Облачная платформаAdvanced

S2C VPN

Язык статьи: Английский
Перевести

VPN Gateway

Table 1 Constraints on VPN gateways

VPN Type

Resource

Default Quota

Enterprise Edition VPN

VPN gateways per tenant in each region

50

  • If you have only one VPC, you can create a maximum of 50 VPN gateways for the VPC.
  • If you have multiple VPCs, you can create a maximum of 50 VPN gateways for all these VPCs.

VPN connection groups per VPN gateway

100

Local subnets per VPN gateway

50

Number of BGP routes that can be accepted by VPN gateways of different specifications

100

  • VPN gateway of the Professional 1 specification: 200
  • VPN gateway of the Professional 2 specification: 300

Maximum number of routes supported by a VPN gateway

9500

Maximum number of ACL rules supported by VPN gateways of different specifications

300

Classic VPN

VPN gateways per tenant in each region

2

Only one VPN gateway can be created for a VPC.
  • By default, the maximum length of TCP packets supported by a VPN gateway is 1300 bytes.

Customer Gateway

Table 2 Constraints on customer gateways

VPN Type

Resource

Default Quota

Enterprise Edition VPN

Customer gateways per tenant in each region

100
  • Enable NAT traversal on the customer gateway based on the networking.
    • If the customer gateway is connected to the Internet through a NAT device, enable NAT traversal on the customer gateway.
    • If the customer gateway is directly connected to the Internet, you do not need to enabled NAT traversal on the customer gateway.
  • Dead Peer Detection (DPD) must be enabled on a customer gateway.
  • A customer gateway must support IPsec tunnel interfaces and be configured with a corresponding security policy.
  • When Network Quality Analysis (NQA) is enabled for a connection in static routing mode, the IPsec tunnel interface of a customer gateway must have an IP address and be able to respond to ICMP requests.
  • It is recommended that the maximum segment size (MSS) of TCP packets be set to a value less than 1399 on a customer gateway, so as to prevent fragmentation caused by addition of an IPsec header.

VPN Connection

Table 3 Constraints on VPN connections

VPN Type

Resource

Default Quota

How to Increase Quota

Enterprise Edition VPN

Policy rules per VPN connection

50

Subject to the value displayed on the console.

Customer subnets per VPN connection

50

.

Classic VPN

VPN connections per tenant in each region

12

This quota cannot be increased.
  • In multi-subnet scenarios, you are advised to use VPN connections in routing mode. For a VPN connection in policy-based or policy template mode, a VPN gateway creates a communications tunnel for each pair of the local and customer subnets by default. If there are multiple local or customer subnets for a VPN connection in policy-based or policy template mode, multiple communications tunnels are created.

    For a VPN gateway of the Professional 1 or Professional 2 specification, a single IP address can be used to establish a maximum of 300 communications tunnels with customer gateways..
    • In routing mode, each VPN connection occupies only one communications tunnel of the corresponding VPN gateway IP address.
    • In policy-based or policy template mode, each VPN connection occupies M x N communications tunnels of the corresponding VPN gateway IP address. M indicates the number of local subnets, and N indicates the number of customer subnets.

      For a VPN gateway of the Professional 1 or Professional 2 specification, a maximum of 300 source and destination subnet pairs are supported for each IP address used to establish connections with customer gateways.

    If the number of communications tunnels occupied by all VPN connections in different modes established by a single gateway IP address exceeds 100, excess VPN connections will fail to be created.

    If the number of communications tunnels occupied by VPN connections in different modes established by a single IP address of a VPN gateway of the Professional 1 or Professional 2 specification exceeds 300, excess VPN connections will fail to be created.
  • When creating a VPN connection in policy-based mode and adding multiple policy rules, ensure that the source and destination CIDR blocks in different policy rules do not overlap. Otherwise, data flows may be incorrectly matched or IPsec tunnels may flap.
Parent topic: Quotas and Constraints
Предыдущая статья
Quotas and Constraints
Следующая статья
Reference Standards and Protocols
Поддержка Юридические документы Политика конфиденциальности
© 2026 Cloud.ru