Alibaba Cloud global account signup discount Alibaba Cloud VPN Gateway Pricing, Purchase, KYC, Billing, and Setup Guide for Site-to-Site VPN and Remote Access

What users usually want to know before they place an order

Most users searching for Alibaba Cloud VPN Gateway are not looking for a generic explanation of what a VPN is. They are usually trying to answer operational questions such as: Can my account buy this product today? Do I need identity verification first? Which payment method is accepted in my region? Why is my order blocked by compliance review? Which specification should I choose for a branch office tunnel versus remote employee access? After I pay, what exact configuration steps are needed to bring the tunnel up?

In real projects, the biggest delays rarely come from the tunnel configuration itself. They usually happen earlier during account setup, KYC review, payment settlement, region mismatch, or later when routes and security rules are incomplete. This guide is structured around those real decision points so you can move from account preparation to production connectivity with fewer failed orders and fewer tunnel-down incidents.

Typical usage scenarios behind this search

Preparation before purchase

Alibaba Cloud global account signup discount Account requirements

Alibaba Cloud global account signup discount Before you open the buy page, verify that the account can actually complete the order and manage networking resources.

• Alibaba Cloud account must be registered and able to sign in to the console.
• If you are using a RAM user, confirm the user has permissions for VPC, VPN Gateway, route tables, SSL certificates if used, and billing visibility.
• If the environment belongs to a company, use a dedicated owner account for purchase and delegate daily operations through RAM users instead of sharing the root account.

Identity verification and KYC

Identity verification is often the first operational blocker. Depending on account type and country, you may be asked for personal verification or enterprise verification before some networking products can be purchased or before account limits are increased.

Practical advice: complete KYC before project cutover week. If you wait until the deployment window, any manual review can delay procurement and go-live.

Funding, billing, and payment preparation

Depending on your billing mode and region, you may pay by credit card, debit card in supported regions, bank transfer, account balance, or invoiced enterprise settlement where available. The accepted payment methods vary, so check the checkout page for your account and billing country rather than relying on third-party screenshots.

Before ordering, check these four items:

• Whether the product is billed as subscription, pay-as-you-go, or both in your target region.
• Whether your account balance is sufficient if prepaid balance is required.
• Whether auto-renewal is enabled, especially for production VPN connections.
• Whether the finance team needs tax invoice information before payment.

Technical prerequisites

Alibaba Cloud global account signup discount Collect the network values before opening the console. Most failed configurations come from missing or conflicting values.

Step-by-step: buying Alibaba Cloud VPN Gateway correctly

Step 1: Select the region and confirm product availability

In the Alibaba Cloud console, go to the networking section and open VPN Gateway. Select the region first. Do not assume you can buy in one region and attach it to a VPC in another region. VPN Gateway is region-specific and should be deployed in the same region as the VPC you want to access.

Important checks before clicking buy:

• Confirm that your ECS, RDS, Redis, or internal applications are in the same region.
• For cross-border access, test latency from your office or branch network to the region by ping, TCP connect, or an existing public IP in the same geography.
• Make sure the region meets your data residency or internal compliance requirements.

Step 2: Choose billing mode and service duration

On the purchase page, choose the billing model available to your account. For steady production environments, subscription often gives more predictable budgeting. For short migration projects or proof-of-concept work, a flexible billing mode may be more suitable if supported.

When selecting duration:

• Choose 1 month only for short-lived projects or testing.
• Choose longer subscription periods if the tunnel is business-critical and budget approval is already in place.
• Enable auto-renewal for production so the VPN does not expire unexpectedly during a weekend or holiday.

A common mistake is buying a short term manually and forgetting the expiration date. If the VPN Gateway expires, site-to-site traffic and remote admin access can drop immediately.

Step 3: Select specification and feature set

On the configuration page, choose the VPN Gateway specification that matches expected throughput and connection count. If your use case includes only one branch firewall and a few internal services, you may not need a high specification. If the gateway will terminate multiple branch tunnels or carry backup replication traffic, choose a higher tier.

Step 4: Review payment and submit the order

At checkout, confirm account balance, tax settings, coupon or discount applicability if any, and whether the payment method triggers bank verification. If the order fails after submission, the most common causes are insufficient balance, unsupported payment method for the account location, or fraud/risk screening by the payment processor.

If your order enters manual review:

• Check the registered email and console notifications for document requests.
• Make sure account name, payment name, and company verification data are consistent.
• Do not repeatedly create multiple failed orders in a short period. That can trigger additional automated risk checks.

