the Classic page.
+Table 1 describes the VPN status.
+
Table 1 VPN statusStatus
+ |
+Description
+ |
+
|---|
+
+Normal
+ |
+The VPN is successfully created, and the on-premises data center can access the VPC properly.
+ |
+
+Not connected
+ |
+The VPN is successfully created but has not been used for communication with the on-premises data center.
+ |
+
+Creating
+ |
+The VPN is being created.
+ |
+
+Updating
+ |
+VPN information is being updated.
+ |
+
+Deleting
+ |
+The VPN is being deleted.
+ |
+
+Abnormal
+ |
+The VPN is abnormal.
+ |
+
+Frozen
+ |
+The VPN is frozen.
+ |
+
+
+
+
+
Figure 1 Viewing the created VPN
+
+
+
+
+
Modifying a Created VPN
+Scenarios
If VPN network information conflicts with VPC network information or needs to be adjusted based on the latest network environment, you can modify the VPN.
+
+
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click Service List and choose Networking > Virtual Private Network.
- In the navigation pane on the left, choose Virtual Private Network.
If Enterprise Edition VPN is available for the selected region, choose Virtual Private Network > Classic.
+ - On the Virtual Private Network page, locate the target VPN and click Modify.
If Enterprise Edition VPN is available for the selected region, locate the target VPN and click Modify on the Classic page.
+ - In the displayed dialog box, modify parameters as required.
Figure 1 Modify VPN page
+ - Click OK.
+
+
Deleting a VPN
+Scenarios
You can delete a VPN if it is no longer required.
+
+
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click Service List and choose Networking > Virtual Private Network.
- In the navigation pane on the left, choose Virtual Private Network.
If Enterprise Edition VPN is available for the selected region, choose Virtual Private Network > Classic.
+ - On the Virtual Private Network page, locate the target VPN and click Delete.
If Enterprise Edition VPN is available for the selected region, locate the target VPN and click Delete on the Classic page.
+ - In the displayed dialog box, click Yes.
+
+
Quotas
+Resource Types
- VPN resources include VPN gateways, VPN connection groups, and customer gateways.
+
The total quota of each resource type varies according to regions.
+
+
Creating a VPN Gateway
+Scenario
To connect your on-premises data center or private network to your ECSs in a VPC, you need to create a VPN gateway before creating a VPN connection.
+
+
Context
The recommended networking varies according to the number of customer gateway IP addresses, as described in
Table 1.
+
Table 1 NetworkingNumber of Customer Gateway IP Addresses
+ |
+Recommended Networking
+ |
+Description
+ |
+
|---|
+
+1
+ |
+
+ |
+It is recommended that the VPN gateway uses the active-active mode. In this case, one VPN connection group is used.
+ |
+
+2
+ |
+
+ |
+It is recommended that the VPN gateway uses the active/standby mode. In this case, two VPN connection groups are used.
+ |
+
+
+
+
+
- If your on-premises data center has only one customer gateway configured with only one IP address, it is recommended that the VPN gateway uses the active-active mode. In this mode, you need to create a VPN connection between each of the active EIP and active EIP 2 of the VPN gateway and the IP address of the customer gateway. In this scenario, only one VPN connection group is used.
- If your on-premises data center has two customer gateways or one customer gateway configured with two IP addresses, it is recommended that the VPN gateway uses the active/standby mode. In this mode, you need to create a VPN connection with each of the customer gateway IP addresses using the active and standby EIPs of the VPN gateway. In this scenario, two VPN connection groups are used.
+
+
+
Notes and Constraints
- When an enterprise router is associated, pay attention to the upper limit of entries in the routing table of the enterprise router.
+
+
Prerequisites
- A VPC has been created. For details about how to create a VPC, see the Virtual Private Cloud User Guide.
- Security group rules have been configured for the VPC, and ECSs can communicate with other devices on the cloud. For details about how to configure security group rules, see the Virtual Private Cloud User Guide.
- An enterprise router has been created if you want to use it to connect to a VPN gateway. For details, see the enterprise router documentation.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- Click Create VPN Gateway.
- Set parameters as prompted and click Create Now.
Figure 1 Creating a VPN gateway
+Table 2 lists the VPN gateway parameters.
+
+Table 2 Description of VPN gateway parametersParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Region
+ |
+For low network latency and fast resource access, select the region nearest to your target users.
+Resources cannot be shared across regions.
+ |
+ Select a region as required.eu-de
+ |
+
+Name
+ |
+Name of a VPN gateway. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
+ |
+vpngw-001
+ |
+
+Network Type
+ |
+- Public network: A VPN gateway establishes VPN connections through the Internet. Public network is the default value.
- Private network: A VPN gateway establishes VPN connections through a private network.
+ |
+Public network
+ |
+
+Associate With
+ |
+- VPC
Through a VPC, the VPN gateway sends messages to the customer gateway or servers in the local subnet.
+ - Enterprise Router
Through an enterprise router, the VPN gateway sends messages to the customer gateway or servers in the subnets of all VPCs connected to the enterprise router.
+ NOTE: In this scenario, pay attention to the upper limit of entries in the routing table of the enterprise router. If the number of routes advertised by the customer gateway and VPN gateway exceeds this upper limit, the enterprise router cannot learn the excess routes. As a result, traffic will fail to be forwarded between the VPN gateway and the customer gateway.
+
+
+ |
+VPC
+ |
+
+VPC
+ |
+Select a VPC.
+For the VPC parameter configuration, see Figure 2 and Figure 3.
+ |
+vpc-001(192.168.0.0/16)
+ |
+
+Enterprise Router
+ |
+Select an enterprise router.
+For the enterprise router parameter configuration, see Figure 4.
+ |
+er-001
+ |
+
+Interconnection Subnet
+ |
+This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.
+ |
+192.168.66.0/24
+ |
+
+Local Subnet
+ |
+VPC subnets with which your on-premises data center needs to communicate through the customer gateway.
+
+ |
+192.168.1.0/24,192.168.2.0/24
+ |
+
+BGP ASN
+ |
+BGP ASN of the VPN gateway, which must be different from that of the customer gateway.
+ |
+64512
+ |
+
+Specification
+ |
+Three options are available: Basic, Professional 1 and Professional 2.
+ |
+Professional 1
+ |
+
+AZ
+ |
+An AZ is a geographic location with independent power supply and network facilities in a region. AZs in the same VPC are interconnected through private networks and are physically isolated.
+
+ |
+AZ1, AZ2
+ |
+
+HA Mode
+ |
+- Active-active
- When Associate With is set to VPC, the outgoing traffic from the VPN gateway to the customer subnet is preferentially forwarded through the first VPN connection (VPN connection 1) set up between the customer subnet and an EIP. If VPN connection 1 fails, the outgoing traffic is automatically switched to the other VPN connection (VPN connection 2) set up with the customer subnet. After VPN connection 1 recovers, the outgoing traffic is still transmitted through VPN connection 2 and will not be switched back to VPN connection 1.
- When Associate With is set to Enterprise Router, the outgoing traffic from the VPN gateway to the customer subnet is load balanced among all VPN connections set up with the customer subnet.
+ - Active/Standby
The outgoing traffic from the VPN gateway to the customer subnet is preferentially transmitted through the VPN connection (VPN connection 1) set up between the customer subnet and the active EIP. If VPN connection 1 fails, the outgoing traffic is automatically switched to the other VPN connection (VPN connection 2) set up between the customer subnet and the standby EIP. After VPN connection 1 recovers, the outgoing traffic is automatically switched back to VPN connection 1.
+
+ |
+Active-active
+ |
+
+Active EIP
+ |
+EIP used by the VPN gateway to communicate with a customer gateway.
+- Create Now: Create an EIP.
- Use existing: Use an existing EIP.
+ |
+Create Now
+ |
+
+Bandwidth (Mbit/s)
+ |
+Bandwidth of the EIP, in Mbit/s.
+
+ |
+10 Mbit/s
+ |
+
+Bandwidth Name
+ |
+EIP bandwidth name.
+ |
+Vpngw-bandwidth1
+ |
+
+Active EIP 2
+ |
+A VPN gateway needs to be bound to a group of EIPs (active EIP and active EIP 2). You can plan the bandwidth for each EIP. The EIPs can share bandwidth with the EIPs of other network services.
+ |
+Create Now
+ |
+
+Standby EIP
+ |
+A VPN gateway needs to be bound to a group of EIPs (active EIP and standby EIP). You can plan the bandwidth for each EIP. The EIPs can share bandwidth with the EIPs of other network services.
+ |
+Create Now
+ |
+
+Bandwidth (Mbit/s)
+ |
+Bandwidth of the EIP, in Mbit/s.
+
+ |
+10 Mbit/s
+ |
+
+Bandwidth Name
+ |
+EIP bandwidth name.
+ |
+Vpngw-bandwidth2
+ |
+
+Enterprise Project
+ |
+Enterprise project to which the VPN belongs.
+An enterprise project facilitates project-level management and grouping of cloud resources and users. The default project is default.
+For details about how to create and manage enterprise projects, see the Enterprise Management User Guide.
+ |
+default
+ |
+
+Access VPC
+ |
+- This parameter is available only when Associate With is set to Enterprise Router.
+If a VPN gateway needs to connect to different VPCs in the southbound and northbound directions, set the VPC in the northbound direction as the access VPC. The VPC in the southbound direction is the VPC associated with the VPN gateway.
+ |
+Same as the associated VPC
+ |
+
+Access Subnet
+ |
+- This parameter is available only when Associate With is set to Enterprise Router.
+By default, a VPN gateway uses the interconnection subnet to connect to the associated VPC. Set this parameter when another subnet needs to be used.
+ |
+Same as the interconnection subnet
+ |
+
+Gateway IP Address
+ |
+This parameter is available only when Associate With is set to Enterprise Router and Network Type is set to Private network.
+- Self-assigned IP address (default)
An IP address on the access subnet will be automatically assigned to the VPN gateway.
+You can view the automatically assigned IP address on the VPN Gateways page.
+ - Manually-specified IP address
Manually configure IP addresses on the access subnet for the VPN gateway.
+
+ |
+Self-assigned IP address
+ |
+
+Advanced Settings > Access VPC
+ |
+- This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.
+If a VPN gateway needs to connect to different VPCs in the southbound and northbound directions, set the VPC in the northbound direction as the access VPC. The VPC in the southbound direction is the VPC associated with the VPN gateway.
+ |
+Same as the associated VPC
+ |
+
+Advanced Settings > Access Subnet
+ |
+- This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.
+By default, a VPN gateway uses the interconnection subnet to connect to the associated VPC. Set this parameter when another subnet needs to be used.
+ |
+Same as the interconnection subnet
+ |
+
+Advanced Settings > Gateway IP Address
+ |
+This parameter is available only when Associate With is set to VPC and Network Type is set to Private network.
+- Self-assigned IP address (default)
An IP address on the access subnet will be automatically assigned to the VPN gateway.
+You can view the automatically assigned IP address on the VPN Gateways page.
+ - Manually-specified IP address
Manually configure IP addresses on the access subnet for the VPN gateway.
+
+ |
+Self-assigned IP address
+ |
+
+Advanced Settings > Tags
+ |
+Configure Tags in Advanced Settings.
+ |
+-
+ |
+
+
+
+
Figure 2 VPC parameter configuration when Network Type is set to Public network
+Figure 3 VPC parameter configuration when Network Type is set to Private network
+Figure 4 Enterprise router parameter configuration
+ - Confirm the VPN gateway information and click Submit.
+
+
Creating a Customer Gateway
+Scenario
To connect your on-premises data center or private network to your ECSs in a VPC, you need to create a customer gateway before creating a VPN connection.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the Customer Gateways page, click Create Customer Gateway.
- Set parameters as prompted and click Create Now.
Figure 1 Creating a customer gateway
+Table 1 lists the customer gateway parameters.
+
+Table 1 Description of customer gateway parametersParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Name
+ |
+Name of a customer gateway. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
+ |
+cgw-001
+ |
+
+Routing Mode
+ |
+Routing mode of the customer gateway.
+- Select Dynamic (BGP) when VPN Type is set to Route-based and Routing Mode is set to Dynamic (BGP) for the VPN connection.
