What Is a VPN Connection?
A VPN connection is a way to connect the user's customer IDC to the VPC through a public network encrypted channel. For details, see Product Overview.
What Is a VPN Channel?
After the VPN gateway and customer gateway are established, a VPN channel can be established for encrypted communication between the VPC and the external IDC. For details, see Product Overview.
What Is a VPN Gateway?
A VPN gateway is an egress gateway for VPC to establish a VPN connection. It is used with the customer gateway (IPsec VPN service gateway on the IDC side) to establish secure and reliable encrypted network communication between the cloud platform's VPC and external IDCs. The cloud platform's VPN gateway, underpinned by software virtualization, adopts a dual-server hot standby policy. If one of the servers fails, it will automatically switch to the other, ensuring normal business operations.
A VPN gateway provides eight bandwidth limits: 5 Mbps, 10 Mbps, 20 Mbps, 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, and 1,000 Mbps.
What Is an IPsec VPN?
An IPsec VPN is a way to connect the user's IDC to the VPC through a public network encrypted channel. The cloud platform's VPC IPsec VPN access comprises the following components:
- VPN gateway: The VPN gateway is the IPsec VPN gateway of the VPC. It is used with the customer gateway (IPsec VPN service gateway on the user IDC side) to establish secure and reliable encrypted network communication between the VPC and the user's IDC.
- Customer gateway: The customer gateway refers to the mapping of the IPsec VPN service gateway of the user's IDC in the VPC. It needs to be used together with the VPN gateway. A VPN gateway can be used with multiple customer gateways to establish encrypted VPN network channels.
- VPN channel: It is an encrypted public network IPsec VPN channel. After the VPN gateway and customer gateway are established, a VPN channel can be established for encrypted communication between the VPC and the user's IDC.
What Are the Constraints on VPN Use?
During VPN use, you need to comply with the constraints on the VPN connection and the customer gateway IP address. For details, see Usage Constraints.
How Many VPN Gateways and VPN Channels Can Be Created?
Different resources have different creation quantity limits. For details, see Resource Quota Details Within VPC. If you need a higher quota, fill in the Ticket Application.
Can a VPC Be Connected to Multiple IDCs Through VPN Connections?
Yes. Currently, the VPC can establish VPN gateways and multiple VPN channels on each VPN gateway. Each VPN channel can connect to a local IDC.
Can Communication Between VPCs Be Achieved Through VPN Connections?
Yes. Users need to purchase VPN gateways and configure VPN channels and customer gateways for each of the two VPCs, but the configuration is complicated. VPCs can be interconnected through Peering Connection (PC).
How Is the Quality of the Network Between the VPC and IDC Connected Through VPN Ensured?
- The VPN connection between the VPC and the IDC is transmitted through a public network. Therefore, the overall network quality depends on the quality of the public network. When the public network has latency, packet loss, or jitter, the VPN connection will be affected. If you need more stable communication, it is recommended to use the Direct Connect (DC) service.
- The cloud platform provides 24-hour monitoring for your VPN gateways, issuing alarms for any exceptions. In emergencies, Ops personnel will intervene. Users can also monitor the traffic status of VPN gateways and channels in real time via the console. If any exceptions are found, contact us promptly.
What Is the Difference Between DC and IPSec VPN?
- IPsec VPN uses a public network and the IPsec protocol to establish an encrypted network connection between the user's IDC and VPC. VPN gateways can be purchased, validated, and configured in a few minutes. However, VPN connections may be interrupted by Internet jitter, congestion, and other public network quality issues. IPsec VPN features fast deployment and high cost performance, suitable for users whose business does not require high network connection quality.
- DC, a user-dedicated network connection solution, requires a long time for deployment, but can provide high-quality and highly reliable network connection services. It is suitable for users whose business requires high network quality and security.
The specific differences between the two schemes are shown in the following table:
| Strength | DC | IPsec VPN |
|---|---|---|
| Stable network latency | DC provides reliable and guaranteed network latency. The connection network is based on a dedicated line. Users can use the fixed routing configuration to avoid the unstable latency caused by congestion or fault-triggered detours. | Since the IPsec VPN network connection is based on the Internet, routing may be detoured due to linkage congestion during network peak hours, resulting in unstable latency. |
| Highly reliable disaster recovery connection | DC involves deploying connection devices and network forwarding devices in a distributed and clustered manner, with full-linkage high-reliability configuration. They support dual-line connection with protection and can meet users' high requirements of higher than 99.95% availability. | The IPsec VPN gateway adopts a dual-server hot standby configuration, which has high reliability at the gateway layer. However, due to the unreliable Internet network linkage, it cannot guarantee dedicated line-level network reliability. |
| Supporting large bandwidth | DC allows a single line to support a maximum bandwidth connection of 10 Gbps. In addition, multiple 10 Gbps linkages can be connected for network load balancing. In theory, the bandwidth supported has no limit. | A single IPsec VPN gateway supports a maximum bandwidth limit of 100 Mbps. The VPC supports configuring multiple VPN gateways, which can support VPN connections with a bandwidth of greater than 100 Mbps. |
| High security | DC allows the network linkage to be dedicated to users, with no risk of data leakage, ensuring high security and meeting the high network connection requirements of the finance, government, and enterprise sectors. | IPsec VPN network transmission is based on the pre-shared key encryption of the IKE protocol, which can meet most requirements for network transmission security. |
| Supporting network address translation | DC supports configuring network address translation services on the gateway, IP mapping at both ends of the dedicated line, and IP port mapping at the VPC end, thus perfectly resolving address conflicts when multiple third-party networks are interconnected. | Not supported. |
Why Do the Two Ends Have No Traffic or Fail to be Pinged When a VPN Channel Has Been Connected?
Troubleshoot the SPD policy (interesting traffic), routing table, and security group sequentially to see whether they are configured properly:
- Troubleshoot the SPD policy configuration at both ends.
Check whether the interesting traffic on both sides of the VPN channel is set properly. If your VPN traffic passes through a NAT device, prevent the traffic accessing the cloud platform from being matched by NAT and not reaching the VPN channel, which will cause unavailability of activation traffic and the inability to activate the VPN channel. - Troubleshoot the routing configuration at both ends.
Ensure that a routing policy has been created in the route table for routing to your customer's private network and that the route is pointed to the VPN gateway. - Troubleshoot the security policy configuration at both ends.
- The outbound policy of the CVM security group allows active access to the customer IP range, and the inbound policy of the security group allows the customer IP range to actively access your CVM.
- The security policy of your customer's VPN gateway has enabled mutual access between your private network server and CVM.
- Check for security restrictions between your customer's private network server and VPN device.
- Check whether the VPC subnet is bound to the network ACL. If it is, open the corresponding access IP range.
If the problem remains unresolved after the inspection, submit a work ticket to contact us.
Can I Access the Internet Through a VPN Connection?
No. The cloud platform's VPN product provides services according to relevant national policies and regulations. The VPN gateway only provides the feature of accessing the VPC, and does not provide the feature of accessing the Internet.