Site to Site VPN from Alibaba Cloud (FLEXGW) to OnPremises (CyberRoam)

Introduction

This article shows you how to use the on premises "CyberRoam" Firewal to create a Site-to-Site VPN gateway connection and Deploy a VPN gateway appliance (FLEXGW) from your Alibaba Cloud portal and connect it to the VNet.
Flex is a one of its kind Internet Gateway that provides added flexibility and manageability compared to any other public access Internet Gateways. It is easy to install and manage with multiple customization options for an excellent user experience in high demand public wired and Wi-Fi Internet access

This guide will provide quick steps to configure Site-to-Site.

Configuration of the Alibaba Cloud Portal

Login to you Alibaba Cloud Portal and open another browser tab. Look for Alibaba cloud marketplace.

https://www.alibabacloud.com/marketplace

Go to the search space at right-hand corner and find “FlexGW IPsec VPN on CentOS”

Deploy the appliance as an instance in the default VPC.

Once deployed, reset the password and restart the VM.

Go back to the ECS console and check that your ECS instance is up and running:

Change the default security group rules to enhance your application security:

Similarly add ports : 443 / 500 / 4500.
Open your browser and paste the Public IP of the instance at https://publicip/




Create a VPN tunnel Create an appropriate VPN tunnel by providing the necessary details:

Save and finish the configuration. Check the tunnel list:


On CyberRoam (on-prem) Firewall:

Login to your CyberRoam Firewall and Navigate to Objects > Hosts, and create new for record for Alibaba Cloud's local subnet.

Navigate to VPN > Policy and create a new policy. Make sure you match the Algorithm parameters in this policy with the one in FlexGW.

save the configuration.
Navigate to VPN > IPSEC and enter the public IP and local subnet information properly.
Make sure the preshared key is same on both the side.

Save the configuration and go back to your FlexGW to check if the Tunnel is online.

To test it further, you can deploy a virtual machine on both sides and do a ping test.

Site to Site VPN between Alibaba Cloud and Microsoft Azure

Introduction

This article shows you how to use the Azure portal to create a Site-to-Site VPN gateway connection and Deploy a VPN gateway appliance from your Alibaba Cloud portal and connect it to the VNet.

This guide will provide quick steps to configure Site-to-Site.

On Azure:

1. Create a virtual network

To create a VNet in the Resource Manager deployment model by using the Azure portal, follow the steps below.

1. From a browser, navigate to the Azure portal and sign in with your Azure account.
2. Click New. In the Search the marketplace field, type 'virtual network'. Locate Virtual network from the returned list and click to open the Virtual Network page.
3. Near the bottom of the Virtual Network page, from the Select a deployment model list, select Resource Manager, and then click Create. This opens the 'Create virtual network' page.

   

2. Create the gateway subnet

• In the portal, navigate to the virtual network for which you want to create a virtual network gateway.
• In the Settings section of your VNet page, click Subnets to expand the Subnets page.
• On the Subnets page, click +Gateway subnet at the top to open the Add subnet page.
• The Name for your subnet is automatically filled in with the value 'GatewaySubnet'. The GatewaySubnet value is required in order for Azure to recognize the subnet as the gateway subnet. Adjust the auto-filled Address range values to match your configuration requirements.
• To create the subnet, click OK at the bottom of the page.

3. Create the VPN gateway

• On the left side of the portal page, click + and type 'Virtual Network Gateway' in the search box. In Results, locate and click Virtual network gateway.
• At the bottom of the 'Virtual network gateway' page, click Create. This opens the Create virtual network gateway page.
• On the Create virtual network gateway page, specify the values for your virtual network gateway.

4. Create the local network gateway

The local network gateway typically refers to your on-premises location. But here we are connecting to Alibaba cloud VPN gateway appliance. So You give the site a name by which Azure can refer to it, then specify the IP address of the Alibaba cloud VPN device to which you will create a connection.

Create the VPN connection

Create the Site-to-Site VPN connection between your virtual network gateway and your Alibaba cloud VPN device.

• Navigate to and open the blade for your virtual network gateway. There are multiple ways to navigate. In our example, we navigated to the gateway 'VNet1GW' by going to TestVNet1 -> Overview -> Connected devices -> VNet1GW.
• On the blade for VNet1GW, click Connections. At the top of the Connections blade, click +Add to open the Add connection blade.