- When selecting this option, ensure that the customer gateway supports dynamic BGP.
- The customer gateway can advertise a maximum of 100 BGP routes to the VPN gateway. If more than 100 BGP routes are advertised, the BGP peer relationship is disconnected, causing traffic interruption between the VPN gateway and customer gateway.
+
+- Select Static when VPN Type is set to Route-based and Routing Mode is set to Static for the VPN connection.
- You are advised to select Static when VPN Type is set to Policy-based for the VPN connection.
+ |
+Static
+ |
+
+BGP ASN
+ |
+Enter the ASN of your on-premises data center or private network.
+The BGP ASN of the customer gateway must be different from that of the VPN gateway.
+ |
+65000
+ |
+
+Gateway IP Address
+ |
+IP address used by the customer gateway to communicate with the VPN gateway. The value must be a static address.
+Ensure that UDP port 4500 is permitted in a firewall rule on the customer gateway in your on-premises data center or private network.
+ |
+1.2.3.4
+ |
+
+Advanced Settings > Tags
+ |
+Configure Tags in Advanced Settings.
+ |
+-
+ |
+
+
+
+
- (Optional) If there are two customer gateways, repeat the preceding operations to configure the other customer gateway with a different identifier.
+
+
Related Operations
You need to configure an IPsec VPN tunnel on the router or firewall in your on-premises data center.
+
+
Creating a VPN Connection
+Scenario
To connect your on-premises data center or private network to your ECSs in a VPC, you need to create VPN connections after creating a VPN gateway and a customer gateway.
+
+
Notes and Constraints
- When creating a VPN connection in static routing mode, ensure that the customer gateway supports ICMP and is correctly configured with the customer interface IP address of the VPN connection before enabling NQA. Otherwise, traffic will fail to be forwarded.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the VPN Connections page, click Create VPN Connection.
For higher reliability, you are advised to create a VPN connection between each of the two EIPs of a VPN gateway and a customer gateway.
+
+ - Set parameters as prompted and click Create Now.
Table 1 lists the VPN connection parameters.
+
Table 1 Description of VPN connection parametersParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Name
+ |
+Name of a VPN connection. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
+ |
+vpn-001
+ |
+
+VPN Gateway
+ |
+Name of the VPN gateway for which the VPN connection is created.
+You can also click Create VPN Gateway to create a VPN gateway. For details about related parameters, see Table 2.
+ |
+vpngw-001
+ |
+
+Gateway IP Address
+ |
+IP address of the VPN gateway.
+The same EIP of a VPN gateway cannot be repeatedly selected when you create VPN connections between the VPN gateway and the same customer gateway.
+ |
+Available gateway IP address
+ |
+
+Customer Gateway
+ |
+Name of a customer gateway.
+You can also click Create Customer Gateway to create a customer gateway. For details about related parameters, see Table 1.
+ NOTE: If a customer gateway connects to multiple VPN gateways, the BGP ASNs and VPN types of the VPN gateways must be the same.
+
+ |
+cgw-001
+ |
+
+VPN Type
+ |
+IPsec connection mode, which can be route-based or policy-based.
+- Static routing
Determines the data that enters the IPsec VPN tunnel based on the route configuration (local subnet and customer subnet).
+Application scenario: Communication between customer gateways
+ - BGP routing
Determines the traffic that can enter the IPsec VPN tunnel based on BGP routes.
+Application scenario: Communication between customer gateways, many or frequently changing interconnection subnets, or backup between VPN and Direct Connect
+ - Policy-based
Determines the data that enters the IPsec VPN tunnel based on the policy (between the customer network and VPC). Policy rules can be defined based on the source and destination CIDR blocks.
+Application scenario: Isolation between customer gateways
+
+ |
+Static routing
+ |
+
+Customer Subnet
+ |
+Customer-side subnet that needs to access the VPC on the cloud through VPN connections.
+If there are multiple customer subnets, separate them with commas (,).
+ NOTE: - The customer subnet can overlap with the local subnet but cannot be the same as the local subnet.
- A customer subnet cannot be included in the existing subnets of the VPC associated with the VPN gateway. It also cannot be the destination address in the route table of the VPC associated with the VPN gateway.
- Customer subnets cannot be the reserved CIDR blocks of VPCs, for example, 100.64.0.0/10 or 214.0.0.0/8.
- If the interconnection subnet is associated with an ACL rule, ensure that the ACL rule permits the TCP port for traffic between all local and customer subnets.
- Address groups cannot be used to configure the source and destination subnets in a policy on customer gateway devices.
+
+ |
+172.16.1.0/24,172.16.2.0/24
+ |
+
+Interface IP Address Assignment
+ |
+This parameter is available only when VPN Type is set to Static routing or BGP routing.
+ NOTE: - Set interface IP addresses to the tunnel interface IP addresses used by the VPN gateway and customer gateway to communicate with each other.
- If the tunnel interface address of the customer gateway is fixed, select Manually specify, and set the tunnel interface address of the VPN gateway based on the tunnel interface address of the customer gateway.
+
+- Manually specify
+
- Automatically assign
- By default, an IP address on the 169.254.x.x/30 CIDR block is assigned to the tunnel interface of the VPN gateway.
- To view the automatically assigned local and customer interface IP addresses, click Modify VPN Connection on the VPN Connections page.
- When you set VPN Type to BGP routing and select Automatically assign, check the automatically assigned local and customer tunnel interface addresses after the VPN connection is created. Ensure that the local and remote tunnel interface addresses configured on the customer gateway device (the other end of the VPN connection) are the reverse of the settings on the cloud side.
+
+ |
+Automatically assign
+ |
+
+Local Tunnel Interface Address
+ |
+This parameter is available only when Interface IP Address Assignment is set to Manually specify.
+Tunnel interface IP address configured on the VPN gateway.
+ |
+N/A
+ |
+
+Customer Tunnel Interface Address
+ |
+This parameter is available only when Interface IP Address Assignment is set to Manually specify.
+Tunnel interface IP address configured on the customer gateway device.
+ |
+N/A
+ |
+
+Link Detection
+ |
+This parameter is available only when VPN Type is set to Static routing.
+ NOTE: When enabling this function, ensure that the customer gateway supports ICMP and is correctly configured with the customer interface IP address of the VPN connection. Otherwise, traffic will fail to be forwarded.
+
+After this function is enabled, the VPN gateway automatically performs Network Quality Analysis (NQA) on the customer interface IP address of the customer gateway.
+ |
+Selected
+ |
+
+PSK
+ |
+The PSKs configured for the VPN gateway and customer gateway must be the same.
+The PSK:
+- Contains 8 to 128 characters.
- Can contain only three or more types of the following characters:
- Digits
- Uppercase letters
- Lowercase letters
- Special characters: ~ ! @ # $ % ^ ( ) - _ + = { } , . / : ;
+
+ |
+Test@123
+ |
+
+Confirm PSK
+ |
+Enter the PSK again.
+ |
+Test@123
+ |
+
+Policy
+ |
+This parameter is available only when VPN Type is set to Policy-based.
+Defines the data flow that enters the encrypted VPN connection between the local and customer subnets. You need to configure the source and destination CIDR blocks in each policy rule. By default, a maximum of five policy rules can be configured.
+
+
+ |
+- Source CIDR block 1: 192.168.1.0/24
- Destination CIDR block 1: 172.16.1.0/24,172.16.2.0/24
- Source CIDR block 2: 192.168.2.0/24
- Destination CIDR block 2: 172.16.1.0/24,172.16.2.0/24
+ |
+
+Advanced Settings
+ |
+- Default: Use default IKE and IPsec policies.
- Existing: Use existing IKE and IPsec policies.
- Custom: Use custom IKE and IPsec policies. For details about the policies, see Table 2 and Table 3.
+ |
+Custom
+ |
+
+
+
+
+
+
Table 2 IKE policyParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Version
+ |
+Version of the IKE protocol. The value can be one of the following:
+- v1 (v1 has low security. If the device supports v2, v2 is recommended.)
- v2
+The default value is v2.
+ |
+v2
+ |
+
+Negotiation Mode
+ |
+This parameter is available only when Version is v1.
+
+ |
+Main
+ |
+
+Authentication Algorithm
+ |
+Hash algorithm used for authentication. The following options are available:
+- SHA1(Insecure. Not recommended.)
- MD5(Insecure. Not recommended.)
- SHA2-256
- SHA2-384
- SHA2-512
+The default value is SHA2-256.
+ |
+SHA2-256
+ |
+
+Encryption Algorithm
+ |
+Encryption algorithm. The following options are available:
+
+The default value is AES-128.
+ |
+AES-128
+ |
+
+DH Algorithm
+ |
+The following algorithms are supported:
+- Group 1(Insecure. Not recommended.)
- Group 2(Insecure. Not recommended.)
- Group 5(Insecure. Not recommended.)
- Group 14(Insecure. Not recommended.)
- Group 15
- Group 16
- Group 19
- Group 20
- Group 21
+The default value is Group 15.
+ |
+Group 15
+ |
+
+Lifetime (s)
+ |
+Lifetime of a security association (SA).
+An SA will be renegotiated when its lifetime expires.
+- Unit: second
- The value ranges from 60 to 604800.
- The default value is 86400.
+ |
+86400
+ |
+
+Local ID
+ |
+Authentication identifier of the VPN gateway used in IPsec negotiation. The VPN gateway ID configured on the customer gateway must be the same as the local ID configured here. Otherwise, IPsec negotiation fails.
+- IP Address (default value)
The system automatically sets this parameter to the selected EIP of the VPN gateway.
+ - FQDN
Set the FQDN to a string of 1 to 128 case-sensitive characters that can contain letters, digits, and special characters (excluding &, <, >, [, ], \, ?, and spaces).
+
+ |
+IP Address
+ |
+
+Customer ID
+ |
+Authentication identifier of the customer gateway used in IPsec negotiation. The customer gateway ID configured on the customer gateway must be the same as the customer ID configured here. Otherwise, IPsec negotiation fails.
+- IP Address (default value)
The system automatically sets this parameter to the IP address of the customer gateway.
+ - FQDN
Set the FQDN to a string of 1 to 128 case-sensitive characters that can contain letters, digits, and special characters (excluding &, <, >, [, ], \, ?, and spaces).
+
+ |
+IP Address
+ |
+
+
+
+
+
+
Table 3 IPsec policyParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Authentication Algorithm
+ |
+Hash algorithm used for authentication. The following options are available:
+- SHA1(Insecure. Not recommended.)
- MD5(Insecure. Not recommended.)
- SHA2-256
- SHA2-384
- SHA2-512
+The default value is SHA2-256.
+ |
+SHA2-256
+ |
+
+Encryption Algorithm
+ |
+Encryption algorithm. The following options are available:
+- 3DES(Insecure. Not recommended.)
- AES-128(Insecure. Not recommended.)
- AES-192(Insecure. Not recommended.)
- AES-256(Insecure. Not recommended.)
- AES-128-GCM-16
- AES-256-GCM-16
+The default value is AES-128.
+ |
+AES-128
+ |
+
+PFS
+ |
+Algorithm used by the Perfect forward secrecy (PFS) function.
+PFS supports the following algorithms:
+- Disable(Insecure. Not recommended.)
- DH group 1(Insecure. Not recommended.)
- DH group 2(Insecure. Not recommended.)
- DH group 5(Insecure. Not recommended.)
- DH group 14(Insecure. Not recommended.)
- DH group 15
- DH group 16
- DH group 19
- DH group 20
- DH group 21
+The default value is DH group 15.
+ |
+DH group 15
+ |
+
+Transfer Protocol
+ |
+Security protocol used in IPsec to transmit and encapsulate user data. The following protocols are supported:
+
+The default value is ESP.
+ |
+ESP
+ |
+
+Lifetime (s)
+ |
+Lifetime of an SA.
+An SA will be renegotiated when its lifetime expires.
+- Unit: second
- The value ranges from 30 to 604800.
- The default value is 3600.
