How transit routers work

VPC connection requirements

When connecting a VPC, the zone availability of the transit router determines how many vSwitches you need:

Single-zone regions (for example, China (Nanjing - Local Region)):

• The VPC must have at least one vSwitch in the supported zone with at least one available IP address.

• One elastic network interface (ENI) is created in the vSwitch and occupies one IP address.

Multi-zone regions (for example, China (Hangzhou)):

• The VPC must have at least two vSwitches in different zones, each with at least one available IP address.

• One ENI is created in each vSwitch, occupying one IP address per vSwitch.

• The two vSwitches provide zone-disaster recovery to ensure uninterrupted data transmission.

For regions that support multiple zones, create a vSwitch in each zone for VPC connections and make sure each vSwitch has at least one idle IP address. This reduces network latency and improves performance by shortening data transmission distance. For zone availability details, see What is CEN?. For routing behavior details, see VPC connection routing principles.

Route tables

Each Enterprise Edition transit router has one default route table. You can also create custom route tables for traffic segmentation — for example, isolating development VPCs from production VPCs, similar to virtual routing and forwarding (VRF) in traditional networks. Default and custom route tables are isolated from each other for access control.

After connecting a network instance, no routes are advertised to it by default. Enable route synchronization to turn on automatic route advertisement.

Associated forwarding

Associated forwarding determines which route table the transit router queries when forwarding traffic from a network instance.

• Traffic from a network instance is only forwarded after its connection is associated with a route table.

• Each network instance connection can be associated with the route tables of only one Enterprise Edition transit router.

Route learning

Route learning determines which route tables receive routes from a network instance.

• Routes from a network instance are advertised to a route table only after route learning is enabled between the connection and that route table.

• A single network instance connection can propagate routes to route tables of one or more Enterprise Edition transit routers.

How the two mechanisms work together:

Additional routing features

• Custom route entries: Add static routes to route tables to override or supplement learned routes.

• Prefix lists: Associate a prefix list with a route table to automatically add routes for all CIDR blocks in the list. This reduces manual configuration.

• Routing policies: Filter and modify routes in a route table — control whether routes are advertised to specific network instances or other transit routers, and adjust route attributes. When a VBR or IPsec-VPN connection is attached, the system automatically adds a routing policy (priority 5000, action Reject, direction Egress Regional Gateway) to prevent direct communication between VBR or IPsec-VPN connections on the same transit router. For details, see Default routing policy.

• Aggregated routes: Combine multiple specific routes in a route table into a single aggregate route. When route synchronization is enabled for the associated VPC, the aggregate route is advertised instead of the individual routes — reducing route count and accelerating synchronization.

• Multi-region VBR equal-cost routes: When Multi-region Equal-Cost Multi-Path (ECMP) routing is enabled and routes from multiple VBRs share the same attributes except for region IDs, those routes are treated as equal-cost routes and load-balanced.

VPC route conflict rules

Routes to and from VPCs take precedence in specific conflict scenarios. When a conflict is detected, the lower-priority route is marked as conflicting and blocked — without disrupting traffic already flowing through existing routes.

VPCs and on-premises networks host different services. Overlapping CIDR blocks across VPCs or hybrid cloud connections should not have active-standby or ECMP relationships.

Priority for non-conflicting data-center routes

For routes pointing to a data center that do not trigger conflict rules, priority is determined in this order:

1. Static routes (highest priority): Manually configured custom route entries and prefix list entries. When both exist for the same destination, they automatically form ECMP routes.

2. Dynamic routes — evaluated in the following order when multiple dynamic routes exist:

   1. Source instance type: VBR > ECR > Cloud Connect Network (CCN) > IPsec connections (VCO)

   2. Route entry type in the source route table: BGP routes take precedence over custom route entries.

   3. AS_PATH length: Routes with shorter BGP AS_PATH are preferred.

   4. Next hop location: Intra-region connections are preferred over inter-region connections.

   5. Routing policy priority: A lower priority value indicates a higher priority.

   6. Tie-breaker:

      • For intra-region next hops: ECMP is enabled automatically.

      • For inter-region next hops: If multi-region ECMP routing for VBRs is enabled and the source is a VBR or ECR, ECMP is enabled. Otherwise, region IDs of the next-hop transit routers are compared alphabetically — entries with alphabetically earlier region IDs take priority.

IPv6 support by network instance

Limitations

• The multicast feature does not support IPv6.

• IPv6 route entries share the same route table entry quota as IPv4 entries. For example, if the quota is 10,000 entries, the combined total of IPv4 and IPv6 entries must stay below that limit.

• When creating a VPC connection with Automatically Create Route That Points to Transit Router and Add to All Route Tables of Current VPC selected, the system automatically adds three IPv4 routes (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). IPv6 routes are not added automatically.

To route IPv6 traffic through the transit router for a VPC, either activate route synchronization after creating the VPC connection, or manually add IPv6 route entries in the VPC route tables. For a step-by-step example, see Establish inter-region IPv6 communication with transit router.