After creating an IPsec-VPN connection, you must also configure a route on both the cloud gateway and the on-premises gateway. This ensures bidirectional traffic flow between the cloud and on-premises networks, enhancing rapid route convergence and network communication quality.

Cloud gateway route: On the VPN gateway or Transit Router (TR) associated with the IPsec-VPN connection, configure routes for the connection peer (an on-premises data center or another VPC).

On-premises gateway route: To connect an on-premises data center with a Virtual Private Cloud (VPC) via VPN Connect, configure VPN-specific settings on the data center gateway.

Cloud gateway routes

Route types

IPsec-VPN connections support both static and dynamic routing propagation modes. Choose the mode that best suits your scenario.

Comparison	Static routes	Dynamic
Application scenarios	Applicable to scenarios where the routes of the IPsec-VPN connection peer are limited in number and frequently remain unchanged.	Applicable to scenarios where the routes of the IPsec-VPN connection peer are numerous and frequently modified.
Modification cost	Relatively high. If the routes of the IPsec-VPN connection peer change, you must manually update route configuration in route tables of the VPN gateway/TR and the VPC.	Low. Dynamic routing uses the Border Gateway Protocol (BGP). If routes change on the peer side of the IPsec-VPN connection, the VPN gateway/TR automatically learns these routes and publishes them to the VPC side without manual configuration.
Peer device requirements	No requirements	The peer gateway must support BGP
Recommended type	Support both Destination Routing Mode and Protected Data Flows. Choose one based on your specific scenario.	Destination Routing Mode is recommended. If the routing mode for the IPsec-VPN connection is Protected Data Flows and Dynamic routing is selected, only dynamic routes within the Protected Data Flows CIDR block take effect. Routes outside this block are ignored.
Route selection priority	Static routes take precedence over dynamic routes. Longest prefix match (LPM) principle: When traffic matches a route table, and the destination IP address falls within destination CIDR blocks of multiple routes, the system will select an entry with the longest mask (i.e., the highest priority) based on the LPM principle. Shortest AS_PATH match principle: For dynamic routes with the same destination, the shorter the AS_PATH length, the higher the priority of the route.

Route recommendations and limits

IPsec-VPN connection via VPN gateway

IPsec-VPN connection via TR

Recommendations

In dynamic routing mode, we recommend using Destination Routing Mode. If the routing mode for the IPsec-VPN connection is Protected Data Flows and Dynamic routing is selected, only dynamic routes within the Protected Data Flows CIDR block take effect. Routes outside this block are ignored.

In the scenario where multiple IPsec-VPN connections are created on the same VPN gateway, we recommend using the same propagation mode for all connections under this VPN gateway. That is, use either all static or all dynamic routing for all IPsec-VPN connections.

Avoid propagating the following types of routes, as they will consume the route quota of the VPN gateway and may be rejected by VPC.

Dynamic routes with a destination CIDR of 0.0.0.0/n, including 0.0.0.0/0.

Dynamic routes that have the same CIDR block as the subnet range of the VPN gateway's host VPC.

Limits

Avoid propagating loop routes with AS_PATH containing the VPN gateway's ASN.

The VPN gateway supports only dynamic equal-cost multi-path routing (ECMP) routes, but not static ECMP routes.

A single TR instance or VPN gateway supports ECMP routing across up to 16 IPsec-VPN connections.

The VPN gateway can receive routes with an AS_PATH length up to 29 and send routes with an AS_PATH length up to 30.

The VPN gateway's route table supports a maximum of 200 routes by default. Routes exceeding this limit will be discarded. If the default quota cannot satisfy your needs, go to the Quota center to increase the corresponding quota. For procedure, see Quota management.

Sending a massive number of dynamic routes may cause the BGP session to drop. If the number of dynamic routes sent over an IPsec-VPN connection exceeds 1,000 (via a VPN Gateway) or 5,000 (via a TR), the BGP session will terminate abruptly. It will not recover even after the excess routes are withdrawn. To send a massive number of dynamic routes, submit a ticket.

