{"id":16953,"date":"2019-03-18T12:23:05","date_gmt":"2019-03-18T11:23:05","guid":{"rendered":"https:\/\/www.savecall.de\/ipsec-shutdown-in-china\/"},"modified":"2026-07-21T09:43:52","modified_gmt":"2026-07-21T07:43:52","slug":"ipsec-shutdown-in-china","status":"publish","type":"post","link":"https:\/\/www.savecall.de\/en\/ipsec-shutdown-in-china\/","title":{"rendered":"IPSEC shutdown in China"},"content":{"rendered":"\n

\n

\n

IPSec shutdown in China: alternatives<\/h1>\n<\/div>\n\n\n\n

Trusted Advisor for IT & Telecommunications Sourcing<\/h3>\n<\/div>\n\n\n\n
\n
\n
How companies continue to securely connect their locations<\/h2>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
IPSEC shutdown in China<\/h2>\n\n\n\n
China blocks cross-border IPSec VPNs. SAVECALL shows compliant alternatives with MPLS and China Telecom SD-WAN.<\/h6>\n\n\n\n
The Chinese government is increasingly restricting IPSec VPNs. As a result, companies are losing secure access to servers and services abroad. SAVECALL shows alternatives for stable and legal site connections.<\/p>\n\n\n\n
<\/div>\n\n\n\n
In a nutshell:<\/strong><\/p>\n\n\n\n
\n
Background: The Great Firewall blocks international IPSEC ports<\/li>\n\n\n\n
Affected: VPN and Cross Border Tunnels between China and abroad<\/li>\n\n\n\n
Allowed: Only regulated carrier lines such as MPLS or SD WAN<\/li>\n\n\n\n
Solution: China Telecom SD WAN<\/a> with POPs in Beijing, Shenzhen and Guangzhou<\/li>\n\n\n\n
Advantage: Fast provision from 10 Mbit, low latency, cheaper than MPLS<\/li>\n<\/ul>\n\n\n\n
<\/div>\n\n\n\n
The solution:<\/strong> SAVECALL securely connects German companies with China via regulated SD WAN solutions in cooperation with China Telecom.<\/p>\n\n\n\n
What this article covers:<\/strong> This article explains why China is shutting down IPSec VPNs, what the official regulation says, and how the China Telecom SD-WAN platform works as an alternative. The core question: How secure is your company’s connection to China at the moment?<\/p>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Table of contents<\/h3>\n\n\n\n
\n
Why China is shutting down IPSec VPNs<\/a><\/li>\n\n\n\n
The official Chinese regulation<\/a><\/li>\n\n\n\n
The China Telecom SD-WAN platform<\/a><\/li>\n\n\n\n
How SAVECALL supports<\/a><\/li>\n\n\n\n
FAQ<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n

\n
\n
\n
\n
\n
\n
\n
\n
\n<\/p>\n\n\n
\n
\n
Why China is shutting down IPSec VPNs<\/h3>\n\n\n\n
The IPSec shutdown in China refers to the gradual blocking of cross-border IPSec VPN tunnels by Chinese authorities, which means companies with sites in China lose their usual site connection abroad.<\/p>\n\n\n\n
Many German companies maintain VPNs to China in order to connect their sites there to the corporate network. The Chinese cyber security authorities want to control internet usage in China and block international websites in particular. This is done through the “Great Firewall of China”<\/strong>. All internet traffic must pass through this and be filtered there. In the past, Internet users in China were able to bypass this firewall using international IPSec VPN tunnel services. For a monthly fee, you could use unregulated, open Internet access with an online service provider, and a huge gray market developed. With China’s Cybersecurity Law of 2017, this gray market was systematically eliminated, and offenders have since been subject to severe prison sentences. German companies are also affected by this, as they usually grant their employees access to the international Internet and their own servers and services abroad. Technically, this is realized by means of IPSec tunnels or MPLS VPN<\/strong>.<\/p>\n\n\n\n
The official Chinese regulation<\/h3>\n\n\n\n
The official Chinese government policy on this is as follows:<\/p>\n\n\n\n
\n
Any business entity and individual who set up or rent lines (including VPN services) for the purpose of cross-border transaction or activities is strictly prohibited without authorization from the Chinese Telecom Management Authority.<\/li>\n\n\n\n
The Cloud Service Provider who owns service infrastructure in China and requires connection to foreign country networks shall establish the connection through authorized international internet access service providers approved by the Ministry of Industry and Information Technology (MIIT). Leased lines, VPNs and any unstated self-invented network communication channels are strictly prohibited.<\/li>\n\n\n\n
CDN and SD-WAN operation, including cross-border data transmission, shall comply with the above rules for future management.<\/li>\n<\/ul>\n\n\n\n
In practice, this means that ports 80, 443, 8080, as well as IPSec\/S2S VPN, are blocked by the Chinese authorities. IPSec technically uses the ports 50, 51, 500, 4500 and so on, without there being an official document that specifically addresses these ports. Nevertheless, all cross-country IPSec ports<\/strong> are gradually being blocked<\/strong>. Only pure China-domestic IPSec connections are not affected. What alternatives do companies then have to connect their Chinese locations to their international branches or foreign servers? Carrier MPLS connections<\/strong> are not affected by the shutdowns, as they are subject to different regulation. Since they are so expensive, the Chinese authorities are not concerned that these lines will be used en masse for surfing the unregulated Internet. For many companies, however, an MPLS connection to China is too expensive. Therefore, China Telecom now offers a regulated, reliable and cheaper alternative to MPLS.<\/p>\n\n\n\n
The China Telecom SD-WAN platform<\/h3>\n\n\n\n
$\"Technical$ <\/figure>\n\n\n\n
Here, an existing local Internet connection is used to switch a connection via a pre-configured China Telecom SD-WAN box<\/strong> via China Telecom’s business user backbone, which is located outside<\/strong> the Great Firewall of China and also offers far better performance. The traffic is routed via SD-WAN POPs<\/strong> in Beijing, Shenzhen and Guangzhou to the low-latency CTG DCI-Net<\/strong> and then forwarded internationally via a gateway in Hong Kong<\/strong>. The traffic can then be transferred to the Internet in Frankfurt, for example. SAVECALL has designed such a solution together with China Telecom and has already put it into operation for many German companies. We offer connections from 10 Mbit, which are delivered ready for operation within approximately 14 days, a reliable solution that is far cheaper than an MPLS VPN.<\/p>\n<\/div>\n<\/div>\n\n\n