+ |
+3600
+ |
+
+
+
+
+
An IKE policy specifies the encryption and authentication algorithms to use in the negotiation phase of an IPsec tunnel. An IPsec policy specifies the protocol, encryption algorithm, and authentication algorithm to use in the data transmission phase of an IPsec tunnel. The policy settings for VPN connections must be the same at the VPC and on-premises data center sides. If they are different, VPN negotiation will fail, causing the failure to establish VPN connections.
+
The following algorithms are not recommended because they are not secure enough:
+
+
+
+ - Confirm the VPN connection configuration and click Submit.
- Repeat the preceding operations to create the other VPN connection.
For details about IP address configuration, see Context.
+Figure 1 Creating a VPN connection
+
+
+
Classic VPN Management
+
+
+
diff --git a/docs/vpn/umn/vpn_04_0700.html b/docs/vpn/umn/vpn_04_0700.html
new file mode 100644
index 00000000..b65e417c
--- /dev/null
+++ b/docs/vpn/umn/vpn_04_0700.html
@@ -0,0 +1,23 @@
+
+
+Monitoring
+
+
+
diff --git a/docs/vpn/umn/vpn_04_0701.html b/docs/vpn/umn/vpn_04_0701.html
new file mode 100644
index 00000000..93f4e182
--- /dev/null
+++ b/docs/vpn/umn/vpn_04_0701.html
@@ -0,0 +1,11 @@
+
+
+Monitoring VPN
+Cloud Eye lets you keep a close eye on the performance and resource utilization of VPNs, ensuring VPN reliability and availability. You can use Cloud Eye to automatically monitor VPNs in real time and manage alarms and notifications, so that you can keep track of VPN performance metrics.
+
Metrics (Enterprise Edition VPN)
+Description
This section describes monitored metrics reported by VPN to Cloud Eye as well as their namespaces and dimensions. You can use the Cloud Eye management console to query the metrics of the monitored objects and alarms generated for VPN.
+
+
+
Metrics
+
Table 1 Metrics supported for Enterprise Edition VPN gatewaysMetric ID
+ |
+Metric Name
+ |
+Description
+ |
+Value Range
+ |
+Monitored Object
+ |
+Monitoring Interval (Raw Data)
+ |
+
|---|
+
+gateway_send_pkt_rate
+ |
+Outbound Packet Rate
+ |
+Average number of data packets leaving the cloud per second.
+ |
+≥ 0 pps
+ |
+Gateway
+ |
+1 minute
+ |
+
+gateway_recv_pkt_rate
+ |
+Inbound Packet Rate
+ |
+Average number of data packets entering the cloud per second.
+ |
+≥ 0 pps
+ |
+Gateway
+ |
+1 minute
+ |
+
+gateway_send_rate
+ |
+Outbound Bandwidth
+ |
+Average volume of traffic leaving the cloud per second.
+ |
+0–1 Gbit/s
+ |
+Gateway
+ |
+1 minute
+ |
+
+gateway_recv_rate
+ |
+Inbound Bandwidth
+ |
+Average volume of traffic entering the cloud per second.
+ |
+0–1 Gbit/s
+ |
+Gateway
+ |
+1 minute
+ |
+
+gateway_send_rate_usage
+ |
+Outbound Bandwidth Usage
+ |
+Bandwidth utilization for traffic leaving the cloud.
+ |
+0-100%
+ |
+Gateway
+ |
+1 minute
+ |
+
+gateway_recv_rate_usage
+ |
+Inbound Bandwidth Usage
+ |
+Bandwidth utilization for traffic entering the cloud.
+ |
+0-100%
+ |
+Gateway
+ |
+1 minute
+ |
+
+gateway_connection_num
+ |
+Number of Connections
+ |
+Number of VPN connections.
+ |
+≥ 0
+ |
+Gateway
+ |
+1 minute
+ |
+
+
+
+
+
+
Table 2 Enterprise Edition VPN connection metricsMetric ID
+ |
+Metric Name
+ |
+Description
+ |
+Value Range
+ |
+Monitored Object
+ |
+Monitoring Interval (Raw Data)
+ |
+
|---|
+
+tunnel_average_latency
+ |
+Average Tunnel RTT
+ |
+Average round-trip time on the tunnel between the VPN gateway and customer gateway.
+ |
+0–5000 ms
+ |
+VPN connection
+ |
+1 minute
+ |
+
+tunnel_max_latency
+ |
+Maximum Tunnel RTT
+ |
+Maximum round-trip time on the tunnel between the VPN gateway and customer gateway.
+ |
+0–5000 ms
+ |
+VPN connection
+ |
+1 minute
+ |
+
+tunnel_packet_loss_rate
+ |
+Tunnel Packet Loss Rate
+ |
+Packet loss rate on the tunnel between the VPN gateway and customer gateway.
+ |
+0–100 %
+ |
+VPN connection
+ |
+1 minute
+ |
+
+link_average_latency
+ |
+Average Link RTT
+ |
+Average round-trip time on the physical link between the VPN gateway and customer gateway.
+ |
+0–5000 ms
+ |
+VPN connection
+ |
+1 minute
+ |
+
+link_max_latency
+ |
+Maximum Link RTT
+ |
+Maximum round-trip time on the physical link between the VPN gateway and customer gateway.
+ |
+0–5000 ms
+ |
+VPN connection
+ |
+1 minute
+ |
+
+link_packet_loss_rate
+ |
+Link Packet Loss Rate
+ |
+Packet loss rate on the physical link between the VPN gateway and customer gateway.
+ |
+0–100 %
+ |
+VPN connection
+ |
+1 minute
+ |
+
+connection_status
+ |
+VPN Connection Status
+ |
+Status of a VPN connection:
+0: not connected
+1: connected
+2: unknown
+ |
+0, 1, or 2
+ |
+VPN connection
+ |
+1 minute
+ |
+
+recv_pkt_rate
+ |
+Packet Receive Rate
+ |
+Average number of data packets received per second.
+ |
+≥ 0 pps
+ |
+VPN connection
+ |
+1 minute
+ |
+
+send_pkt_rate
+ |
+Packet Send Rate
+ |
+Average number of data packets sent per second.
+ |
+≥ 0 pps
+ |
+VPN connection
+ |
+1 minute
+ |
+
+recv_rate
+ |
+Traffic Receive Rate
+ |
+Average volume of traffic received per second.
+ |
+0~1Gbit/s
+ |
+VPN connection
+ |
+1 minute
+ |
+
+send_rate
+ |
+Traffic Send Rate
+ |
+Average volume of traffic sent per second.
+ |
+0~1Gbit/s
+ |
+VPN connection
+ |
+1 minute
+ |
+
+
+
+
+
+
Dimensions
+
key
+ |
+Value
+ |
+
|---|
+
+evpn_connection_id
+ |
+Enterprise Edition VPN connection
+ |
+
+evpn_gateway_id
+ |
+Enterprise Edition VPN gateway
+ |
+
+
+
+
+
+
Creating Alarm Rules
+Scenarios
You can configure alarm rules on the Cloud Eye console to keep track of your VPN status at any time.
+
+
Procedure
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click
in the upper left corner of the management console, and choose Management & Deployment > Cloud Eye. - Choose Cloud Service Monitoring > Virtual Private Network, click Create Alarm Rule, and configure alarm rules for different types of alarms as required.
- Alarms related to Enterprise Edition VPN gateways: Choose S2C VPN Gateway from the right drop-down list box, click the Resources tab, and choose More > Create Alarm Rule in the Operation column of a VPN gateway.
- Alarms related to Enterprise Edition VPN connections: Choose S2C VPN Connection from the right drop-down list box, click the Resources tab, and choose More > Create Alarm Rule in the Operation column of a VPN connection.
- Alarms related to Classic VPN connections: Choose VPN Connections from the right drop-down list box, click the Resources tab, and choose More > Create Alarm Rule in the Operation column of a VPN connection.
+ - Click Create.
After the alarm rule is created, if you have enabled Alarm Notification and configured required parameters, you will receive notifications once an alarm is triggered.
+ For more information about VPN alarm rules, see the Cloud Eye User Guide.
+
+
+
+
Viewing Metrics
+Scenarios
View the VPN connection status and usages of bandwidth and EIP. You can view data of the last 1, 3, 12, or 24 hours, or last 7 days.
+
+
Viewing VPN Gateway Metrics
- Viewing metrics on the Cloud Eye console
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click Service List and choose Management & Deployment > Cloud Eye.
- Choose Cloud Service Monitoring > Virtual Private Network.
- On the Enterprise – VPN Gateways page, locate the target VPN gateway, and click View Metric in the Operation column.
You can view data of the last 1, 3, 12, or 24 hours, or last 7 days.
+
+
+
+
Viewing VPN Connection Metrics
+
+
Metrics (Classic VPN)
+Description
This section describes monitored metrics reported by VPN to Cloud Eye as well as their namespaces and dimensions. You can use the Cloud Eye management console to query the metrics of the monitored objects and alarms generated for VPN.
+
+
+
Metrics
+
Table 1 Metrics supported for Classic VPN bandwidthMetric ID
+ |
+Metric Name
+ |
+Description
+ |
+Value Range
+ |
+Monitored Object
+ |
+Monitoring Interval (Raw Data)
+ |
+
|---|
+
+upstream_bandwidth
+ |
+Outbound Bandwidth
+ |
+Network rate of outbound traffic (previously called "Upstream Bandwidth").
+Unit: bit/s
+ |
+≥ 0 bit/s
+ |
+Bandwidth or EIP
+ |
+1 minute
+ |
+
+downstream_bandwidth
+ |
+Inbound Bandwidth
+ |
+Network rate of inbound traffic (previously called "Downstream Bandwidth").
+Unit: bit/s
+ |
+≥ 0 bit/s
+ |
+Bandwidth or EIP
+ |
+1 minute
+ |
+
+upstream_bandwidth_usage
+ |
+Outbound Bandwidth Usage
+ |
+Usage of outbound bandwidth, in percentage.
+Outbound bandwidth usage = Outbound bandwidth/Purchased bandwidth
+ |
+0-100%
+ |
+Bandwidth or EIP
+ |
+1 minute
+ |
+
+downstream_bandwidth_usage
+ |
+Inbound Bandwidth Usage
+ |
+Usage of inbound bandwidth, in percentage.
+Inbound bandwidth usage = Inbound bandwidth/Purchased bandwidth
+ NOTE: - Up to 10 Mbit/s inbound bandwidth is provided for some sites that purchase an inbound bandwidth of less than 10 Mbit/s. As such, the inbound bandwidth usage may be greater than 100%.
- If you change the bandwidth of an EIP in use, there is a delay of 5–10 minutes for the metrics to update for the new bandwidth.
+
+ |
+0-100%
+ |
+Bandwidth or EIP
+ |
+1 minute
+ |
+
+up_stream
+ |
+Outbound Traffic
+ |
+Outbound network traffic (previously called "Upstream Traffic")
+Unit: byte
+ |
+≥ 0 bytes
+ |
+Bandwidth or EIP
+ |
+1 minute
+ |
+
+down_stream
+ |
+Inbound Traffic
+ |
+Inbound network traffic (previously called "Downstream Traffic")
+Unit: byte
+ |
+≥ 0 bytes
+ |
+Bandwidth or EIP
+ |
+1 minute
+ |
+
+
+
+
+
+
Table 2 Metrics supported for Classic VPN connectionsMetric ID
+ |
+Metric Name
+ |
+Description
+ |
+Value Range
+ |
+Monitored Object
+ |
+Monitoring Interval (Raw Data)
+ |
+
|---|
+
+connection_status
+ |
+VPN Connection Status
+ |
+Status of a VPN connection:
+0: not connected
+1: connected
+ |
+0 or 1
+ |
+VPN connection
+ |
+5 minutes
+ |
+
+
+
+
+
+
Dimensions
+
key
+ |
+Value
+ |
+
|---|
+
+vpn_connection_id
+ |
+VPN Connections
+ |
+
+
+
+
+
+
Unbinding an EIP from a VPN Gateway
+Scenario
After a VPN gateway is created, you can unbind an EIP from it.
+
+
Notes and Constraints
An EIP that is in use by a VPN connection cannot be unbound from a VPN gateway.
