This topic describes how to access an Elastic Compute Service (ECS) instance in an Alibaba Cloud Virtual Private Cloud (VPC) from a server of an on-premises data center by using Express Connect.
Background information
If you need to access the cloud resources in a VPC from your on-premises data center by using a physical connection, you must add a route entry with the destination CIDR block 100.64.0.0/10 and the next hop of the target VPC in the corresponding Virtual Border Router (VBR). Also, you must add a route entry that points to 100.64.0.0/10 with the Alibaba Cloud-side IP address of the VBR as the next hop on the gateway device of your on-premises data center.
The CIDR block 100.64.0.0/10 is reserved for VPCs. It is used by the cloud services in VPCs, such as Domain Name System (DNS), Object Storage Service (OSS), and Log Service.
Background information
In this topic, the configurations of the VPC and on-premises data center shown in the following figure are used as an example. Assume that your on-premises data center (CIDR block: 172.17.1.0/24) is located in Hangzhou. You have a VPC (CIDR block: 172.16.0.0/16) in the China (Hangzhou) region. You want to use a physical connection to access an ECS instance (IP address: 172.16.1.1) in the VPC from a server (IP address: 172.17.1.2) at the on-premises data center.

Parameter | Value |
---|---|
CIDR block of the VPC | 172.16.0.0/16 |
CIDR block of the VSwitch | 172.16.0.0/24 |
IP address of the ECS instance | 172.16.1.1/24 |
CIDR block of the on-premises data center | 172.17.1.0/24 |
IP addresses used for the connection |
|
IP address of the local server | 172.17.1.2/24 |
IP addresses used for health checks |
|
Step 1: Establish a physical connection
You can establish an exclusive physical connection by applying for a physical connection interface in the Express Connect console yourself or establish a shared physical connection by using a shared port of an Alibaba Cloud partner. For more information, see Created a dedicated physical connection and Establish a shared physical connection.
In this example, configure the VBR associated with the physical connection as follows:
Configuration | Value |
---|---|
VLANID | 0 |
Alibaba Cloud-side IP address | 10.0.0.1 |
Customer-side IP address | 10.0.0.2 |
Subnet mask | 255.255.255.252 |
Step 2: Add the VPC and VBR to a CEN instance
After the physical connection is established, add the VBR and VPC to be connected to the same Cloud Enterprise Network (CEN) instance.
Step 3: Configure VBR routes
After you add the VBR and VPC to the same CEN instance, add a route pointing to the on-premises data center in the VBR.
Step 4: Configure health checks
To configure health checks, follow these steps:
Step 5: Configure routes for the on-premises data center
After you complete the preceding steps, the route configurations on Alibaba Cloud are completed. You must configure a route pointing to the VPC on the network device of the on-premises data center. You can configure a static route or BGP route to forward traffic from the on-premises data center to the VBR.
Step 6: Test the connectivity from the local server
To test the connectivity between the local server and Alibaba Cloud, follow these steps:
- Open the command prompt on the server of the on-premises data center.
- Run the ping command to ping the IP address of the VBR 10.0.0.1. If the ping test succeeds, the physical connection from the local server to Alibaba Cloud is successful.
Step 7: Test the connectivity from the ECS instance
Make sure that an ECS instance is created. IP addresses of ECS instances are dynamically
allocated. Use the actual internal IP address of the ECS instance in this step. In
this example, the IP address of the ECS instance is 172.16.1.1
.
- Open the command prompt on the local server.
- Run the ping command
ping 172.16.1.1
. - Open the command prompt on the ECS instance.
- Run the ping command
ping 172.17.1.2
. If the ping test succeeds, the physical connection between the local server and the ECS instance is successful.