\n<\/p>\n

\n
\n<\/p>\n\n\n
\n
\n
\n
How SAVECALL connects your China sites<\/h3>\n\n\n\n
<\/div>\n\n\n\n
SAVECALL securely connects German companies with China via regulated SD-WAN solutions in cooperation with China Telecom. Get in touch with us, we will be happy to advise you free of charge and without obligation on the right alternative for your site connectivity.<\/p>\n\n\n\n
<\/div>\n\n\n\n
Conclusion on the IPSec shutdown in China<\/strong><\/h3>\n\n\n\n
<\/div>\n\n\n\n
Whether carrier MPLS or China Telecom SD-WAN: both paths are unaffected by the IPSec shutdown and offer companies a compliant site connection to China. MPLS remains the more expensive but established option, SD-WAN the faster to provision and more affordable alternative. How secure is your company’s connection to China at the moment?<\/p>\n\n\n\n
<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
\n
\n
\n
\n
$\"Frank$ <\/figure>\n<\/div>\n\n\n\n
\n
Written by<\/p>\n\n\n\n
Frank Frommknecht<\/h3>\n\n\n\n
Key Account Consultant, SAVECALL<\/strong><\/p>\n\n\n\n
Has supported companies for over 20 years in selecting and optimizing their connectivity solutions. His focus: making complex telecommunications understandable from the customer’s perspective and strategically finding the right solution.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
Why<\/h2>\n\n\n\n
$\"\"$ <\/figure>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
Telecom & IT sourcing. Worldwide. Carrier-independent.<\/h3>\n\n\n\n
<\/div>\n\n\n\n
Selection & operation of worldwide connectivity & cloud infrastructure. Without vendor risk & unnecessary costs.<\/p>\n\n\n\n
<\/div>\n\n\n\n
\n
80+ carriers worldwide<\/li>\n\n\n\n
One point of contact<\/li>\n\n\n\n
One SLA<\/li>\n\n\n\n
One portal: mySAVECALL<\/li>\n\n\n\n
Min. 20% savings<\/li>\n<\/ul>\n<\/div>\n\n\n\n
\n
Book a consultation<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
\n
\n
25+
years of experience<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
40+
Employees<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
80+
Partner<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
\n
\n
\n
1400+ Clients<\/h2>\n<\/div>\n\n\n\n
\n
Learn more<\/a><\/h5>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
\n
\n
Sources<\/h3>\n\n\n\n
\n
SAVECALL, “MPLS and IPSEC in China”, savecall.de\/en\/mpls-and-ipsec-in-china<\/a><\/li>\n\n\n\n
SAVECALL, “Enterprise WAN: SD-WAN, MPLS & Ethernet”, savecall.de\/en\/wan<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n\n\n
<\/p>\n\n\n
Frequently asked questions about the IPSec shutdown in China<\/h3>\n\n\n\n
Why does China block IPSec VPN connections abroad?<\/strong>
China regulates cross-border internet traffic through the Great Firewall of China and requires international connections to run via authorized access providers. China’s Cybersecurity Law of 2017 explicitly prohibits self-set-up VPN lines and unauthorized cross-border connections for companies and individuals. The aim was to close the gray market of unofficial IPSec tunnels that had grown over the years, which many German companies also used to connect their China sites. In practice, all cross-border IPSec ports have since been gradually blocked.<\/p> <\/div>
Which ports and connections are specifically affected?<\/strong>
Chinese authorities block, among others, ports 80, 443 and 8080, as well as site-to-site IPSec VPN connections. IPSec technically uses ports 50, 51, 500 and 4500, without there being an official document that specifically names these ports. Only cross-border IPSec connections are affected, purely domestic Chinese IPSec connections remain untouched. For companies with international connectivity, this means a growing risk of sudden connection outages.<\/p> <\/div>
Are MPLS connections to China also affected by the shutdown?<\/strong>
No, carrier MPLS connections are subject to different regulation and are not affected by the IPSec shutdowns. Since MPLS connections are comparatively expensive, Chinese authorities do not fear they will be used as mass access to the unregulated internet. MPLS therefore remains a reliable, if cost-intensive, alternative. For many companies, however, a dedicated MPLS line to China is too expensive, which is why China Telecom offers a cheaper, equally regulated alternative via SD-WAN.<\/p> <\/div>
How does the China Telecom SD-WAN platform work?<\/strong>