Step-by-step: configure site-to-site VPN after purchase

Step 1: Prepare VPC, vSwitch, and route information

In the VPC console, identify the target VPC and note its CIDR block. If the cloud and on-premises networks overlap, the tunnel may establish but traffic routing will fail or become ambiguous. Resolve overlapping CIDR blocks before deployment whenever possible.

Then check route tables:

• Confirm the workloads you want to access are inside the VPC and subnets you expect.
• Document the route table associated with each vSwitch.
• Alibaba Cloud global account signup discount If using custom route tables, verify you will add the on-premises destination route after the VPN connection is created.

Step 2: Create the customer gateway

In the VPN Gateway console, click the option to create a customer gateway. Enter the public IP address of your on-premises firewall or VPN device. Name it clearly, such as hq-fw-sg-01 or branch-london-edge.

Considerations:

• The IP must be the actual public peer seen by Alibaba Cloud.
• If your firewall is behind NAT, verify whether NAT traversal is supported and enabled.
• If the public IP changes often, use a static IP before production rollout. Dynamic peer IP changes create recurring outages.

Step 3: Create the IPsec-VPN connection

Click to create an IPsec-VPN connection and select the VPN Gateway you purchased and the customer gateway you just created. Enter the local and remote CIDR blocks exactly as planned. Then configure IKE and IPsec parameters.

Typical tunnel-up failure causes at this step:

• One side uses IKEv1 and the other uses IKEv2.
• Encryption or authentication algorithms do not match.
• On-premises firewall local/remote subnet definitions are reversed.
• The public IP entered in the customer gateway is outdated.
• UDP 500 and UDP 4500 are blocked by an upstream firewall.

Step 4: Add or verify routes

After creating the IPsec connection, check whether routes are propagated automatically in your design. If not, manually add a route in the VPC route table so the destination on-premises CIDR points to the VPN Gateway. On the on-premises side, add a static route or equivalent policy so the VPC CIDR is sent through the tunnel.

If routes are wrong, the tunnel may show as connected but traffic still fails. This is one of the most common operational misunderstandings.

Step 5: Configure security groups and host firewalls

Even with a healthy tunnel, ECS instances and databases may remain inaccessible if security groups or operating system firewalls block the traffic.

For Linux ECS, useful checks include commands such as ss -lntp, firewall-cmd --list-all, and ip route. For Windows, use Test-NetConnection in PowerShell to verify reachability from a client host.

Step-by-step: configure remote access with SSL-VPN

Step 1: Enable SSL-VPN on the purchased gateway

In the VPN Gateway console, open the gateway instance and choose the SSL-VPN related configuration. Create a server configuration and define the client address pool. This address pool must not overlap with your VPC CIDR, office LAN, home user subnet, or any peered network.

Example:

• VPC CIDR: 172.16.0.0/16
• Office LAN: 10.20.0.0/16
• Home LAN often used by users: 192.168.1.0/24
• Suggested SSL-VPN client pool: 10.250.0.0/24

Step 2: Define access permissions

Specify which VPC subnets or internal resources remote users can reach. Do not grant broad access to all ports and all internal networks unless there is a strong reason. If users need only bastion host access or private Git access, restrict to those subnets and ports.

Step 3: Download client configuration and distribute securely

Generate or download the client profile and any required certificates from the console. Distribute them through a controlled internal method, not through public file sharing or personal chat tools. Track who received client profiles and revoke them when employees leave or contractors finish work.

Step 4: Test end-user connectivity

After the client connects, test in this order:

• Can the client reach the private IP of an ECS instance by ping or TCP connect if ICMP is blocked?
• Can the user resolve internal DNS names if required?
• Can the user reach SSH, RDP, HTTPS, MySQL, or Redis only according to the allowed policy?

If the client connects but cannot access internal services, check route push settings, client local firewall, VPC route tables, and ECS security groups.

Purchasing, billing, and compliance questions that often delay projects

Identity verification not completed

If the console allows sign-in but blocks purchase or activation, complete the account verification workflow first. Some users create a new account on deployment day and assume payment alone is enough. In practice, networking services may still require validated identity details.

Payment method rejected

If a card fails, verify:

• The card supports international or online B2B transactions.
• Alibaba Cloud global account signup discount The billing address matches what the issuer expects.
• The bank is not blocking the transaction as suspicious.
• The account owner country and payment instrument country do not create a mismatch requiring manual review.

Order submitted but service unavailable

This can happen due to risk review, unpaid order timeout, or region-specific stock or policy restrictions. Check the order status in the billing center, not only the product page.