+
+
+
Deleting a VPN Connection
+Scenario
If a VPN connection is no longer required, you can delete it to release network resources.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the VPN Connections page, locate the row that contains the target VPN connection, and click Delete.
- In the displayed dialog box, click Yes.
+
+
Permissions Management
+
+
+
diff --git a/docs/vpn/umn/vpn_04_1201.html b/docs/vpn/umn/vpn_04_1201.html
new file mode 100644
index 00000000..cf1217ca
--- /dev/null
+++ b/docs/vpn/umn/vpn_04_1201.html
@@ -0,0 +1,32 @@
+
+
+Creating a User and Granting VPN Permissions
+Use the Identity and Access Management (IAM) service to implement fine-grained permissions control over your VPN resources. With IAM, you can:
+
- Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing VPN resources.
- Grant users only the permissions required to perform a given task based on their job responsibilities.
- Grant the permission to perform professional and efficient O&M on your VPN resources to other accounts or cloud services.
+
If your account meets your permissions requirements, you can skip this section.
+
This section describes the procedure for granting permissions (see Figure 1).
+
Prerequisites
You have learned about the permissions supported by VPN, and determined the permissions to be granted to a user group. Before granting permissions of other services, learn about all permissions supported by IAM.
+
+
Process Flow
Figure 1 Process of granting VPN permissions
+
- Create a user group and assign permissions to it.
Create a user group on the IAM console and attach the VPN Administrator policy to the group.
+ - Create a user and add it to the user group.
Create a user on the IAM console and add the user to the group created in 1.
+ - Log in and verify permissions.
Log in to the management console as the created user. Switch to the authorized region and verify the permissions.
+- Click Service List and choose Networking > Virtual Private Network. On the Enterprise – VPN Gateways page, click Create VPN Gateway in the upper right corner. If the VPN gateway is successfully created, the VPN Administrator policy has already taken effect.
- Choose any other service in Service List. If a message appears indicating that you have insufficient permissions to access the service, the VPN Administrator policy has already taken effect.
+
+
+
+
VPN Custom Policies
+Custom policies can be created to supplement the system-defined policies of VPN.
+
You can create custom policies in either of the following ways:
+
- Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
- JSON: Edit JSON policies from scratch or based on an existing policy.
+
For details, see Creating a Custom Policy. The following section contains examples of common VPN custom policies.
+
Example VPN custom policy
- Example 1: Grant permission to delete VPN gateways.
{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "vpn:vpnGateways:delete"
+ ]
+ }
+ ]
+}
+ - Example 2: Deny VPN connection deletion.
A policy with only "Deny" permissions must be used together with other policies. If the permissions granted to an IAM user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
+The following method can be used if you need to assign permissions of the VPN FullAccess policy to a user but also forbid the user from deleting VPN connections. Create a custom policy for denying VPN connection deletion, and assign both policies to the group the user belongs to. Then the user can perform all operations on VPN except deleting VPN connections. The following is an example of a deny policy:
+{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Deny",
+ "Action": [
+ "vpn:vpnGateways:delete"
+ ]
+ }
+ ]
+}
+ - Example 3: defining multiple actions in a policy
A custom policy can contain the actions of one or multiple services that are of the same type (global or project-level). The following is an example policy containing multiple actions.
+{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Allow",
+ "Action": [
+ "vpn:vpnGateways:create",
+ "vpn:vpnConnections:create",
+ "vpn:customerGateways:create"
+ ]
+ },
+ {
+ "Effect": "Deny",
+ "Action": [
+ "vpn:vpnGateways:delete",
+ "vpn:vpnConnections:delete",
+ "vpn:customerGateways:create"
+ ]
+ },
+ {
+ "Effect": "Allow",
+ "Action": [
+ "vpc:vpcs:list",
+ "vpc:subnets:get"
+ ]
+ }
+ ]
+}
+
+
+
FAQs
+
+
+
diff --git a/docs/vpn/umn/vpn_08_0232.html b/docs/vpn/umn/vpn_08_0232.html
new file mode 100644
index 00000000..4345cdc8
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_0232.html
@@ -0,0 +1,11 @@
+
+
+Where Can I Add Routes on the VPN Console to Reach the Remote Subnets?
+When a VPN connection is created, routes are automatically delivered to reach the remote subnets.
+
Will I Be Notified If a VPN Connection Is Interrupted?
+The VPN connection status can be monitored. After a VPN connection is created, the VPN service reports the connection status information to Cloud Eye, but does not automatically send alarm notifications to you. To receive notifications, create alarm rules and enable Alarm Notification on the Cloud Eye console.
+
After a VPN connection is created, you can locate the row that contains the VPN connection and choose Operation > View Metric to view the VPN connection status.
+
What Are the Differences Between the Application Scenarios and Connection Modes of IPsec and SSL VPNs?
+Scenarios
IPsec VPN connects two LANs, such as a branch and its headquarters (or a VPC), or an on-premises data center and a VPC.
+
SSL VPN connects a client to a LAN. For example, the portable computer of an employee on a business trip accesses the internal network of the company.
+
+
Connection Modes
IPsec VPN requires fixed gateways, such as firewalls or routers, at both ends. The administrator needs to configure gateways at both ends to complete IPsec VPN negotiation.
+
SSL VPN needs to install a specified client software on the server, then the server connects to the SSL device through the username and password.
+
+
Currently, only IPsec VPN is supported; SSL VPN is not supported.
+
+
+
How Do I Replace a Direct Connect Connection with a VPN?
+- Ensure that the on-premises gateway supports IPsec VPN.
- Create a VPN gateway and a VPN connection on the cloud. Select the VPC to which the Direct Connect connection uses for the VPN gateway.
When creating a VPN connection, configure its remote subnet as follows to avoid routing conflicts.
+
- Delete the virtual interface of the Direct Connect connection first and then configure the VPN connection.
- Divide the remote subnet into two subnets and configure the VPN connection. After the Direct Connect connection is deleted, configure the VPN connection again.
+
+
How Do I Access ECSs at Home When My Enterprise Network Has Been Connected to the Cloud Through a VPN?
+A VPN connects a VPC on the cloud and an on-premises local area network (LAN).
+
The home network is not a part of the LAN of your enterprise and cannot be directly connected to the VPC on the cloud.
+
If your host at home needs to access VPC resources on the cloud, your host can directly access the EIP of the cloud service or connect to the LAN of your enterprise through SSL VPN (if your enterprise supports SSL access) and then access VPC resources on the cloud through the LAN.
+
How Many VPN Connections Do I Need to Connect to Multiple On-premises Servers?
+VPN uses the IPsec technology to connect your on-premises data center to a VPC on the cloud. As such, the number of VPN connections is related to the number of data centers where the servers to be connected to the cloud are located, but not to the number of servers.
+
In most cases, one on-premises data center has one public gateway. All servers connect to the Internet through this gateway. Therefore, you only need to configure one VPN connection to allow communications between the VPC and your on-premises data center.
+
What Are the Impacts of a VPN on an On-premises Network? What Are the Changes to the Route for Accessing an ECS?
+When you configure a VPN, perform the following operations on the on-premises gateway:
+
- Configure IKE and IPsec policies.
- Specify the to-be-protected traffic (firewall).
- Check the route configuration on the gateway to ensure that traffic destined for a VPC can be routed to the correct outbound interface (interface having an IPsec policy bound).
+
After the VPN configuration is complete, only the traffic matching the ACL rules enters the VPN tunnel.
+
For example, before a VPN is created, on-premises users access the ECS through the EIP bound to the ECS. After a VPN is created, data flows matching the firewall rules access the private IP address of the ECS through the VPN tunnel.
+
How Do I Configure DPD for Interconnection with the Cloud?
+By default, DPD is enabled on the cloud side and cannot be disabled.
+
Configure DPD as follows:
+
- DPD-type: on-demand
- DPD idle-time: 30s
- DPD retransmit-interval: 15s
- DPD retry-limit: 3
- DPD msg: seq-hash-notify
+
The DPD msg format at both ends of the VPN connection must be the same, but the DPD type, idle time, retransmission interval, and retry limit can be different.
+
Why Is Not Connected Displayed as the Status for a Successfully Created VPN Connection?
+After a VPN connection is created, its status changes to Normal only after servers at both ends of the VPN connection communicate with each other.
+
- IKE v1:
If no traffic goes through the VPN connection for a period of time, the VPN connection needs to be renegotiated. The negotiation time depends on the value of Lifetime (s) in the IPsec policy. Generally, Lifetime (s) is set to 3600 (1 hour), indicating that the negotiation will be initiated in the fifty-fourth minute. If the negotiation succeeds, the connection remains to the next round of negotiation. If the negotiation fails, the VPN connection status changes to Not Connected within one hour. The connection can be restored only after the two ends of the VPN connection communicate with each other. The disconnection can be avoided by using a network monitoring tool, such as IP SLA, to generate packets.
+ - IKE v2: If no traffic goes through the VPN connection for a period of time, the VPN connection remains in the connected status.
+
What Is the VPN Quota?
+What Is a Quota?
Quotas can limit the number or amount of resources available to users, such as the maximum number of ECSs or EVS disks that can be created.
+
If the existing resource quota cannot meet your service requirements, you can apply for a higher quota.
+
+
How Do I View My Quota?
- Log in to the management console.
- Click
in the upper left corner and select the desired region and project. - Click
(the My Quotas icon) in the upper right corner.The Service Quota page is displayed.
+ - View the used and total quota of each type of resources on the displayed page.
If a quota cannot meet service requirements, apply for a higher quota.
+
+
+
Security
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1504.html b/docs/vpn/umn/vpn_08_1504.html
new file mode 100644
index 00000000..1b1b8edc
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1504.html
@@ -0,0 +1,11 @@
+
+
+SSL VPN
+SSL VPN is a virtual private network technology using the SSL protocol. It allows remote users to securely access enterprise intranet resources.
+
Enterprise Edition VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1507.html b/docs/vpn/umn/vpn_08_1507.html
new file mode 100644
index 00000000..3929f646
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1507.html
@@ -0,0 +1,15 @@
+
+
+Classic VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1509.html b/docs/vpn/umn/vpn_08_1509.html
new file mode 100644
index 00000000..18204570
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1509.html
@@ -0,0 +1,19 @@
+
+
+Enterprise Edition VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1511.html b/docs/vpn/umn/vpn_08_1511.html
new file mode 100644
index 00000000..74666bc5
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1511.html
@@ -0,0 +1,15 @@
+
+
+Classic VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1513.html b/docs/vpn/umn/vpn_08_1513.html
new file mode 100644
index 00000000..5a95765a
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1513.html
@@ -0,0 +1,19 @@
+
+
+Tag Management
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1514.html b/docs/vpn/umn/vpn_08_1514.html
new file mode 100644
index 00000000..572bdfa4
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1514.html
@@ -0,0 +1,38 @@
+
+
+Scenario
+VPN tags are used to identify VPN resources, facilitating VPN resource identification and management. You can add tags for a VPN resource when you create the VPN resource. Alternatively, you add tags for an existing VPN resource on the resource details page. A maximum of 20 tags can be added for each VPN resource.
+
A tag consists of a key and a value. Table 1 describes the requirements on the keys and values of VPN tags.
+
+
Table 1 Requirements on the keys and values of VPN tagsParameter
+ |
+Requirement
+ |
+Example Value
+ |
+
|---|
+
+Key
+ |
+- Cannot be left blank.
- Must be unique for the same VPN.
- Can contain a maximum of 128 characters.
+ |
+vpn_key1
+ |
+
+Value
+ |
+- Can contain a maximum of 255 characters.
+ |
+vpn-01
+ |
+
+
+
+
+
Searching for Resources by Tag
+Context
You can search for VPN gateways, customer gateways, and VPN connections based on the tag keys and values that have been added for these VPN resources.
+
+
Procedure
Searching for Enterprise Edition VPN gateways by tag
+
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- Click in the text box for selecting a property or entering a keyword, choose a tag key under Resource Tag, and select a tag value.
The system displays the VPN gateways that match the selected tag key and value.
- You can only select existing keys and values from the drop-down list.
- You can select a maximum of 20 tags to search for VPN resources. If you select multiple tags, the relationship between them is AND.
