VPN Connet
VPN Connet
Document
- Documentation
VPN ConnetUser GuideRoute managementOn-premises gateway routeManual configurationConfiguring H3C firewall
Copy page
Download PDFManual configuration
Configuring H3C firewall
Copy pageDownload PDFConfiguring H3C firewall
Scenarios
In the scenario that the H3C firewall is applying to your local data center, after configuring the cloud VPN gateway, customer gateway, and IPsec-VPN connection, you also need to configure the VPN connection on the H3C firewall.
warning
Configurations and interface layout may differ among different models and versions of H3C firewalls. You can refer to the corresponding documentation or consult the third-party firewall vendor for specific configuration based on the firewall model you use.
Prerequisites
You have completed procedures for creating a VPN gateway, creating a customer gateway, creating an IPsec-VPN connection, and adding a VPN gateway route.
Parameter description
- Virtual Private Cloud (VPC)
- The CIDR block is 192.168.2.0/24, and the Elastic IP Address (EIP) of the VPN gateway is 22.XX.XX.10.
The EIP of a VPN gateway is automatically assigned when the VPN gateway is created. It serves as the egress IP address of the VPN gateway. Unlike separately purchased EIP instances, the EIP cannot be independently owned, and shares the same lifetime as the VPN gateway.
- cloud IPsec-VPN connection
- Pre-Shared Key: test@1234
- IKE Config
- StrategyValueAuthentication algorithmsha256Encryption algorithmaes192DH algorithmgroup14NegotiationmainVersionikev1Lifecycle86400
- IPsec Config
- StrategyValueAuthentication algorithmsha256Encryption algorithmaes192DH algorithmgroup14Lifecycle86400security protocolesp
- Data center: The private CIDR block is 10.1.1.0/24, and the EIP of the gateway device is 122.XX.XX.64. The interface used by the gateway device to connect to the internet is Reth1.
Procedure
This topic only describes necessary arguments. For other arguments, you can set them as needed.
- Log in to the Web page of the H3C firewall locally.
- Create a new IPsec policy.
- In the left-side navigation pane, click Network > VPN > IPsec > Policy.
- On the Create IPsec Policy page, configure an on-premises IPsec policy. Ensure the local IPsec policy matches the IPsec-VPN connection configuration created in the VPC.
- The configuration parameters of the cloud IPsec-VPN connection are shown in the parameter description. The necessary local parameter configurations are listed in the table. Save the configuration after completing the setup.
-
- In the left navigation tree, click Network > VPN > IPsec > IKE Config, then click New to add an IKE configuration. Click OK when finished.
- The IKE configuration here must match the IKE configuration in the cloud IPsec-VPN connection.
- ParameterValuePriority10AuthenticationPre-shared keyAuthentication algorithmSHA256Encryption algorithmAES-CBC-192DHDH group 14IKE SA lifecycle86400
- In the left navigation tree, click Network > VPN > IPsec > Policy, find the policy created in step 2, add an IPsec Config under Advanced configuration, then click OK after finishing the configuration.
- The IPsec Config here must match the IPsec Config in the cloud IPsec-VPN connection.
- ParameterValueEncapsulation patternTunnel modeSecurity protocolESPESP authentication algorithmSHA256ESP encryption algorithmAES-CBC-192PFSGroup_14IPsec SA lifetime (time-based)86400Local IP address122.XX.XX.64
- In the left navigation tree, click Network > VPN > IPsec > Policy > Security Policy > Create to create outbound and inbound security policies respectively.
- Outbound security policy
- Security policy from the local data center to the cloud Virtual Private Cloud.
- ParameterDescriptionValueNameEnter the name of this uplink security policy.h3c_to_vpcSource security zoneSelect source security domain.TrustDestination security domainSelect the destination security domain.UntrustTypeSelect the IP type.IPv4ActionsSet the execution action of this security policy to allow or deny access.AllowSource IP addressPrivate CIDR block of the on-premises data center.10.1.1.0/24Destination IP addressCIDR block of the Virtual Private Cloud (VPC)192.168.2.0/24
- Inbound security policy
- Security policy from the cloud Virtual Private Cloud to the local data center.
- ParameterDescriptionValueNameEnter the name of this outbound security policy.vpc_to_h3cSource security domainSelect source security zone.UntrustDestination security domainSelect the destination security domain.TrustTypeSelect the IP type.IPv4ActionsSet the execution action of this security policy to allow or deny access.AllowSource IP addressThe CIDR block of the VPC.192.168.2.0/24Destination IP addressPrivate CIDR block of the local data center.10.1.1.0/24
- Click Network > Route > Static Route in the left navigation tree to enter the Create IPv4 Static Route page. Add a static route from the on-premises data center to the VPC, then click OK.
- Uplink route
- Route from on-premises data center to VPC.
-
- Downlink route
- Route from VPC to on-premises data center. Since this operation uses direct routes, configuring downlink routes is not required. You can also configure related static route entries based on actual network conditions.
Last updated: 2026.07.17 11:00:34
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
