What is IPsec VPN?
IPsec VPN is a way to connect user IDCs and VPCs through an encrypted channel over the public network. Tencent Cloud VPC IPsec VPN connection consists of the following components:
VPN Gateway: It is an IPsec VPN gateway for the Virtual Private Cloud, which is used together with the customer gateway (IPsec VPN service gateway on the user IDC side) to establish secure and reliable encrypted network communication between the Virtual Private Cloud and the user IDC.
Customer Gateway: The customer gateway refers to the mapping of the IPsec VPN service gateway of the user IDC in the Virtual Private Cloud. The customer gateway needs to be used together with the VPN gateway. One VPN gateway can establish encrypted VPN network channels with multiple customer gateways.
VPN Channel: It is an encrypted public network IPsec VPN channel. After the VPN gateway and customer gateway are established, a VPN channel can be established for encrypted communication between the Virtual Private Cloud and the user IDC.
Can a VPC be connected to multiple IDCs through VPN connections?
Yes, currently the Virtual Private Cloud can establish VPN gateways and establish multiple VPN channels on each VPN gateway. Each VPN channel can connect to a local IDC.
What is the difference between Direct Connect and IPSec VPN connection?
IPsec VPN connections use a public network and the IPsec protocol to establish an encrypted network connection between the user's data center and the Virtual Private Cloud. VPN gateways can be purchased, validated, and configured in a few minutes. However, VPN connections may be interrupted by Internet jitter, congestion and other public network quality issues. When the user's business does not require high network connection quality, it is a fast deployment and cost-effective option.
Direct connect provides a user-dedicated network connection solution. It takes a long time to build, but can provide high-quality and highly reliable network connection services. When the user's business requires high network quality and security, this solution can be selected for deployment.
The specific differences between the two are shown in the following table:
Strengths | Direct Connect | IPsec VPN |
Stable Network Delay | The network latency is reliable and limited to a low level. The connection network is based on a DC. You can use a fixed routing configuration to avoid the latency and instability caused by congestion or fault-triggered detours. | The network connection is based on the Internet. When the network link is blocked during peak hours, it may cause routing detours and unstable latency. |
Highly Reliable Disaster Recovery Connect | Both connection devices and network forwarding devices are deployed in a distributed and clustered manner, with full-link high-reliability configuration, supporting dual-line connection with protection, meeting your stringent requirements for availability above 99.95%. | It adopts a dual-machine hot backup configuration, which has high reliability at the gateway layer. However, due to the unreliable Internet network link, it cannot guarantee dedicated line-level network reliability. |
Supporting Large Bandwidth | A single line supports a maximum bandwidth connection of 10 Gbps, and can also allow connection with multiple 10 Gbps links for network CLB, with no theoretical upper limit. | A single gateway supports a maximum bandwidth of 3 Gbps. VPC supports multiple VPN gateway configurations, and by configuring multiple VPN gateways, it can support VPN access beyond 3 Gbps. |
High Security | The network link is dedicated to users, with no risk of data leakage, ensuring high security and meeting the stringent network connection requirements of the finance, government, and enterprise sectors. | Network transmission is based on the pre-shared key encryption of the IKE protocol, which can meet most network transmission security requirements. |
Supporting Network Address Translation | It supports configuring network address translation services on the gateway, enabling IP mapping at both ends of the DC and IP port mapping at the VPC end, thus resolving address conflicts when multiple networks are interconnected. | Not support. |
What are the constraints on using a VPN?
When using VPN, you need to comply with the constraints on the VPN connection and the customer gateway IP address. For details, see Usage Constraints.
How many VPN gateways and VPN channels can be created?
Different resources have different creation quantity limits. For details, see Resource Quota Details Within VPC. If you need a higher quota, fill in the Ticket Application.
How to assure the network quality between the Virtual Private Cloud and IDC connected through VPN?
VPN Connections between VPC and IDC are transmitted over the public network. Therefore, the overall network quality depends on the quality of the public network. When the public network experiences latency, packet loss, or jitter, VPN Connections will be affected accordingly. If you need more stable communication quality, it is recommended to use DC service.
Tencent Cloud provides 24-hour monitoring for your VPN gateways and reports alarms for abnormal situations. Operations personnel are available for emergencies. You can also monitor the traffic status of VPN gateways and channels in the console in real time. If any exceptions occur, please promptly contact us.
Can I access the Internet through a VPN connection?
No. VPN gateways only provide access to VPCs but not to the Internet.
Can I use VPN Connections without a public IP?
If you use an IPsec VPN connection, you must have public IPs on both ends.
If you don't have public IPs, you can try using an SSL VPN to connect your local LAN to the cloud environment. Explore SSL VPN to see whether it meets your requirements.
Note
Using an IPSec VPN connection requires the customer gateway to have a fixed IP address.
An SSL VPN gateway doesn't require the customer gateway to have a fixed public IP address. It is an egress gateway through which the VPC establishes SSL VPN Connections and is used together with the SSL VPN client (mobile client). For details, see SSL VPN.
What is a customer gateway?
A customer gateway is a logical object that records the VPN gateway on the edge of the peer IDC.
What is an SPD policy? Why do I need to configure the local and peer IP ranges?
The SPD (Security Policy Database) policies consist of a series of SPD rules used to specify which IP ranges within a VPC or CCN can communicate with which IP ranges within an IDC.
In the SPD configuration, you need to configure the Local Network Segment and the Peer Network Segment. The local gateway configuration is the Tencent Cloud VPN Gateway belonging to the network segment, and it cannot overlap. The Peer Network Segment is the public network segment of the customer's local gateway used to connect with Tencent Cloud. For details, see SPD policies.
What is an SSL VPN client?
An SSL VPN client is a VPN client that is deployed on user terminals and is considered a logical instance on Tencent Cloud.