- You can use tags together with other types of filter criteria. The relationship between them is AND.
+
+
Searching for customer gateways of Enterprise Edition VPN by tag
+
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose Virtual Private Network > Enterprise – Customer Gateways.
- Click in the text box for selecting a property or entering a keyword, choose a tag key under Resource Tag, and select a tag value.
The system displays the customer gateways that match the selected tag key and value.
- You can only select existing keys and values from the drop-down list.
- You can select a maximum of 20 tags to search for VPN resources. If you select multiple tags, the relationship between them is AND.
- You can use tags together with other types of filter criteria. The relationship between them is AND.
+
+
Searching for Enterprise Edition VPN connections by tag
+
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Connections.
- Click in the text box for selecting a property or entering a keyword, choose a tag key under Resource Tag, and select a tag value.
The system displays the VPN connections that match the selected tag key and value.
- You can only select existing keys and values from the drop-down list.
- You can select a maximum of 20 tags to search for VPN resources. If you select multiple tags, the relationship between them is AND.
- You can use tags together with other types of filter criteria. The relationship between them is AND.
+
+
Searching for Classic VPN gateways by tag
+
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click Service List and choose Network > Virtual Private Network.
- In the navigation pane on the left, choose Virtual Private Network > Classic.
- Click Search by Tag in the upper right corner, select the desired tag key and value, and click Search.
- You can only select existing keys and values from the drop-down list.
- You can select a maximum of 20 tags to search for VPN resources.
+
+
+
Managing Tags
+Context
You can add, delete, modify, and view tags of VPN gateways.
+
+
Procedure
Managing tags of Enterprise Edition VPN gateways- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- Click the name of the target VPN gateway. The VPN gateway details page is displayed.
- Click the Tags tab, and add, delete, modify, or view tags of the VPN gateway.
- Add a tag.
Click Add Tag. In the Add Tag dialog box, enter the key and value of a tag to be added, and click OK.
+ - Modify a tag.
Click Edit in the Operation column of the target tag. In the Edit Tag dialog box, change the tag value and click OK.
+ - Delete a tag.
Click Delete in the Operation column of the target tag. In the Delete Tag dialog box, click OK.
+ - View tags.
On the Tags page, view tag details, including the number of new tags that can be created and the key and value of each existing tag.
+
+
+
+
Managing tags of Classic VPN gateways
+
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click Service List and choose Network > Virtual Private Network.
- In the navigation pane on the left, choose Virtual Private Network > Classic.
- On the Classic page, click the name of the target VPN gateway. The VPN gateway details page is displayed.
- Click the Tags tab, and add, delete, modify, or view tags of the VPN gateway.
- Add a tag.
Click Add Tag. In the Add Tag dialog box, enter the key and value of a tag to be added, and click OK.
+ - Modify a tag.
Click Edit in the Operation column of the target tag. In the Edit Tag dialog box, change the tag value and click OK.
+ - Delete a tag.
Click Delete in the Operation column of the target tag. In the Delete Tag dialog box, click OK.
+ - View tags.
On the Tags page, view tag details, including the number of new tags that can be created and the key and value of each existing tag.
+
+
+
+
Enterprise Edition VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1518.html b/docs/vpn/umn/vpn_08_1518.html
new file mode 100644
index 00000000..f0bf4500
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1518.html
@@ -0,0 +1,33 @@
+
+
+Classic VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_08_1519.html b/docs/vpn/umn/vpn_08_1519.html
new file mode 100644
index 00000000..5c559177
--- /dev/null
+++ b/docs/vpn/umn/vpn_08_1519.html
@@ -0,0 +1,121 @@
+
+
+Change History
+
+
Released On
+ |
+Description
+ |
+
|---|
+
+2024-08-23
+ |
+This release incorporates the following changes:
+
+ |
+
+2024-03-15
+ |
+This release incorporates the following changes:
+
+ |
+
+2020-11-01
+ |
+This release incorporates the following changes:
+- Updated the value range of the pre-shared key in Table 1.
- Adjusted the column width of the table in Creating a VPN.
+ |
+
+2019-02-22
+ |
+This release incorporates the following changes:
+Updated the region description in Table 1.
+ |
+
+2019-02-18
+ |
+Accepted in OTC-4.0/Agile-02.2019
+ |
+
+2019-02-11
+ |
+This release incorporates the following changes:
+- Deleted content about the firewall version from section Creating a VPN.
- Added Table 1.
- Adjusted the column width of a table.
+ |
+
+2019-02-02
+ |
+This release incorporates the following changes:
+
+ |
+
+2019-01-30
+ |
+This release incorporates the following changes:
+- Sorted the DH algorithms to display in Table 2.
- Sorted the PFS algorithms to display in Table 3
- Added description to show how to query the firewall version in step 5.
+ |
+
+2019-01-23
+ |
+This release incorporates the following changes:
+
+ |
+
+2019-01-02
+ |
+This release incorporates the following changes:
+Added description about the PFS function to the section for configuring the IPsec policy of a VPN.
+ |
+
+2018-04-30
+ |
+This issue is the eighth official release, which incorporates the following change:
+Added support for tags configured during VPN creation.
+ |
+
+2017-08-30
+ |
+This issue is the seventh official release, which incorporates the following change:
+Added description about VPC and subnet tags.
+ |
+
+2017-07-30
+ |
+This issue is the sixth official release, which incorporates the following change:
+- Added the best practice.
- Added support for the multi-project feature.
+ |
+
+2017-04-28
+ |
+This issue is the fifth official release, which incorporates the following change:
+- Changed the maximum number obtained by multiplying the number of local subnets and that of remote subnets of a VPN to 2500.
+ |
+
+2017-03-30
+ |
+This issue is the fourth official release, which incorporates the following change:
+Added an example illustrating how to configure the remote device of a VPN.
+ |
+
+2017-01-20
+ |
+This issue is the third official release, which incorporates the following change:
+- Added description about the IPsec VPN created between multiple local gateways in different VPCs and the same remote gateway.
+ |
+
+2016-12-30
+ |
+This issue is the second official release, which incorporates the following change:
+Added FAQs.
+ |
+
+2016-10-19
+ |
+This issue is the first official release.
+ |
+
+
+
+
+
Administrator Guide
+
+
+
diff --git a/docs/vpn/umn/vpn_admin_0016.html b/docs/vpn/umn/vpn_admin_0016.html
new file mode 100644
index 00000000..4205f9b3
--- /dev/null
+++ b/docs/vpn/umn/vpn_admin_0016.html
@@ -0,0 +1,125 @@
+
+
+Configuring VPN When Fortinet FortiGate Firewall Is Used
+Scenarios
This section describes how to create a VPN gateway and VPN connections to connect your on-premises network to a VPC subnet if your local data center uses FortiGate firewalls as Internet egresses.
+
+
Topology Connection
As shown in Figure 1, the local data center has multiple Internet egresses. The egress 11.11.11.11 is specified to establish a VPN connection with a VPC. The subnet of the local data center is 10.10.0.0/16, and the VPC subnet is 172.16.0.0/24. The IP address of the VPN gateway you created is 22.22.22.22. Create a VPN connection to connect your on-premises network to the VPC subnet.
+
Figure 1 Multi-egress on-premises network connecting to a VPC through a VPN
+
+
Configure the VPN connection policies based on Figure 2.
+
Figure 2 Policy details
+
+
Configuration Procedure
This example describes how to configure a VPN if a FortiGate firewall is used in your local data center.
+
- Configure IPsec VPN.
- Create a tunnel.
- Configure the basic information for the tunnel.
- Configure IKE phase 1 parameters.
- Configure IPsec phase 2 parameters.
- Configure the IPsec tunnel.
+ - Configure routes.
- Add a static route.
Add a route to the cloud VPC subnet 172.16.0.0/24, with the outbound interface being the VPN tunnel interface.
+ - Configure policy-based routes for multiple egresses.
Set the source address to the subnet of the local data center and the destination address to the subnet of the VPC. Adjust the configuration sequence of the policy-based routes to ensure that the policy-based routes will be preferentially used.
+
+ - Configure policies and NAT.
- Configure a policy for access to the cloud from the local data center.
- Configure a policy for access to the local data center from the cloud.
+
+
+
Configuration Verification
- Check whether the on-premises VPN status is normal.
- Check whether the cloud-based VPN status is normal.
+
+
Configuration Using the CLI
- Configure the physical interface.
config system interface
+ edit "port1"
+ set vdom "root"
+ set ip 11.11.11.11 255.255.255.0
+ set type physical
+next
+ edit "IPsec" //Tunnel interface configuration
+ set vdom "root"
+ set type tunnel
+ set interface "port1" //Physical interface bound to the tunnel
+ next
+ end
+ - Configure interface zones.
config system zone
+ edit "trust"
+ set intrazone allow
+ set interface "A1"
+ next
+ edit "untrust"
+ set intrazone allow
+ set interface "port1 "
+ next
+end
+ - Configure subnets.
config firewall address
+ edit "hw-172.16.0.0/24"
+ set uuid f612b4bc-5487-51e9-e755-08456712a7a0
+ set subnet 172.16.0.0 255.255.255.0 //Subnet on the cloud
+ next
+ edit "local-10.10.0.0/16"
+ set uuid 9f268868-5489-45e9-d409-5abc9a946c0c
+ set subnet 10.10.0.0 255.255.0.0 //Subnet of the local data center
+ next
+ - Configure IPsec.
config vpn IPsec phase1-interface //Phase 1 configuration
+ edit "IPsec"
+ set interface "port1"
+ set nattraversal disable
+ set proposal aes128-sha1
+ set comments "IPsec"
+ set dhgrp 5
+ set remote-gw 22.22.22.22
+ set psksecret ENC dmFyLzF4tRrIjV3T+lSzhQeU2nGEoYKC31NaYRWFJl8krlwNmZX5SfwUi5W5RLJqFu82VYKYsXp5+HZJ13VYY8O2Sn/vruzdLxqu84zbHEIQkTlf5n/63KEru1rRoNiHDTWfh3A3ep3fKJmxf43pQ7OD64t151ol06FMjUBLHgJ1ep9d32Q0F3f3oUxfDQs21Bi9RA==
+ next
+end
+config vpn IPsec phase2-interface //Phase 2 configuration
+ edit "IP-TEST"
+ set phase1name "IPsec "
+ set proposal aes128-sha1
+ set dhgrp 5
+ set keylifeseconds 3600
+ set src-subnet 10.10.0.0 255.255.0.0
+ set dst-subnet 172.16.0.0 255.255.255.0
+ next
+end
+ - Configure access policies.
config firewall policy
+ edit 15 //Policy 15 is used to access the on-premises data center from the cloud. NAT is disabled.
+ set uuid 4f452870-ddb2-51e5-35c9-38a987ebdb6c
+ set srcintf "IPsec"
+ set dstintf "trust"
+ set srcaddr "hw-172.16.0.0/24"
+ set dstaddr "local-10.10.0.0/16"
+ set action accept
+ set schedule "always"
+ set service "ALL"
+ set logtraffic all
+ next
+ edit 29 //Policy 29 is used to access the cloud from the on-premises data center. NAT is disabled.
+ set uuid c2d0ec77-5254-51e9-80dc-2813ccf51463
+ set srcintf "trust"
+ set dstintf "IPsec"
+ set srcaddr "local-10.10.0.0/16"
+ set dstaddr "hw-172.16.0.0/24"
+ set action accept
+ set schedule "always"
+ set service "ALL"
+ set logtraffic all
+ next
+ - Configure routes.
config router static
+ edit 24 //Route 24 is a static route that is used to access on the cloud.
+ set dst 172.16.0.0 255.255.255.0
+ set gateway 11.11.11.1
+ set distance 10
+ set device "port1"
+config router policy
+edit 2 //Policy-based route 2 is used to access the cloud from the on-premises data center.
+ set input-device "A1"
+ set src "10.10.00/255.255.0.0"
+ set dst "172.16.0.0/255.255.255.0"
+ set gateway 11.11.11.1
+ set output-device "port1"
+
+
+
What Are the Typical Scenarios of IPsec VPN?
