VPN connections support IPsec VPN and SSL VPN connections. This section introduces the components of the two connection methods.
IPsec VPN
An IPsec VPN connection consists of three components: VPN gateway, customer gateway, and VPN channel.
VPN Gateway
The VPN gateway is the egress gateway for the VPC to establish a VPN connection. It is used in conjunction with the customer gateway (IPsec VPN service gateway on the IDC side) to establish secure and reliable encrypted network communications between the cloud platform VPC and the external IDC. The VPN gateway is virtualized through software and adopts a dual-machine hot standby policy. When a single machine fails, it automatically switches to the standby machine without affecting the normal running of the business.
The VPN gateway bandwidth limit includes the following options: 5 Mbps, 10 Mbps, 20 Mbps, 50 Mbps, 100 Mbps.
Customer Gateway
The customer gateway is a logical object used to record the public IP of the IPsec VPN gateway on the IDC side (the IDC side must have a fixed public IP). It needs to be used in conjunction with the VPN gateway. One VPN gateway can establish encrypted VPN network channels with multiple customer gateways.
VPN Tunnel
After the VPN gateway and customer gateway are established, you can establish a VPN channel for encrypted communication between the VPC and the external IDC. This VPN channel supports IPsec encryption protocol and can meet the needs of most VPN connections.
The VPN channel runs in the operator's public network. Network congestion and jitter in the public network can affect the quality of the VPN network. If your business is sensitive to latency and jitter, you are recommended to connect with VPC via a Direct Connect line. For more details, see Direct Connect Service.
Establish VPN channel
When it implements IPsec, the VPN channel in the cloud platform uses the IKE (Internet Key Exchange) protocol to establish a session. IKE has a set of self-protection mechanisms that can safely authenticate identities, distribute keys, and establish IPSec sessions on insecure networks.
- Basic Configuration
- SPD (Security Policy Database) policy
- IKE Configuration (optional)
- IPsec Configuration (optional)
The following section introduces the basic information, SPD policy, IKE configuration (optional) and IPsec configuration (optional) in detail.
Basic Configuration
The basic configuration mainly includes basic information such as VPN channel name, region, VPC, VPN gateway, and customer gateway.
SPD Policy
The SPD (Security Policy Database) policy consists of a series of SPD rules, which are used to specify which IP ranges in the VPC can communicate with which IP ranges in the IDC. Each SPD rule includes a local IP range CIDR and at least one peer IP range CIDR. A local IP range CIDR and a peer IP range CIDR form a set of matching relationships. There can be multiple sets of matching relationships under one SPD rule.
Note:
The matching relationships of the rules in all channels under the same VPN gateway cannot overlap, that is, in a group of matching relationships, the local IP range and the remote IP range cannot overlap at the same time.
Example:
As shown in the figure below, the following SPD rules already exist under a VPN gateway:
- SPD Rule 1: The local IP range is 10.0.0.0/24, and the peer IP ranges are 192.168.0.0/24 and 192.168.1.0/24. There are two sets of matching relationship.
- SPD Rule 2: The local IP range is 10.0.1.0/24, and the peer IP range is 192.168.2.0/24. There is one set of matching relationship.
- SPD Rule 3: The local IP range is 10.0.2.0/24, and the peer IP range is 192.168.2.0/24. There is one set of matching relationship.
Their matching relationships are: - 10.0.0.0/24-----192.168.0.0/24
- 10.0.0.0/24-----192.168.1.0/24
- 10.0.1.0/24-----192.168.2.0/24
- 10.0.2.0/24-----192.168.2.0/24
These four sets of matching relationships cannot overlap with each other, that is, their local IP ranges and remote IP ranges cannot overlap at the same time. - If a new matching relationship of 10.0.0.0/24-----192.168.1.0/24 is added, the SPD rule cannot be added because it overlaps with an existing matching relationship.
- If a new matching relationship of 10.0.1.0/24-----192.168.1.0/24 is added and it does not overlap with the existing three matching relationships, then the SPD rule can be added.
IKE configuration
| Configuration Items | Description |
|---|---|
| Version | IKE V1 |
| Identity Authentication Method | Default Pre-shared Key |
| Authentication Algorithm | Identity authentication algorithm and it supports MD5 and SHA1. |
| Negotiation Mode | Supports main (main mode) and aggressive (aggressive mode). The difference between the two is that aggressive mode can send more information with fewer packets and establish connections quickly, but it exposes the security gateway's identity in a clear manner. When using aggressive mode, configuration parameters such as Diffie-Hellman and PFS cannot be negotiated and require compatible configurations on both ends |
| Local ID | Supports IP and FQDN (Fully Qualified Domain Name) |
| Customer ID | Supports IP and FQDN |
| DH group | Specifies the DH group used when exchanging IKE keys. The security of the key exchange increases with the size of the DH group, but the exchange time also increases. - Group1: DH group using the 768-bit Modular Exponential (MODP) algorithm. - Group2: DH group using the 1024-bit MODP algorithm. - Group5: DH group using the 1536-bit MODP algorithm. - Group14: DH group using the 2048-bit MODP algorithm, does not support dynamic VPN implementation of this option. - Group24: DH group using the 2048-bit MODP algorithm with a 256-bit prime order subgroup, does not support group VPN implementation of this option. |
| IKE SA Lifetime | Unit: Seconds. Sets the SA lifetime for IKE security proposals. Before the set SA lifetime expires, another SA is negotiated to replace the old SA. The old SA will continue to be used until the new SA is negotiated. Once the new SA is established, it will be used immediately, and the old SA will be automatically cleared after its lifetime expires. |
IPsec configuration
| Configuration Items | Description |
|---|---|
| Encryption Algorithm | Supports 3DES, AES-128, AES-192, AES-256, DES. |
| Authentication Algorithm | Supports MD5 and SHA1. |
| Message Encapsulation Mode | Tunnel |
| Security Protocol | ESP |
| PFS | Supports disable, dh-group2, dh-group5, and dh-group14. |
| IPsec SA lifetime(s) | Unit: Seconds |
| IPsec SA lifetime(KB) | Unit: KB |