IPSec shutdown in China: alternatives

Why China is shutting down IPSec VPNs

The IPSec shutdown in China refers to the gradual blocking of cross-border IPSec VPN tunnels by Chinese authorities, which means companies with sites in China lose their usual site connection abroad.

Many German companies maintain VPNs to China in order to connect their sites there to the corporate network. The Chinese cyber security authorities want to control internet usage in China and block international websites in particular. This is done through the “Great Firewall of China”. All internet traffic must pass through this and be filtered there. In the past, Internet users in China were able to bypass this firewall using international IPSec VPN tunnel services. For a monthly fee, you could use unregulated, open Internet access with an online service provider, and a huge gray market developed. With China’s Cybersecurity Law of 2017, this gray market was systematically eliminated, and offenders have since been subject to severe prison sentences. German companies are also affected by this, as they usually grant their employees access to the international Internet and their own servers and services abroad. Technically, this is realized by means of IPSec tunnels or MPLS VPN.

The official Chinese regulation

The official Chinese government policy on this is as follows:

• Any business entity and individual who set up or rent lines (including VPN services) for the purpose of cross-border transaction or activities is strictly prohibited without authorization from the Chinese Telecom Management Authority.
• The Cloud Service Provider who owns service infrastructure in China and requires connection to foreign country networks shall establish the connection through authorized international internet access service providers approved by the Ministry of Industry and Information Technology (MIIT). Leased lines, VPNs and any unstated self-invented network communication channels are strictly prohibited.
• CDN and SD-WAN operation, including cross-border data transmission, shall comply with the above rules for future management.

In practice, this means that ports 80, 443, 8080, as well as IPSec/S2S VPN, are blocked by the Chinese authorities. IPSec technically uses the ports 50, 51, 500, 4500 and so on, without there being an official document that specifically addresses these ports. Nevertheless, all cross-country IPSec ports are gradually being blocked. Only pure China-domestic IPSec connections are not affected. What alternatives do companies then have to connect their Chinese locations to their international branches or foreign servers? Carrier MPLS connections are not affected by the shutdowns, as they are subject to different regulation. Since they are so expensive, the Chinese authorities are not concerned that these lines will be used en masse for surfing the unregulated Internet. For many companies, however, an MPLS connection to China is too expensive. Therefore, China Telecom now offers a regulated, reliable and cheaper alternative to MPLS.

The China Telecom SD-WAN platform

Here, an existing local Internet connection is used to switch a connection via a pre-configured China Telecom SD-WAN box via China Telecom’s business user backbone, which is located outside the Great Firewall of China and also offers far better performance. The traffic is routed via SD-WAN POPs in Beijing, Shenzhen and Guangzhou to the low-latency CTG DCI-Net and then forwarded internationally via a gateway in Hong Kong. The traffic can then be transferred to the Internet in Frankfurt, for example. SAVECALL has designed such a solution together with China Telecom and has already put it into operation for many German companies. We offer connections from 10 Mbit, which are delivered ready for operation within approximately 14 days, a reliable solution that is far cheaper than an MPLS VPN.