+A VPN is a point-to-point connection that implements private network access between two points.
+
- Applicable scenarios:
- A VPN is created between different regions to enable cross-region VPC communications.
- A VPN hub is used together with VPC peering connections and Cloud Connect connections to enable communications between an on-premises data center and multiple VPCs on the cloud.
- A VPN is used together with source NAT to enable access to specific IP addresses across clouds.
+ - Not applicable scenarios:
- A VPN cannot be used to connect VPCs in the same region. It is recommended that you use VPC peering connections to enable communications between VPCs in the same region.
- A VPN cannot be used between the cloud and your home network that uses PPPoE dial-up.
- A VPN cannot be used between the cloud and 4G/5G routers.
- A VPN cannot be used between the cloud and your personal terminals.
+
+
What Are a VPC, a VPN Gateway, and a VPN Connection?
+VPC enables you to create private, isolated virtual networks. You can use VPN to securely access ECSs in VPCs.
+
A VPN gateway is an egress gateway for a VPC. With a VPN gateway, you can create a secure, reliable, and encrypted connection between a VPC and an on-premises data center or between two VPCs in different regions.
+
A VPN connection is a secure and reliable IPsec encrypted communications tunnel established between a VPN gateway and the customer gateway in an on-premises data center.
+
To create a VPN on the cloud, perform the following operations:
+
- Create a VPN gateway. You need to specify the VPC to be connected, as well as the bandwidth and EIPs of the VPN gateway.
- Create a VPN connection. You need to specify the gateway EIP used to connect to the customer gateway, subnets, and negotiation policies.
+
How Do I Plan CIDR Blocks for Access to a VPC Through a VPN Connection?
+- The CIDR blocks of a VPC cannot conflict with on-premises CIDR blocks.
- To avoid conflicts with cloud service addresses, do not use 127.0.0.0/8, 169.254.0.0/16, 224.0.0.0/3, or 100.64.0.0/10 for your on-premises network.
+
Is an IPsec VPN Connection Automatically Established?
+Yes. An IPsec VPN connection is automatically established.
+
What Are VPN Negotiation Parameters? What Are Their Default Values?
+
+
Table 1 VPN negotiation parametersProtocol
+ |
+Parameter
+ |
+Value
+ |
+
|---|
+
+IKE
+ |
+Version
+ |
+- v1 (v1 has low security. If the device supports v2, v2 is recommended.)
- v2 (default value)
+ |
+
+Negotiation Mode
+ |
+- Main (default value)
- Aggressive
+ |
+
+Authentication Algorithm
+ |
+- MD5 (This algorithm is insecure. Exercise caution when using this algorithm.)
- SHA1 (This algorithm is insecure. Exercise caution when using this algorithm.)
- SHA2-256 (default value)
- SHA2-384
- SHA2-512
+ |
+
+Encryption Algorithm
+ |
+- 3DES (This algorithm is insecure. Exercise caution when using this algorithm.)
- AES-128 (default value)
- AES-192 (This algorithm is insecure. Exercise caution when using this algorithm.)
- AES-256 (This algorithm is insecure. Exercise caution when using this algorithm.)
- AES-256-GCM-16
+ |
+
+DH Algorithm
+ |
+- Group 1 (This algorithm is insecure. Exercise caution when using this algorithm.)
- Group 2 (This algorithm is insecure. Exercise caution when using this algorithm.)
- Group 5 (This algorithm is insecure. Exercise caution when using this algorithm.)
- Group 14 (default value)
- Group 15
- Group 16
- Group 19
- Group 20
- Group 21
+ |
+
+Lifetime (s)
+ |
+86400 (default value)
+Unit: second
+Value range: 60 to 604800
+ |
+
+Local ID
+ |
+
+ By default, the local ID type is IP address and the local ID value is the EIP of the VPN gateway.
+ |
+
+Customer ID
+ |
+
+ By default, the customer ID type is IP address and the customer ID value is the public IP address of the customer gateway.
+ |
+
+IPsec
+ |
+Authentication Algorithm
+ |
+- SHA1 (This algorithm is insecure. Exercise caution when using this algorithm.)
- MD5 (This algorithm is insecure. Exercise caution when using this algorithm.)
- SHA2-256 (default value)
- SHA2-384
- SHA2-512
+ |
+
+Encryption Algorithm
+ |
+- AES-128 (default value)
- AES-192 (This algorithm is insecure. Exercise caution when using this algorithm.)
- AES-256 (This algorithm is insecure. Exercise caution when using this algorithm.)
- 3DES (This algorithm is insecure. Exercise caution when using this algorithm.)
- AES-128-GCM-16
- AES-256-GCM-16
+ |
+
+PFS
+ |
+
+ |
+
+Transfer Protocol
+ |
+
+ |
+
+Lifetime (s)
+ |
+3600 (default value)
+Unit: second
+Value range: 30 to 604800
+ |
+
+
+
+
+
- Perfect Forward Secrecy (PFS) is a security feature.
IKE negotiation has two phases, phase one and phase two. The key of phase two (IPsec SA) is derived from the key generated in phase one. Once the key in phase one is disclosed, the security of the IPsec VPN may be adversely affected. To improve the key security, IKE provides PFS. When PFS is enabled, an additional DH exchange will be performed during IPsec SA negotiation to generate a new IPsec SA key, improving IPsec SA security.
+ - For security purposes, PFS is enabled on the cloud side by default. Ensure that PFS is also enabled on the gateway device in your on-premises data center and the PFS settings on both ends are the same. Otherwise, the negotiation will fail.
- The default traffic-based lifetime of an IPsec SA is 1,843,200 KB on the cloud side and cannot be changed for the VPN. This parameter is not involved in negotiation and has no impact on the establishment of an IPsec SA.
+
+
Are a Username and Password Required for Creating an IPsec VPN Connection?
+No. IPsec VPN uses a pre-shared key (PSK) for authentication. The PSK is configured on a VPN gateway, and a connection will be established after VPN negotiation is complete. Therefore, no username or password is required for creating an IPsec VPN connection. Generally, SSL, PPTP, and L2TP VPNs use usernames and passwords for authentication.
+
IPsec XAUTH provides extended authentication for IPsec VPN. It requires users to enter their usernames and passwords during VPN negotiation.
+
Currently, VPN does not support IPsec XAUTH.
+
+
What VPN Resources Can Be Monitored?
+VPN gateway
+
The following bandwidth information of a VPN gateway IP address can be monitored: inbound traffic, inbound bandwidth, outbound traffic, outbound bandwidth, and outbound bandwidth usage.
+
VPN connection
+
The following information about a VPN connection can be monitored: VPN connection status, average link round-trip time (RTT), maximum link RTT, link packet loss rate, average tunnel RTT, maximum tunnel RTT, and tunnel packet loss rate.
+
To monitor average link RTT, maximum link RTT, link packet loss rate, average tunnel RTT, maximum tunnel RTT, and tunnel packet loss rate, click the VPN connection name and click Add in the Health Check area on the Summary tab page to add health check items.
+
Can EIPs Be Used as VPN Gateway IP Addresses?
+Yes.
+
When creating a VPN gateway, you can bind EIPs as the gateway IP addresses.
+
Which IKE Version Should I Select When I Create a VPN Connection?
+IKEv2 is recommended because IKEv1 is not secure. In addition, IKEv2 outperforms IKEv1 in connection negotiation and establishment, authentication methods, dead peer detection (DPD) timeout processing, and security association (SA) timeout processing.
+
IKEv2 will be widely used, and IKEv1 will gradually phase out.
+
Introduction to IKEv1 and IKEv2
- As a hybrid protocol, IKEv1 brings some security and performance defects due to its complexity. As such, it has become a bottleneck in the IPsec system.
- IKEv2 addresses the issues of IKEv1 while retaining basic functions of IKEv1. IKEv2 is more simplified, efficient, secure, and robust than IKEv1. Additionally, IKEv2 is defined by RFC 4306 in a single document, whereas IKEv1 are defined in multiple documents. By minimizing core functions and default password algorithms, IKEv2 greatly improves interoperability between different IPsec VPNs.
+
+
Security Risks of IKEv1
+
+
Differences Between IKEv1 and IKEv2
- Negotiation process
- IKEv1 is complex and consumes a large amount of bandwidth. IKEv1 SA negotiation consists of two phases. In IKEv1 phase 1, an IKE SA is established in either main mode or aggressive mode. Main mode requires three exchanges between peers totaling six ISAKMP messages, whereas aggressive mode requires two exchanges totaling three ISAKMP messages. Aggressive mode is faster, but does not provide identity protection for peers as key exchange and identity authentication are performed simultaneously. In IKEv1 phase 2, IPsec SAs are established through three ISAKMP messages in quick mode.
- Compared with IKEv1, IKEv2 simplifies the SA negotiation process. IKEv2 requires only two exchanges, totaling four messages, to establish an IKE SA and a pair of IPsec SAs. To create multiple pairs of IPsec SAs, only one additional exchange is needed for each additional pair of SAs.
For IKEv1 negotiation, its main mode involves nine (6+3) messages, and its aggressive mode involves six (3+3) messages. In contrast, IKEv2 negotiation requires only four (2+2) messages.
+
+
+ - Authentication methods
- Only IKEv1 (requiring an encryption card) supports digital envelope authentication (HSS-DE).
- IKEv2 supports Extensible Authentication Protocol (EAP) authentication. IKEv2 can use an AAA server to remotely authenticate mobile and PC users and assign private IP addresses to these users. IKEv1 does not provide this function and must use L2TP to assign private IP addresses.
- Only IKEv2 supports IKE SA integrity algorithms.
+ - DPD timeout processing
- Only IKEv1 supports the retry-interval parameter. If a device sends a DPD packet but receives no reply within the specified retry-interval, the device records a DPD failure event. When the number of DPD failure events reaches 5, both the IKE SA and IPsec SAs are deleted. IKE SA negotiation will start again only when there is traffic to be transmitted over the IPsec tunnel.
- In IKEv2, the retransmission interval increases from 1, 2, 4, 8, 16, 32 to 64, in seconds. If no reply is received within eight consecutive transmissions, the peer end is considered dead, and the IKE SA and IPsec SAs are deleted.
+ - IKE SA timeout processing and IPsec SA timeout processing
In IKEv2, the IKE SA soft lifetime is 9/10 of the IKE SA hard lifetime plus or minus a random number. This reduces the likelihood that two ends initiate renegotiation simultaneously. Therefore, you do not manually set the soft lifetime in IKEv2.
+
+
+
Advantages of IKEv2 over IKEv1
+
+
What Do I Do If a VPN Connection Fails to Be Established?
+- Log in to the management console and choose Virtual Private Network > Enterprise – VPN Connections.
- In the VPN connection list, locate the target VPN connection, and choose More > Modify Policy Settings on the right to view IKE and IPsec policies of the VPN connection.
- Check the IKE and IPsec policies to see whether the negotiation modes and encryption algorithms at both ends of the VPN connection are the same.
If the IKE SA has been set up in phase 1 but no IPsec SA has been established in phase 2, the IPsec policies at both ends of the VPN connection may be inconsistent.
+
- Check whether the firewall configurations are correct.
If the subnets of your on-premises data center are 192.168.3.0/24 and 192.168.4.0/24, and the VPC subnets are 192.168.1.0/24 and 192.168.2.0/24, configure the firewall function for each on-premises subnet to allow communication with the VPC subnets. The following provides an example of firewall configurations:
+rule 1 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
+rule 2 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
+rule 3 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
+rule 4 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
+ - Ping the two ends of the VPN connection from each other to check whether the VPN connection is normal.
+
How Many IPsec VPNs Can I Have?
-By default, a user can have a maximum of five IPsec VPNs. If your quota cannot fulfill your service requirements, submit a service ticket to increase the quota.
-
What Do I Do If VPN Setup Fails?
-- Log in to the management console and click Virtual Private Network.
- In the VPN list, locate the target VPN and click View Policy in the Operation
column to view IKE and IPsec policy details about the VPN.
- - Check the IKE and IPsec policies to see whether the negotiation modes and encryption algorithms between the local and remote sides of the VPN are the same.