The solution uses an existing local internet connection, to which a pre-configured China Telecom SD-WAN box is attached. Traffic runs via China Telecom’s business user backbone, which sits outside the Great Firewall and offers significantly better performance. Traffic is routed via SD-WAN POPs in Beijing, Shenzhen and Guangzhou into China Telecom’s low-latency DCI network and forwarded internationally via a gateway in Hong Kong, for example to be handed off in Frankfurt.<\/p> <\/div>
How long does it take to provision the SD-WAN solution to China?<\/strong>
According to SAVECALL, connections from 10 Mbit can be made operational within around 14 days. This is significantly faster than a classic MPLS line to China, which often requires several months of lead time. The short provisioning time results from the solution building on an existing local internet line rather than requiring a new physical connection. SAVECALL coordinates the implementation together with China Telecom.<\/p> <\/div>
What does an SD-WAN connection cost compared to an MPLS line to China?<\/strong>
Based on SAVECALL’s experience, a China Telecom SD-WAN connection is significantly cheaper than a dedicated MPLS line to China, which can quickly reach a five-figure monthly amount. Since the SD-WAN solution builds on existing internet lines, the high cost of a dedicated leased line is avoided. The exact price depends on bandwidth, location and contract term. SAVECALL compares both options neutrally and calculates which solution pays off for your company.<\/p> <\/div> <\/div>\n\n\n
<\/p>\n\n\n
\n
\n
You might also be interested in<\/h2>\n<\/div>\n\n\n\n
\r\n
\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Globale Internet-Beschaffung: Warum Inhouse-Sourcing oft teurer wird als gedacht<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-security-service-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-costs-site-connectivity<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-monitoring-visibility-operation<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
wan-sla-mttr-what-counts<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Satellite$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
cloud-phone-system-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Mobile radio management<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Mobile Provider Comparison 2026<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
Business Internet Connection Which Provider Fits<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Consulting<\/p>\r\n <\/div>\r\n\r\n
\r\n
why-vendor-sprawl-destroys-agility<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Das$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
AI-Enabled Networks: Why Bandwidth Alone Isn’t Enough\u2014and What CIOs Really Need to Focus On<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
Global Connectivity from a Single Source<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
nis2-telecom-infrastructure<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"WAN$ <\/div>\r\n
WAN<\/p>\r\n <\/div>\r\n\r\n
\r\n
managed-sd-wan-provider-germany<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
sase-provider-comparison<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Voice<\/p>\r\n <\/div>\r\n\r\n
\r\n
Why cloud security is important<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Savecall$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
Second acquisition in twelve months: Savecall takes over landline customers from Bluestring<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
What and where are the challenges for the network infrastructure of most companies?<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Internet<\/p>\r\n <\/div>\r\n\r\n
\r\n
SAVECALL Holding GmbH founded: Clear structure. Strong foundation. Long-term partnership.<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"SAVECALL$ <\/div>\r\n
Security<\/p>\r\n <\/div>\r\n\r\n
\r\n
Mastering Shadow AI with SASE: Security and transparency for Gen-AI in the company<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n
\r\n \r\n\r\n
\r\n
\r\n $\"Luftaufnahme$ <\/div>\r\n
Partner<\/p>\r\n <\/div>\r\n\r\n
\r\n
10 advantages of mobile device management<\/h3>\r\n
\r\n
Learn moreLearn more<\/h3>\r\n <\/div>\r\n <\/div>\r\n\r\n <\/a>\r\n <\/div>\r\n <\/div>\r\n\r\n
<\/div>\r\n
<\/div>\r\n
<\/div>\r\n<\/div>\r\n\r\n