Route propagation and configuration requirements

IPsec-VPN connection via VPN gateway

IPsec-VPN connection via TR

Routing mode	Traffic direction	VPC	Local VPN gateway	Peer data center/VPC
Static routes	From cloud	Single-tunnel VPN gateway After a route is configured to the VPN gateway, the system automatically publishes this route as a custom route in the system route table of the gateway's host VPC. This directs traffic originating from the VPC towards the VPN gateway. You do not need to configure routes for the system route table manually. If the VPN gateway's host VPC has a custom route table in addition to the system route table, and the subnet associated with the custom route table needs to access the peer via VPN Connect, you must manually add the route to the custom route table in the VPC. For the new route, its destination CIDR block is the peer data center or the VPC CIDR block and its next hop type is VPN gateway. For procedure, see Add a route entry. Dual-tunnel VPN gateway After a route is configured to the VPN gateway, the system automatically publishes this route as a system route in all route tables (system and custom route tables) of the gateway's host VPC. This directs traffic originating from the VPC towards the VPN gateway. You do not need to configure routes for the VPC manually. tip The dual-tunnel mode is in the beta stage. If you need a trial, please contact your account manager.	You need to add routes pointing to the peer data center or VPC into the VPN gateway. For procedure, see Adding a VPN gateway route. If the destination CIDR block of a VPN gateway route overlaps with that of a route in the VPC's system route table, the traffic will be forwarded based on the route with the longest mask. Neither the VPN gateway route nor the corresponding route entry in the VPC route table can be modified. When a route is deleted from the VPN gateway, all corresponding system-added routes (with this VPN gateway as the next hop) in the VPC route tables are automatically deleted. Manually added routes remain unaffected. When the VPN gateway is deleted, all corresponding system-added routes (with this VPN gateway as the next hop) in the VPC route tables are automatically deleted. Manually added routes remain unaffected.	No configuration required
Static routes		To cloud	No configuration required	No configuration required	Configure an on-premises gateway route on the peer data center or VPC side. For procedure, see On-premises gateway routes.
Dynamic	From cloud	No configuration required	No configuration required After the BGP session is established, the VPN gateway learns the BGP routes announced by the peer gateway, and publishes them as system routes into all route tables (system and custom route tables) of the gateway's host VPC. After the BGP session is established, the VPN gateway learns the routes from its VPC's system route table that point to the VPC's subnets and publishes them to the peer gateway. The VPN gateway does not learn CEN-published routes or custom routes in the VPC route tables.	No configuration required After the BGP session is established, the peer gateway can automatically propagate its on-premises routes to the VPN gateway. After the BGP session is established, the peer gateway can automatically learn VPC's routes from the VPN gateway.
Dynamic		To cloud			No configuration required

Route configuration guide

IPsec-VPN connection via VPN gateway

IPsec-VPN connection via TR

Adding a VPN gateway route.

Deleting a VPN gateway route.

On-premises gateway route

Prerequisites

The gateway device in your on-premises data center supports the IKE V1 or IKE V2 protocol.

The gateway device in your data center has a static Elastic IP Address (EIP).

The CIDR blocks of your data center must not overlap with those of the VPC where the VPN gateway to be communicated with is located.

Configuration examples

For your convenience, we introduce two configuration methods. You can select the one that best suits your scenario.

Manual configuration

File configuration

Configuring the Sangfor firewall

Configuring the Cisco firewall

Configuring the H3C firewall

Configuring the Hillstone firewall

Routing capability	Principle description	Configuration procedure
Custom route table	A route table manually created by the user. You can use multiple TR route tables to define different interconnectivity scopes for network instances.	Create a route table
Static routes	Used to manually configure routes on the TR instance side. Applicable to scenarios with a small number of routes.	Create a static route
Route propagation	Used to configure TR-side routes by route learning. Applicable to scenarios with a large number of network instance routes. After configuring route learning, the TR route table automatically generates routes with the next hop set to the attachment.	Create a route learning rule
Auto Publish Route	Used to configure routes on the network instance side by auto publishing. After enabling auto-publishing, the system automatically publishes routes from the TR associated forwarding route table of the target instance into the route table of that network instance.	Enable auto publishing
Route policy	Used to filter routes received and sent by the TR, which can change route propagation behavior and selection results.	Create a route policy Configure route policy for a TR route table
Forwarding policy	Used to specify the TR route table for the TR instance to forward traffic of a CIDR block in the network instance.	Create a forwarding policy Configure forwarding policy for a network instance attachment

Routing mode	Traffic direction	VPC	Local TR	Peer data center/VPC
Static routes	From cloud	After creating a TR, connect it to a VPC instance and configure routes. The traffic within the VPC will be forwarded based on the routes in the TR's route table.	Add routes pointing to the peer data center or VPC into the TR. For procedure, see Managing a static route.	No configuration required
Static routes		To cloud	No configuration required	No configuration required	Configure an on-premises gateway route on the peer data center or VPC side. For procedure, see On-premises gateway routes.
Dynamic	From cloud	No configuration required	No configuration required Specify the routing propagation mode as dynamic routing when creating an IPsec-VPN connection. After the BGP session is established, the TR learns the BGP routes announced by the peer gateway. It then publishes these routes as system routes into all route tables (system and custom route tables) of the TR. To use dynamic routing, ensure different Autonomous System Numbers (ASNs) are assigned to the same IPsec-VPN connection's TR and the selected customer gateway. For IPsec-VPN connections using dynamic routing, we recommend avoiding the use of 65535 and 4294967295 as any ASN. If the AS_PATH contains 65535 or 4294967295, the related route will be discarded.	No configuration required After the BGP session is established, the peer gateway can automatically propagate its on-premises routes to the TR. After the BGP session is established, the peer gateway can automatically learn routes from the TR.
Dynamic		To cloud			No configuration required

VPN Connet