- If the IKE policy has been set up during phase one and the IPsec policy has not been enabled in phase two, the IPsec policies between the local and remote sides of the VPN may be inconsistent.
- If the Cisco physical device is used at the customer side, it is recommended that you use MD5. Then, you need to set Authentication Mode to MD5 in the IPsec policy for the VPN created on the cloud.
- - Check whether the ACL configurations are correct.
If the subnets of your data center are 192.168.3.0/24 and 192.168.4.0/24, and the VPC subnets are 192.168.1.0/24 and 192.168.2.0/24, configure the ACL rules for each data center subnet to permit the communication with the VPC subnets. The following provides an example of ACL configurations:
-rule 1 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
-rule 2 permit ip source 192.168.3.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
-rule 3 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
-rule 4 permit ip source 192.168.4.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
- - After the configuration is complete, ping the local and the remote side from each other to check whether the VPN connection is normal.
-
How Can I Handle the Failure in Accessing the ECSs from My Data Center or LAN Even If the VPN Has Been Set Up?
-The security group denies the access from all sources by default. If you want to access your ECSs, modify the security group configuration and allow the access from the remote subnets.
-
What Do I Do If I Cannot Access My Data Center or LAN from the ECSs After a VPN Connection Has Been Set Up?
-Check whether you have properly configured the firewall policies for the access from the public IP address of the cloud VPN to the public IP address of your data center or LAN. No policies are configured to limit the access by default.
-
Does a VPN Allow for Communication Between Two VPCs?
-If the two VPCs are in the same region, you can use a VPC peering connection to enable communication between them.
-
If the two VPCs are in different regions, you can use a VPN to enable communication between the VPCs. The CIDR blocks of the two VPCs are the local and remote subnets, respectively.
-
Overview
+The supported regions are subject to those available on the console.
+
+
Scenario
To meet business development requirements, enterprise A needs to implement communication between its on-premises data center and its VPC. In this case, enterprise A can use the VPN service to create connections between the on-premises data center and the VPC.
+
- If the on-premises data center has only one customer gateway and this gateway can be configured with only one IP address, it is recommended that the VPN gateway uses the active-active mode. Figure 1 shows the networking.
In active-active mode, if connection 1 fails, traffic is automatically switched to connection 2, without affecting enterprise services. After connection 1 recovers, VPN still uses connection 2 for data transmission.
Figure 1 Active-active mode
+
- If the on-premises data center has two customer gateways or has only one customer gateway that can be configured with two IP addresses, it is recommended that the VPN gateway use the active/standby mode. Figure 2 shows the networking.
In active/standby mode, connection 1 is the active link and connection 2 is the standby link. By default, traffic is transmitted only through the active link. If the active link fails, traffic is automatically switched to the standby link, without affecting enterprise services. After the active link recovers, traffic is switched back to the active link.
Figure 2 Active/Standby mode
+
+
+
Limitations and Constraints
+
+
Data Plan
+
Table 1 Data planCategory
+ |
+Item
+ |
+Data
+ |
+
|---|
+
+VPC
+ |
+Subnet that needs to access the on-premises data center
+ |
+192.168.0.0/16
+ |
+
+VPN gateway
+ |
+Interconnection subnet
+ |
+This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.
+192.168.2.0/24
+ |
+
+VPN gateway
+ |
+HA mode
+ |
+Active-active
+ |
+
+VPN gateway
+ |
+EIP
+ |
+EIPs are automatically generated when you buy them. By default, a VPN gateway uses two EIPs. In this example, the EIPs are as follows:
+- Active EIP: 11.xx.xx.11
- Active EIP 2: 11.xx.xx.12
+ |
+
+VPN connection
+ |
+Tunnel interface address
+ |
+This address is used by a VPN gateway to establish an IPsec tunnel with a customer gateway. At the two ends of the IPsec tunnel, the configured local and remote tunnel interface addresses must be reversed.
+- VPN connection 1: 169.254.70.1/30
- VPN connection 2: 169.254.71.1/30
+ |
+
+On-premises data center
+ |
+Subnet that needs to access the VPC
+ |
+172.16.0.0/16
+ |
+
+Customer gateway
+ |
+Gateway IP address
+ |
+The gateway IP address is assigned by a carrier. In this example, the gateway IP address is:
+22.xx.xx.22
+ |
+
+Customer gateway
+ |
+Tunnel interface address
+ |
+- VPN connection 1: 169.254.70.2/30
- VPN connection 2: 169.254.71.2/30
+ |
+
+
+
+
+
+
Operation Process
Figure 3 shows the process of using the VPN service to enable communication between an on-premises data center and a VPC.
+
Figure 3 Operation process
+
+
Table 2 Operation process descriptionNo.
+ |
+Step
+ |
+Description
+ |
+
|---|
+
+1
+ |
+Step 1: Creating a VPN Gateway
+ |
+Bind two EIPs to the VPN gateway.
+If you have purchased EIPs, you can directly bind them to the VPN gateway.
+ |
+
+2
+ |
+Step 2: Creating a Customer Gateway
+ |
+Configure the VPN device in the on-premises data center as the customer gateway.
+ |
+
+3
+ |
+Step 3: Creating VPN Connection 1
+ |
+Create a VPN connection between the active EIP of the VPN gateway and the customer gateway.
+ |
+
+4
+ |
+Step 4: Creating VPN Connection 2
+ |
+Create a VPN connection between active EIP 2 of the VPN gateway and the customer gateway.
+It is recommended that the routing mode, PSK, IKE policy, and IPsec policy settings of the two VPN connections be the same.
+ |
+
+5
+ |
+Step 5: Configuring the Customer Gateway Device
+ |
+- The local and remote tunnel interface addresses configured on the customer gateway device must be the same as the customer and local tunnel interface addresses of the VPN connection, respectively.
- The routing mode, PSK, IKE policy, and IPsec policy settings on the customer gateway device must be same as those of the VPN connection.
+ |
+
+6
+ |
+Step 6: Verifying Network Connectivity
+ |
+Log in to an ECS and run the ping command to verify the network connectivity.
+ |
+
+
+
+
+
+
Step 2: Creating a Customer Gateway
+Procedure
- In the navigation pane on the left, choose .
- On the Customer Gateways page, click Create Customer Gateway.
- Set parameters as prompted and click OK.
The following describes only key parameters.
+
+Table 1 Customer gateway parametersParameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Name
+ |
+Name a customer gateway.
+ |
+cgw-001
+ |
+
+Routing Mode
+ |
+Set the routing mode of the customer gateway.
+The options include Dynamic (BGP) and Static.
+ |
+Static
+ |
+
+Gateway IP Address
+ |
+Enter the IP address of the customer gateway.
+ |
+IP Address, 22.xx.xx.22
+ |
+
+BGP ASN
+ |
+The BGP ASN needs to be specified only when Routing Mode is set to Dynamic (BGP).
+Enter the ASN of your on-premises data center or private network.
+The BGP ASN of the customer gateway must be different from that of the VPN gateway.
+ |
+65000
+ |
+
+Advanced Settings > Tags
+ |
+Configure Tags in Advanced Settings.
+ |
+-
+ |
+
+
+
+
+
+
Verification
Check the created customer gateway on the Customer Gateways page.
+
+
Step 3: Creating VPN Connection 1
+Procedure
- In the navigation pane on the left, choose .
- On the VPN Connections page, click Create VPN Connection.
- Set parameters for VPN connection 1 as prompted and click Submit.
The following describes only key parameters.
+
+Table 1 Parameter settings for VPN connection 1Parameter
+ |
+Description
+ |
+Example Value
+ |
+
|---|
+
+Name
+ |
+Enter the name of VPN connection 1.
+ |
+vpn-001
+ |
+
+VPN Gateway
+ |
+Select the VPN gateway created in Step 1: Creating a VPN Gateway.
+ |
+vpngw-001
+ |
+
+Gateway IP Address
+ |
+Select the active EIP of the VPN gateway.
+ |
+11.xx.xx.11
+ |
+
+Customer Gateway
+ |
+Select the customer gateway created in Step 2: Creating a Customer Gateway.
+ |
+cgw-001
+ |
+
+VPN Type
+ |
+Select Static routing.
+ |
+Static routing
+ |
+
+Customer Subnet
+ |
+Enter the subnet of the on-premises data center that needs to access the VPC.
+ NOTE: - The customer subnet can overlap with the local subnet but cannot be the same as the local subnet.
- A customer subnet cannot be included in the existing subnets of the VPC associated with the VPN gateway. It also cannot be the destination address in the route table of the VPC associated with the VPN gateway.
- Customer subnets cannot be the reserved CIDR blocks of VPCs, for example, 100.64.0.0/10 or 214.0.0.0/8.
- If the interconnection subnet is associated with an ACL rule, ensure that the ACL rule permits the TCP port for traffic between all local and customer subnets.
- Address groups cannot be used to configure the source and destination subnets in a policy on customer gateway devices.
+
+ |
+172.16.0.0/16
+ |
+
+Interface IP Address Assignment
+ |
+The options include Manually specify and Automatically assign.
+ |
+Manually specify
+ |
+
+Local Tunnel Interface Address
+ |
+Specify the tunnel interface address configured on the VPN gateway.
+ NOTE: The local and remote interface addresses configured on the customer gateway device must be the same as the values of Customer Tunnel Interface IP Address and Local Tunnel Interface IP Address, respectively.
+
+ |
+169.254.70.2/30
+ |
+
+Customer Tunnel Interface Address
+ |
+Specify the tunnel interface address configured on the customer gateway device.
+ |
+169.254.70.1/30
+ |
+
+Link Detection
+ |
+This function is used for route reliability detection in multi-link scenarios.
+ NOTE: When enabling this function, ensure that the customer gateway supports ICMP and is correctly configured with the customer interface IP address of the VPN connection. Otherwise, VPN traffic will fail to be forwarded.
+
+ |
+NQA enabled
+ |
+
+PSK, Confirm PSK
+ |
+Specify the negotiation key of the VPN connection.
+The PSKs configured on the VPN console and the customer gateway device must be the same.
+ |
+Test@123
+ |
+
+Policy Settings
+ |
+Configure the IKE and IPsec policies, which define the encryption algorithms used by the VPN tunnel.
+The policy settings on the VPN console and the customer gateway device must be the same.
+ |
+Default
+ |
+
+
+
+
+
+
Verification
Check the created VPN connection on the VPN Connections page. The initial state of the VPN connection is Creating. As the customer gateway device has not been configured, no VPN connection can be established. After about 2 minutes, the VPN connection state changes to Not connected.
+
+
Enterprise Edition VPN Gateway Management
+
+
+
diff --git a/docs/vpn/umn/vpn_ug_00002.html b/docs/vpn/umn/vpn_ug_00002.html
new file mode 100644
index 00000000..0f19358c
--- /dev/null
+++ b/docs/vpn/umn/vpn_ug_00002.html
@@ -0,0 +1,26 @@
+
+
+Viewing a VPN Gateway
+Scenario
After creating a VPN gateway, you can view its details.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the VPN Gateways tab page, view the VPN gateway list.
- Click the name of a VPN gateway to view its details.
- For a VPN gateway of the public network type, you can view the basic information and EIPs.
- For VPN gateways of the private network type, you can view the basic information and advanced settings.
+Figure 1 Viewing a VPN gateway
+Figure 2 Viewing details about a VPN gateway
+
+
In the VPN gateway list, you can click a public IP address in the Gateway IP Address column of a VPN gateway to go to the EIP page, where you can check EIP metrics by clicking 
.
+
+
+
Modifying a VPN Gateway
+Scenario
You can modify basic information about a VPN gateway, including the name and local subnet.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- Locate the row that contains the target VPN gateway, and click Modify Basic Information in the Operation column.
To modify only the name of a VPN gateway, you can also click 
on the right of the VPN gateway name.
+ - Modify the name and local subnet of the VPN gateway as prompted.
- Click OK.
+
Figure 1 Modifying a VPN gateway
+
Table 1 describes the parameters for modifying the VPN gateway.