Renewal concerns

Production VPNs should not rely on manual renewal reminders. Use auto-renewal where possible and set internal alerts 30 days, 7 days, and 1 day before expiration. Also confirm the payment source for renewal is still valid. A replaced corporate card can silently break auto-renewal.

Cost comparison and configuration recommendations

How to evaluate cost realistically

Do not compare VPN Gateway cost using only the listed instance price. Include these components:

• VPN Gateway instance fee
• Internet bandwidth or related egress charges if applicable to your design
• Cross-region or cross-border traffic implications
• Operational cost of managing certificates, routes, and monitoring
• Potential cost of downtime if the gateway is undersized or manually renewed

Practical recommendations by scenario

Alibaba Cloud global account signup discount Common troubleshooting procedures after purchase

The VPN tunnel is down

Check these items in order:

• Customer gateway public IP matches the current on-premises firewall WAN IP.
• UDP 500 and 4500 are reachable.
• Pre-shared key matches exactly.
• IKE version, encryption, hash, and DH group are identical on both ends.
• NAT-T is enabled if the peer is behind NAT.
• The on-premises device has not exceeded its own tunnel or license limit.

The tunnel is up, but ECS cannot be reached by SSH or RDP

Check route tables first, then security groups, then OS firewall. For Linux, verify SSH is listening on the expected port. For Windows, verify RDP is enabled and inbound 3389 is allowed. If you recently reinstalled the operating system, previous host firewall settings may have changed.

Alibaba Cloud global account signup discount MySQL or Redis cannot be accessed over the VPN

For MySQL, check whether the database listens only on localhost, whether RDS whitelist or private connection rules allow the on-premises CIDR, and whether DNS resolution points to the private endpoint. For Redis, check authentication, protected mode or ACL-related settings, and whether private endpoint access is expected rather than public endpoint access.

Remote users connect to SSL-VPN but cannot resolve internal domains

This usually points to DNS configuration rather than the VPN tunnel itself. Push the correct internal DNS server settings to clients if supported, or configure split-DNS behavior on the client side. Also confirm that the internal DNS server allows queries from the SSL-VPN client address pool.

Alibaba Cloud global account signup discount Optimization recommendations

Security optimization

• Use a long random pre-shared key and rotate it during scheduled maintenance.
• Restrict security groups to on-premises CIDRs instead of allowing broad private ranges.
• For SSL-VPN, issue client profiles only to named users and revoke them promptly when access is no longer required.
• Use RAM users with least privilege for daily administration.
• Log configuration changes and store a copy of IKE/IPsec settings in your change management system.

Performance optimization

• Choose a region close to the office or branch firewall to reduce latency.
• Avoid overlapping CIDR blocks and excessive route complexity.
• For data migration, test throughput with real packet sizes and monitor fragmentation behavior.
• If users report intermittent slowness, compare tunnel utilization during backup windows or peak business hours.

Cost optimization

• Size for measured traffic, not estimated worst case unless the environment is business-critical.
• Use shorter subscription periods for temporary migration projects.
• Review renewal settings quarterly so expired cards or stale finance approvals do not interrupt service.
• Do not deploy separate gateways in multiple regions unless application placement requires it.

Stability optimization

• Document all routes, peer IPs, crypto parameters, and contact owners.
• Monitor tunnel state and set alerts on disconnection, latency increase, or packet loss.
• Keep a tested rollback plan for changing IKE/IPsec algorithms or readdressing networks.
• Take snapshots or backups of ECS systems before major network cutovers if administrative access depends on the VPN.

Alibaba Cloud global account signup discount Final decision checklist before production go-live

Before you depend on Alibaba Cloud VPN Gateway for a production office connection or remote admin access, verify all of the following:

• Account KYC is complete and billing is stable.
• Auto-renewal is enabled or renewal ownership is documented.
• Region selection matches workload location and latency expectations.
• VPC and on-premises CIDRs do not overlap.
• Customer gateway public IP is fixed and confirmed.
• IKE and IPsec parameters are documented and matched on both ends.
• Routes, security groups, and host firewalls are tested.
• SSH, RDP, database access, and internal DNS resolution are validated over the tunnel.
• Operations team has a runbook for tunnel-down troubleshooting.

Alibaba Cloud global account signup discount If you complete these checks in order, you avoid the majority of failed purchases and post-deployment support incidents associated with Alibaba Cloud VPN Gateway for site-to-site connectivity and remote access.