Access an ECS instance from an on-premises data center through a physical connection

Background information

In this topic, the configurations of the VPC and on-premises data center shown in the following figure are used as an example. Assume that your on-premises data center (CIDR block: 172.17.1.0/24) is located in Hangzhou. You have a VPC (CIDR block: 172.16.0.0/16) in the China (Hangzhou) region. You want to use a physical connection to access an ECS instance (IP address: 172.16.1.1) in the VPC from a server (IP address: 172.17.1.2) at the on-premises data center.

Step 1: Establish a physical connection

You can establish an exclusive physical connection by applying for a physical connection interface in the Express Connect console yourself or establish a shared physical connection by using a shared port of an Alibaba Cloud partner. For more information, see Created a dedicated physical connection and Establish a shared physical connection.

In this example, configure the VBR associated with the physical connection as follows:

Step 2: Add the VPC and VBR to a CEN instance

After the physical connection is established, add the VBR and VPC to be connected to the same Cloud Enterprise Network (CEN) instance.

1. Log on to the CEN console.
2. On the Instances page, find the target CEN instance and click the instance ID.
   Make sure that a CEN instance is created. For more information, see Create a CEN instance.
3. On the Networks tab, click Attach Network and add the VBR to the CEN instance.
   For more information, see Attach networks.
4. Click Attach More to add the VPC to the CEN instance.
   

Step 3: Configure VBR routes

After you add the VBR and VPC to the same CEN instance, add a route pointing to the on-premises data center in the VBR.

1. Log on to the Express Connect console.
2. In the left-side navigation pane, choose Virtual Border Routers (VBRs) > Virtual Border Routers (VBRs). Find the target VBR and click the instance ID.
3. On the VBR details page, click the Routes tab and then click Add route.
4. In the Add Route dialog box that appears, configure the route as follows:
   • Destination Subnet: Enter the CIDR block of the on-premises data center. In this example, enter 172.17.1.0/24.
   • Next Hop Type: Select Physical Connection Interface.
   • Next Hop: Select the physical connection you established in Step 1.
5. Click OK.

Step 4: Configure health checks

To configure health checks, follow these steps:

1. Log on to the CEN console.
2. In the left-side navigation pane, click Health Check.
3. Select the region of the target CEN instance. In this example, select China (Hangzhou). Then, click Set Health Check.
4. On the Set Health Check page, configure health checks as follows:
   • Instances: Select the CEN instance with which the VBR is associated.
   • Virtual Border Router (VBR): Select the VBR to be monitored.
   • Source IP: Enter an idle IP address under the VSwitch of the connected VPC, for example, 172.16.1.2.
   • Destination IP: Enter the interface IP address of the network device at the on-premises data center, for example, 10.0.0.2.

Step 5: Configure routes for the on-premises data center

After you complete the preceding steps, the route configurations on Alibaba Cloud are completed. You must configure a route pointing to the VPC on the network device of the on-premises data center. You can configure a static route or BGP route to forward traffic from the on-premises data center to the VBR.

1. Configure a static route or BGP dynamic route on the gateway device of the on-premises data center.
   • The following is an example of a static route and is for reference only. Configurations for devices of different manufacturers are different.

     ip route 172.16.0.0 255.255.0.0 10.0.0.1

   • You can also configure a BGP route. For more information, see Configure BGP.

     The CIDR block to be advertised is the CIDR block of the VPC that needs to communicate with the on-premises data center. The IP address of the next hop, namely, the VBR, is 10.0.0.1. In this example, the CIDR block of the VPC is 172.16.0.0/16.

2. On the local gateway device, ping the IP address of the VBR to check the connectivity.
   Run the ping command ping 10.0.0.1. If the ping test succeeds, the physical connection between the local gateway and Alibaba Cloud is successful.
3. Run the following command to add a default route that points to the local gateway on the local server:

   route add default gw 172.17.1.1

Step 6: Test the connectivity from the local server

To test the connectivity between the local server and Alibaba Cloud, follow these steps:

1. Open the command prompt on the server of the on-premises data center.
2. Run the ping command to ping the IP address of the VBR 10.0.0.1. If the ping test succeeds, the physical connection from the local server to Alibaba Cloud is successful.

Step 7: Test the connectivity from the ECS instance

Make sure that an ECS instance is created. IP addresses of ECS instances are dynamically allocated. Use the actual internal IP address of the ECS instance in this step. In this example, the IP address of the ECS instance is 172.16.1.1.

1. Open the command prompt on the local server.
2. Run the ping command ping 172.16.1.1.
3. Open the command prompt on the ECS instance.
4. Run the ping command ping 172.17.1.2. If the ping test succeeds, the physical connection between the local server and the ECS instance is successful.