+
+
Table 1 Parameters for modifying the VPN gatewayParameter
+ |
+Description
+ |
+Modifiable or Not
+ |
+
|---|
+
+Name
+ |
+Name of a VPN connection. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
+ |
+Y
+ |
+
+Local Subnet
+ |
+VPC subnets with which your on-premises data center needs to communicate through the customer gateway.
+ |
+Y
+ |
+
+Region
+ |
+For low network latency and fast resource access, select the region nearest to your target users.
+Resources cannot be shared across regions.
+ |
+N
+ |
+
+Associate With
+ |
+Select VPC.
+ |
+N
+ |
+
+VPC
+ |
+VPC that the on-premises data center needs to access.
+ |
+N
+ |
+
+Interconnection Subnet
+ |
+This subnet is used for communication between the VPN gateway and VPC. Ensure that the selected interconnection subnet has four or more assignable IP addresses.
+ |
+N
+ |
+
+BGP ASN
+ |
+BGP AS number.
+ |
+N
+ |
+
+Specification
+ |
+Three options are available: Basic, Professional 1 and Professional 2.
+ |
+N
+ |
+
+AZ
+ |
+An AZ is a geographic location with independent power supply and network facilities in a region. AZs in the same VPC are interconnected through private networks and are physically isolated.
+
+ |
+N
+ |
+
+
+
+
+
+
Binding an EIP to a VPN Gateway
+Scenario
You can bind EIPs to a VPN gateway that has been created.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- Locate the row that contains the target VPN gateway, and click Bind EIP in the Operation column.
- If the VPN gateway uses the active-active mode, the VPN gateway can have an active EIP and active EIP 2 bound.
- If the VPN gateway uses the active/standby mode, the VPN gateway can have an active EIP and a standby EIP bound.
+ - Select the desired EIP and click OK.
+
Figure 1 Binding the active EIP in active-active mode
+
Figure 2 Binding active EIP 2 in active-active mode
+
Figure 3 Binding the active EIP in active/standby mode
+
Figure 4 Binding the standby EIP in active/standby mode
+
+
Deleting a VPN Gateway
+Scenario
You can delete a VPN gateway that is no longer required.
+
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- If the number of bound EIPs is less than or equal to 1, choose in the Operation column of the target VPN gateway.
If the number of bound EIPs is greater than 1, click Delete in the Operation column of the target VPN gateway.
+ - In the displayed dialog box, click Yes.
+
+
Customer Gateway Management of Enterprise Edition VPN
+
+
+
diff --git a/docs/vpn/umn/vpn_ug_00009.html b/docs/vpn/umn/vpn_ug_00009.html
new file mode 100644
index 00000000..1536f2b1
--- /dev/null
+++ b/docs/vpn/umn/vpn_ug_00009.html
@@ -0,0 +1,24 @@
+
+
+Viewing a Customer Gateway
+Scenario
After creating a customer gateway, you can view its details.
+
+
+
Modifying a Customer Gateway
+Scenario
After creating a customer gateway, you can modify its name.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the Customer Gateways page, click
next to the name of a customer gateway. - Enter a new name for the customer gateway and click OK.
Table 1 describes the parameters related to customer gateway modification.
+
Table 1 Parameters related to customer gateway modificationParameter
+ |
+Description
+ |
+Modifiable or Not
+ |
+
|---|
+
+Name
+ |
+Name of a VPN connection. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
+ |
+Y
+ |
+
+BGP ASN
+ |
+The BGP ASN needs to be specified only when Routing Mode is set to Dynamic (BGP). |
+N
+ |
+
+Gateway IP Address
+ |
+IP address used by the customer gateway to communicate with the VPN gateway. The value must be a static address.
+Ensure that UDP port 4500 is permitted in a firewall rule on the customer gateway in your on-premises data center or private network.
+ |
+N
+ |
+
+
+
+
+
+
+
+
Deleting a Customer Gateway
+Scenario
You can delete a customer gateway that you have created.
+
+
Notes and Constraints
Before deleting a customer gateway associated with a VPN connection, remove the customer gateway from the VPN connection.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the Customer Gateways page, locate the customer gateway to delete, and click Delete in the Operation column.
- Click Yes.
+
+
Enterprise Edition VPN Connection Management
+
+
+
diff --git a/docs/vpn/umn/vpn_ug_00013.html b/docs/vpn/umn/vpn_ug_00013.html
new file mode 100644
index 00000000..275e0f4b
--- /dev/null
+++ b/docs/vpn/umn/vpn_ug_00013.html
@@ -0,0 +1,25 @@
+
+
+Viewing a VPN Connection
+Scenario
After creating a VPN connection, you can view its details.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the VPN Connections page, view the VPN connection list.
- Click the name of a VPN connection to view its basic information and policy configuration.
+
Figure 1 Viewing a VPN connection
+
+
- In the VPN connection list, locate the target VPN connection, and choose More > Modify Policy Settings on the right to view IKE and IPsec policies of the VPN connection.
+
+
+
Modifying a VPN Connection
+Scenario
A VPN connection is an encrypted communications channel established between a VPN gateway in a VPC and a customer gateway in your on-premises data center. You can modify a VPN connection when required.
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the VPN Connections page, locate the VPN connection to modify, and click Modify VPN Connection or Modify Policy Settings.
- Modify VPN connection parameters as prompted.
- Click OK.
+
Figure 1 Modifying a VPN connection
+
If you change the PSK or modify the IKE or IPsec policy of a VPN connection, ensure that the new configurations are consistent with those on the customer gateway. Otherwise, the VPN connection will be interrupted.
+
+
Only some of the parameters take effect immediately after being modified, as described in Table 1.
+
+
Table 1 Time when new parameter settings take effectItem
+ |
+Parameter
+ |
+When New Settings Take Effect
+ |
+How to Modify
+ |
+
|---|
+
+-
+ |
+PSK
+ |
+- When IKEv1 is used, the new setting takes effect in the next negotiation period.
- When IKEv2 is used, the new setting takes effect after the VPN connection is re-established.
+ |
+
+ |
+
+IKEv1 policy
+ |
+- Encryption Algorithm
- Authentication Algorithm
- DH Algorithm
- Negotiation Mode
- Local ID
- Customer ID
- Lifetime (s)
+ |
+The new settings take effect in the next negotiation period.
+ |
+Locate the VPN connection to delete, and choose More > Modify Policy Settings in the Operation column.
+ |
+
+IKEv1 policy
+ |
+Version
+ |
+The new setting takes effect immediately.
+ |
+Locate the VPN connection to delete, and choose More > Modify Policy Settings in the Operation column.
+ |
+
+IKEv2 policy
+ |
+- Encryption Algorithm
- Authentication Algorithm
- DH Algorithm
- Lifetime (s)
+ |
+The new settings take effect in the next negotiation period.
+
+ |
+Locate the VPN connection to delete, and choose More > Modify Policy Settings in the Operation column.
+ |
+
+IKEv2 policy
+ |
+Version
+ |
+The new setting takes effect immediately.
+ |
+Locate the VPN connection to delete, and choose More > Modify Policy Settings in the Operation column.
+ |
+
+IKEv2 policy
+ |
+
+ |
+The new settings take effect after the VPN connection is re-established.
+ |
+- Delete the current VPN connection.
- Create a new VPN connection.
+ |
+
+IPsec policy
+ |
+- Encryption Algorithm
- Authentication Algorithm
- PFS
- Lifetime (s)
+ |
+The new settings take effect in the next negotiation period.
+ |
+Locate the VPN connection to delete, and choose More > Modify Policy Settings in the Operation column.
+ |
+
+IPsec policy
+ |
+Transfer Protocol
+ |
+This parameter cannot be modified on the management console.
+ |
+Locate the VPN connection to delete, and choose More > Modify Policy Settings in the Operation column.
+ |
+
+
+
+
+
Table 2 describes the parameters related to VPN connection modification.
+
+
Table 2 Parameters related to VPN connection modificationParameter
+ |
+Description
+ |
+Modifiable or Not
+ |
+
|---|
+
+Name
+ |
+Name of a VPN connection. The value can contain only letters, digits, underscores (_), hyphens (-), and periods (.).
+ |
+Y
+ |
+
+Customer Gateway
+ |
+Gateway used for communicating with a VPC through VPN.
+ |
+Y
+ |
+
+Customer Subnet
+ |
+Subnet in the on-premises data center that needs to access the VPC.
+ |
+Y
+ |
+
+Policy Settings
+ |
+There are IKE and IPsec policies.
+ |
+Y
+ |
+
+PSK
+ |
+The PSKs configured for the VPN gateway and customer gateway must be the same.
+ |
+Y
+ |
+
+VPN Gateway
+ |
+VPN gateway that has been created.
+ |
+N
+ |
+
+Gateway IP Address
+ |
+IP address used by the customer gateway to communicate with the VPN gateway. The value must be a static address.
+Ensure that UDP port 4500 is permitted in a firewall rule on the customer gateway in your on-premises data center or private network.
+ |
+N
+ |
+
+Interface IP Address Assignment
+ |
+Mode in which IP addresses of the local and customer interfaces are assigned. The options include Manually specify and Automatically assign.
+ |
+N
+ |
+
+Local Tunnel Interface Address
+ |
+Tunnel interface IP address configured on the VPN gateway.
+ |
+N
+ |
+
+Customer Tunnel Interface Address
+ |
+Tunnel interface IP address configured on the customer gateway device.
+ |
+N
+ |
+
+
+
+
+
+
Audit
+
+
+
diff --git a/docs/vpn/umn/vpn_ug_00017.html b/docs/vpn/umn/vpn_ug_00017.html
new file mode 100644
index 00000000..c07c83d8
--- /dev/null
+++ b/docs/vpn/umn/vpn_ug_00017.html
@@ -0,0 +1,106 @@
+
+
+VPN Operations That Can Be Recorded by CTS
+
+
Table 1 Enterprise Edition VPN-related operations that can be recorded by CTSOperation
+ |
+Resource Type
+ |
+Trace Name
+ |
+
|---|
+
+Creating a customer gateway
+ |
+customer-gateway
+ |
+createCgw
+ |
+
+Updating a customer gateway
+ |
+customer-gateway
+ |
+updateCgw
+ |
+
+Deleting a customer gateway
+ |
+customer-gateway
+ |
+deleteCgw
+ |
+
+Creating a VPN gateway
+ |
+vpn-gateway
+ |
+createVgw
+ |
+
+Updating a VPN gateway
+ |
+vpn-gateway
+ |
+updateVgw
+ |
+
+Deleting a VPN gateway
+ |
+vpn-gateway
+ |
+deleteVgw
+ |
+
+Updating the VPN gateway status
+ |
+vpn-gateway
+ |
+UpdateResourceState
+ |
+
+Creating a VPN connection
+ |
+vpn-connection
+ |
+createVpnConnection
+ |
+
+Updating a VPN connection
+ |
+vpn-connection
+ |
+updateVpnConnection
+ |
+
+Deleting a VPN connection
+ |
+vpn-connection
+ |
+deleteVpnConnection
+ |
+
+Creating a resource tag
+ |
+instance
+ |
+createResourceTag
+ |
+
+Deleting a resource tag
+ |
+instance
+ |
+deleteResourceTag
+ |
+
+
+
+
+
Querying CTS Traces
+After you enable CTS and the management tracker is created, CTS starts recording operations performed on VPN resources. You can view the operation records in the last seven days on the CTS console.
+
For details about how to view audit logs, see the Cloud Trace Service User Guide.
+
Configuring Health Check
+Scenario
After VPN connections are created, you can configure health check to enable the VPN gateway to send probe packets to the customer gateway to collect statistics about the round-trip time and packet loss rate of physical links. The statistics help you learn about the VPN connection quality. The Cloud Eye service monitors the round-trip time and packet loss rate of VPN links. For details, see Metrics (Enterprise Edition VPN).
+
+
Procedure
- Log in to the management console.
- Click in the upper left corner and select the desired region and project.
- Click in the upper left corner of the page, and choose .
- In the navigation pane on the left, choose .
- On the VPN Connections page, click the name of the target VPN connection. On the Summary tab page, click Add in the Health Check area.
- In the Add Health Check dialog box, click OK.
+
+
in the upper left corner and select the desired region and project.
-
