Virtual Private Cloud (VPC) provides an isolated virtual network. This allows you to manage cloud resources in a secure environment based on tunneling technology. Each VPC is identified by a unique tunnel ID.


The continuous development of cloud computing technologies leads to more demanding requirements for virtual networks, such as scalability, security, reliability, privacy, and robust connectivity performance. This scenario has hastened the birth of various virtualization network technologies.

Earlier solutions combined virtual and physical networks to generate a flat network architecture, such as large-scale Layer-2 networks. As the scale of virtual networks grew, earlier solutions faced more serious problems. A few notable problems include ARP spoofing, broadcast storms, and host scanning. Various network isolation technologies emerged to resolve these problems by completely isolating the physical networks from the virtual networks. One of the technologies utilizes VLAN to isolate users, but VLAN can support only up to 4096 users. It cannot support the large number of users in the cloud computing scenario.


VPC provides an isolated virtual network to manage cloud resources in a secure environment based on tunneling technology. Each VPC is identified by a unique tunnel ID. Data packets are encapsulated with a unique tunnel ID and transmitted over the physical network between Elastic Compute Service (ECS) instances in a VPC. In different VPCs, ECS instances with different tunnel IDs are located on two different routing planes. Therefore, these ECS instances cannot communicate with each other.

Based on the tunneling and Software Defined Network (SDN) technologies, Alibaba Cloud has developed VPCs that are integrated with gateways and VSwitches.

Logic architecture

The following figure shows that a VPC consists of a gateway, a controller, and one or more VSwitches. The VSwitches and gateways form a key data path. By using a protocol developed by Alibaba Cloud, the controller distributes the forwarding table to the gateway and VSwitches to provide a key configuration path. In the overall architecture, the configuration path and data path are separated from each other. VSwitches are distributed nodes. The gateway and controller are deployed in clusters. Multiple data centers are built for backup and disaster recovery. Redundant links are provided for disaster recovery. This deployment mode improves the overall availability of the VPC.

Logical architecture