This topic describes how to access an Elastic Compute Service (ECS) instance in an Alibaba Cloud Virtual Private Cloud (VPC) from a server of an on-premises data center by using Express Connect.
If you need to access the cloud resources in a VPC from your on-premises data center by using a physical connection, you must add a route entry with the destination CIDR block 100.64.0.0/10 and the next hop of the target VPC in the corresponding Virtual Border Router (VBR). Also, you must add a route entry that points to 100.64.0.0/10 with the Alibaba Cloud-side IP address of the VBR as the next hop on the gateway device of your on-premises data center.
The CIDR block 100.64.0.0/10 is reserved for VPCs. It is used by the cloud services in VPCs, such as Domain Name System (DNS), Object Storage Service (OSS), and Log Service.
In this topic, the configurations of the VPC and on-premises data center shown in the following figure are used as an example. Assume that your on-premises data center (CIDR block: 172.17.1.0/24) is located in Hangzhou. You have a VPC (CIDR block: 172.16.0.0/16) in the China (Hangzhou) region. You want to use a physical connection to access an ECS instance (IP address: 172.16.1.1) in the VPC from a server (IP address: 172.17.1.2) at the on-premises data center.
|CIDR block of the VPC||172.16.0.0/16|
|CIDR block of the VSwitch||172.16.0.0/24|
|IP address of the ECS instance||172.16.1.1/24|
|CIDR block of the on-premises data center||172.17.1.0/24|
|IP addresses used for the connection||
|IP address of the local server||172.17.1.2/24|
|IP addresses used for health checks||
Step 1: Establish a physical connection
You can establish an exclusive physical connection by applying for a physical connection interface in the Express Connect console yourself or establish a shared physical connection by using a shared port of an Alibaba Cloud partner. For more information, see Created a dedicated physical connection and Establish a shared physical connection.
In this example, configure the VBR associated with the physical connection as follows:
|Alibaba Cloud-side IP address||10.0.0.1|
|Customer-side IP address||10.0.0.2|
Step 2: Add the VPC and VBR to a CEN instance
After the physical connection is established, add the VBR and VPC to be connected to the same Cloud Enterprise Network (CEN) instance.
- Log on to the CEN console.
- On the Instances page, find the target CEN instance and click the instance ID.
Make sure that a CEN instance is created. For more information, see Create a CEN instance.
- On the Networks tab, click Attach Network and add the VBR to the CEN instance.
For more information, see Attach networks.
- Click Attach More to add the VPC to the CEN instance.
Step 3: Configure VBR routes
After you add the VBR and VPC to the same CEN instance, add a route pointing to the on-premises data center in the VBR.
- Log on to the Express Connect console.
- In the left-side navigation pane, choose . Find the target VBR and click the instance ID.
- On the VBR details page, click the Routes tab and then click Add route.
- In the Add Route dialog box that appears, configure the route as follows:
- Destination Subnet: Enter the CIDR block of the on-premises data center. In this example, enter 172.17.1.0/24.
- Next Hop Type: Select Physical Connection Interface.
- Next Hop: Select the physical connection you established in Step 1.
- Click OK.
Step 4: Configure health checks
To configure health checks, follow these steps:
- Log on to the CEN console.
- In the left-side navigation pane, click Health Check.
- Select the region of the target CEN instance. In this example, select China (Hangzhou). Then, click Set Health Check.
- On the Set Health Check page, configure health checks as follows:
- Instances: Select the CEN instance with which the VBR is associated.
- Virtual Border Router (VBR): Select the VBR to be monitored.
- Source IP: Enter an idle IP address under the VSwitch of the connected VPC, for example, 172.16.1.2.
- Destination IP: Enter the interface IP address of the network device at the on-premises data center, for example, 10.0.0.2.
Step 5: Configure routes for the on-premises data center
After you complete the preceding steps, the route configurations on Alibaba Cloud are completed. You must configure a route pointing to the VPC on the network device of the on-premises data center. You can configure a static route or BGP route to forward traffic from the on-premises data center to the VBR.
- Configure a static route or BGP dynamic route on the gateway device of the on-premises
- The following is an example of a static route and is for reference only. Configurations
for devices of different manufacturers are different.
ip route 172.16.0.0 255.255.0.0 10.0.0.1
- You can also configure a BGP route. For more information, see Configure BGP.
The CIDR block to be advertised is the CIDR block of the VPC that needs to communicate with the on-premises data center. The IP address of the next hop, namely, the VBR, is 10.0.0.1. In this example, the CIDR block of the VPC is 172.16.0.0/16.
- The following is an example of a static route and is for reference only. Configurations for devices of different manufacturers are different.
- On the local gateway device, ping the IP address of the VBR to check the connectivity.
Run the ping command
ping 10.0.0.1. If the ping test succeeds, the physical connection between the local gateway and Alibaba Cloud is successful.
- Run the following command to add a default route that points to the local gateway
on the local server:
route add default gw 172.17.1.1
Step 6: Test the connectivity from the local server
To test the connectivity between the local server and Alibaba Cloud, follow these steps:
- Open the command prompt on the server of the on-premises data center.
- Run the ping command to ping the IP address of the VBR 10.0.0.1. If the ping test succeeds, the physical connection from the local server to Alibaba Cloud is successful.
Step 7: Test the connectivity from the ECS instance
Make sure that an ECS instance is created. IP addresses of ECS instances are dynamically
allocated. Use the actual internal IP address of the ECS instance in this step. In
this example, the IP address of the ECS instance is
- Open the command prompt on the local server.
- Run the ping command
- Open the command prompt on the ECS instance.
- Run the ping command
ping 172.17.1.2. If the ping test succeeds, the physical connection between the local server and the ECS instance is successful.