Configuration of the Alibaba Cloud Portal

Login to you Alibaba Cloud Portal and open another browser tab. Look for Alibaba cloud marketplace.

https://www.alibabacloud.com/marketplace

Go to the search space at right-hand corner and find “FlexGW IPsec VPN on CentOS”

Deploy the appliance as an instance in the default VPC.

Once deployed, reset the password and restart the VM.

Open your browser and paste the Public IP of the instance at https://publicip/

Navigate to IPSEC VPN and click on create a tunnel.

 

Make sure the PSK (Shared Key) is same on both the sides.

Click on Save and it should start connecting to the Azure VPN gateway and you should be able to see the status as below

On Azure Portal:

To test it further, you can deploy a virtual machine on both sides and do a ping test.

I deployed an Ubuntu VM on Azure and on Alibaba.

The virtual machine on Azure with the below private IP:

Virtual Machine on Alibaba with its private IP:

Note: the catch is since, on Alibaba Cloud we have deployed VPN GW as an instance, we have to make sure the “Route Entry” is added to use the ECS instance to reach a particular CIDR.

And there you go:

Ping from Alibaba to Azure

                                            Thank you for reading

How to launch your First ECS Linux instance on Alibaba Cloud

While the talks are around for Amazon EC2 instances, Azure Virtual Machine on Microsoft Azure and Google Compute Engine instances. Let us get our hands dirty by creating first instance on Alibaba Cloud.

Unlike any other Cloud platform the very first step before you spin your Virtual machine instance is to create a Free trial account. Please refer article

1. Login to Alibaba Cloud console using a the free trial account credentials.

2. Click on the console from the bottom of the portal.

3. Click on the Elastic Compute Service under Product & Services.

4. Click on Instances at the left hand side.

5. Select the Region this is for management console and not for the ECS VM deployment and click on Create Instance.

6. Click on Advanced Purchase & choose the pricing model as "Pay-As-you-Go". PAYG model pricing is based on the usage and no. of hours the instance is turned ON. However Subscription based model is fixed fees that gets deducted from the free trial account balance.

7. Select the Datacenter Region and zone where actually the ECS instance will be created.

8. Select the instance type and instance configuration from the respective family.

9. Select Network type with default configuration and select Data Transfer model under Network Billing Type.

Note: Under Network Bandwidth if you do not provide network bandwidth details, then no Public IP is assigned to the instance. You may not be able to access the instance over internet. So to access the instance over public network it is important to specify the bandwidth. Once you specify the bandwidth as 1Mbps public IP gets binded with the ECS instance.

10. Select the Operating System version, here you have the option to choose Windows, Linux (centOS, Ubuntu and other flavor of linux).

11. Select the Storage type, OS disk storage is installed on this storage. You have the option to select SSD Cloud Disk for faster OS to boot.( this will increase the instance pricing so kindly read the instance pricing section carefully in Production scenario). You can additional disk if required.

12. Under Security Setting, you can set credentials for the access to the ECS instance for root user.

13. You can set custom user data information and Instance name like "TestServer" for you to identify.

14. In the overview pane, summary of the ECS instance is available, Click Buy Now.

15. After clicking on Buy Now, confirmation page is displayed. Enable the check box for General terms and Click on Activate.

16. On the activation page click on the Console tab, it will take you to the instance details.

17. Under Instance, you will be able to see the running instances details.Click on Running.

18. Running instance details is available with Public & Private IP. You may be able to connect to the running instance by clicking connect.

19. Once you click on Connect, it displays the VNC password. Please make a note of the VNC password, else you will not be able to login to the instance later in future.

20. You can connect to the Server Terminal by sending Remote Command.

21. It will ask for VNC password, please type the VNC password & click on OK.

22. After you provide the VNC password, you are connected to Server console. To Login to ECS Linux instance type the root login and credentials for the same.

23. Once you type the credentials for the root login, you are logged into the ECS Linux instance Successfully. It displays a welcome message.

By following the above steps you have successfully launched your First ECS Linux instance on Alibaba Cloud.

I hope the article was helpful and Thank You for reading the article.

                                                                                             Courtesy: Ajay Pal