Before you create VPC networks and VSwitches, you must determine the number and CIDR blocks of VPC networks and VSwitches based on your actual requirements.
- How many VPC networks are required?
- How many VSwitches are required?
- How do I specify CIDR blocks?
- How do I specify CIDR blocks if I want to connect a VPC network to other VPC networks or on-premises data centers?
How many VPC networks are required?
One VPC network
We recommend that you create one VPC network if you do not need to deploy systems across regions or separate these systems by using VPC networks.
Multiple VPC networksWe recommend that you create multiple VPC networks in any of the following scenarios:
- Deploy application systems across multiple regions
VPC networks are region-specific resources. You cannot deploy VPC networks across regions. If you want to deploy your application systems in different regions, you must create multiple VPC networks. You can use Express Connect, VPN Gateway, or Cloud Enterprise Network to connect your VPC networks.
Separate different application systems
To separate different application systems, you must create multiple VPC networks. The following figure shows an example of deploying the production environment and the test environment in two VPC networks.
- Deploy application systems across multiple regions
How many VSwitches are required?
We recommend that you create at least two VSwitches for each VPC network and deploy the VSwitches in different zones for cross-region disaster recovery.
We also recommend that you check the network latency between different zones in the same region after you deploy your application systems. The network latency may be higher than expected due to complicated systems calls or cross-zone calls. We recommend that you optimize and adjust your systems to find a solution on maintaining both high availability and low latency.
The number of VSwitches required in the deployment also depends on the system size and application system planning. If your frontend systems require disaster recovery and communications with the Internet, you can connect the frontend systems to different VSwitches and the backend systems to other VSwitches.
How do I specify CIDR blocks?
- CIDR blocks of VPC networks
You can use 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, and the subsets of these CIDR blocks as the CIDR blocks of your VPC networks. To plan the CIDR blocks of VPC networks, follow these rules:
- If you have only one VPC network that does not need to communicate with on-premises data centers, you can use any of the preceding CIDR blocks or their subnets.
- If you have multiple VPC networks, or you want to build a hybrid cloud that consists of VPC networks and on-premises data centers, you can use a subset of the preceding CIDR blocks as the CIDR block for your VPC network. In this case, the mask cannot be longer than 16 bits.
- You must check whether a classic network is used before you specify the CIDR block for your VPC network. If you plan to connect ECS instances in a classic network to your VPC network, we recommend that you do not use the CIDR block 10.0.0.0/8. This CIDR block is used by the classic network.
- CIDR blocks of VSwitches
The CIDR block of a VSwitch must be a subset of the CIDR block of the VPC network to which the VSwitch belongs. If the CIDR block of a VPC network is 192.168.0.0/16, the CIDR block of the VSwitch that belongs to the VPC network can be from 192.168.0.0/17 to 192.168.0.0/29.
To plan CIDR blocks of VSwitches, follow these rules:
- A VSwitch CIDR block with the mask ranging from 16-bit to 29-bit can provide 8 to 65536 IP addresses. This range is set because a 16-bit mask can provide IP addresses to support 65,532 ECS instances, but a mask smaller than 29 bits cannot provide sufficient IP addresses.
- The first IP address and the last three IP addresses of each VSwitch CIDR block are reserved for the system. For example, if the CIDR block of a VSwitch is 192.168.1.0/24, the IP addresses 192.168.1.0, 192.168.1.253, 192.168.1.254, and 192.168.1.255 are reserved.
- The ClassicLink feature allows ECS instances in a classic network to communicate with ECS instances in a VPC network whose CIDR blocks are 192.168.0.0/16, 10.0.0.0/8, and 172.16.0.0/12. If you want to connect an ECS instance of a VSwitch in a VPC network to an ECS instance in the classic network, and the CIDR block of the VPC network is 10.0.0.0/8, the CIDR block of the VSwitch must be 10.111.0.0/16. For more information, see Overview.
- When you plan the CIDR block of a VSwitch, you must also check the number of ECS instances in the VSwitch.
How do I specify CIDR blocks if I want to connect a VPC network to other VPC networks or on-premises data centers?
To connect a VPC network to other VPC networks or on-premises data centers, make sure that the CIDR block of the VPC network does not overlap with that of the target network.
In this example, VPC1 and VPC2 have different CIDR blocks configured. VPC2 and VPC3 have the same CIDR block configured, because currently VPC3 does not need to communicate with VPC1 or VPC2. However, the VSwitches in VPC2 and VPC3 use different CIDR blocks. This allows the two VPCs to communicate with each other in the future. VPC networks that need to communicate with each other can have the same CIDR block, but their VSwitches cannot have the same CIDR block.
When you specify the CIDR blocks for multiple VPC networks to allow them to communicate with other VPC networks or on-premises data centers, follow these rules:
- Try to specify different CIDR blocks for different VPC networks. You can use the subsets of the standard CIDR blocks to increase the number of available CIDR blocks for VPC networks.
- If you cannot specify different CIDR blocks for different VPC networks, try to use different CIDR blocks for VSwitches of different VPC networks.
- If you cannot use different CIDR blocks for all VSwitches of different VPC networks, make sure that the VSwitches that need to communicate with each other use different CIDR blocks.