How is VPN gateway implemented and what is its availability?
- A VPN gateway is implemented through network feature virtualization (NFV), which adopts a dual-machine hot standby policy. When a single machine fails, it automatically switches so as not to affect the normal running of the business.
- The VPN channel runs in a public network. Problems such as congestion, jitter, and delay in the public network will affect the quality of the VPN network. If the business has a low tolerance for network transmission delay and jitter, it is recommended to use direct connect.
What to do if a VPN channel is not connected?
The configuration process of VPN channel connectivity requires that the negotiation information on both ends is consistent before a connection can be successfully established. You need to check the consistency of the configuration on both ends in turn. The recommended inspection ideas are as follows:
Note:
- The VPN channel cannot be established if any parameter is inconsistent.
- The default VPN configurations of different manufacturers' equipment and cloud platform service providers vary.
- Check the first phase IKE configuration information.
Check whether all the parameters required for the first phase, such as the IKE version No., ID authentication method, encryption algorithm, authentication algorithm, negotiation mode, both end identifiers, DH group, and IKE sa lifetime, are consistent. If there are any inconsistencies, modify them and try again.
| IKE Configuration Items | Default Configuration | Other Optional Configurations |
|---|---|---|
| IKE | IKEv1 | - |
| Identity Authentication Method | Pre-shared Key | - |
| Encryption Algorithm | 3DES | AES-128,AES-192,AES-256,DES |
| Authentication Algorithm | MD5 | SHA1 |
| Negotiation Mode | main | aggressive |
| Local ID | IP Address (defaults to the public network IP address of the VPN gateway on the cloud platform) | FQDN |
| Customer ID | IP Address (defaults to the public network IP address of the customer VPN gateway) | FQDN |
| DH group | DH1 | DH2,DH5,DH14,DH24 |
| IKE SA Lifetime | 86400s | Supporting customization |
- Check the Phase 2 IPsec configuration information
Check whether all parameters required for the second phase, such as the encryption algorithm, authentication method, message encapsulation mode, security protocol, PFS, and IPsec SA generation cycle, are consistent at both ends. If there are any inconsistencies, modify them and try again.
Converge Cloud The default configuration of the second phase IPsec parameters of the VPN gateway is:
| IPsec Configuration Items | Default Configuration | Other Optional Configurations |
|---|---|---|
| Encryption Algorithm | AES-128 | AES-128,AES-192,AES-256,DES |
| Authentication Algorithm | MD5 | SHA1 |
| Message Encapsulation Mode | Tunnel | - |
| Security Protocol | ESP | - |
| PFS | disable | dh-group1,dh-group2,dh-group5,dh-group14,dh-group24 |
| IPsec sa Lifetime | 3600s | Supporting customization |
| IPsec sa Lifetime | 1843200KB | Supporting customization |
Why are the monitoring data displayed by the VPN gateway and VPN channel sometimes inconsistent?
Currently, there are differences in the data collection locations and reporting intervals for VPN gateways and VPN channels. The statistical granularity for VPN gateways is 1 minute, while the statistical granularity for VPN channels is 10 seconds, that is, the statistical granularities are inconsistent. Therefore, when data are aggregated on the monitoring page, the displayed data of the VPN gateway and the VPN channel will be inconsistent.
How to configure VPN?
IPsec VPN can be fully self-configured in the console. For details, see Quick Start.
How to create a VPN gateway?
Users can go to the Virtual Private Cloud (VPC) console to create a VPN gateway. For details, see Creating VPN Gateway.
How to create a VPN channel?
Users can go to the Virtual Private Cloud (VPC) console to create a VPN channel. For details, see Creating VPN Channel.
How to view VPN connection monitoring data?
Users can enter the Virtual Private Cloud (VPC) console to view VPN connection monitoring data. For details, see Viewing Monitoring Data.
How to set up VPN connection alarms?
Users can go to the Virtual Private Cloud (VPC) console to set up VPN connection alarms. For details, see Setting Alarms.
How to modify VPN channel configuration?
Users can enter the Virtual Private Cloud (VPC) console to modify the VPN channel configuration. For details, see Modifying VPN Channel Configuration.