Cloud Enterprise Network (CEN) is a highly available network that runs on the Alibaba Cloud private global network. Through a transit router (TR) in each region, CEN establishes private communication channels between VPCs across regions and between VPCs and on-premises data centers. You can use these channels to build a large-scale enterprise cloud network.
Components
The CEN components work together in a hierarchy. You create a CEN instance, and then you create one transit router in each region of the CEN instance. Network instances attach to a transit router through network instance connections, and cross-region connections link transit routers in different regions. Each transit router forwards traffic from the connected network instances by looking up its route table.
| Component diagram | Component | Description |
 | CEN instance | A CEN instance is the foundational resource for creating and managing an integrated intelligent cloud network. It serves as the container for transit routers and can contain one or more transit routers. |
 | Transit router (TR) | A transit router is the core forwarding element within a region. It forwards intra-region and cross-region traffic and supports flexible routing policies. Within a CEN instance, you can create one transit router in each region. |
 | Network instance | A network instance is a key component of a cloud or on-premises network architecture. Common network instances include Virtual Private Cloud (VPC), Express Connect Router (ECR), Cloud Connect Network (CCN), IPsec connection, Virtual Border Router (VBR), and transit router (TR). You connect a network instance to a transit router to enable communication between different network environments. |
 | Network instance connection | When a network instance is connected to a transit router, a network instance connection is formed. You can create network instance connections on a TR to enable resource interconnect in the cloud, cross-region resource interconnect, and resource interconnect between the cloud and on-premises data centers. To connect different network instance types, create the corresponding connection on the TR: VPC connection, ECR connection, CCN connection, VPN connection, VBR connection, and Inter-region connections. |
 | TR route table | After a network instance is connected to a TR, the TR forwards traffic from the network instance by looking up a route table. A TR includes a system route table by default and supports custom route tables. You can use route association and route learning to define communication, isolation, and traffic-steering policies that meet diverse networking requirements. |
Use cases
You can use CEN to connect networks in the following scenarios:
VPC communication within the same region: Connect multiple VPCs in the same region.
Cross-region VPC communication: Connect VPCs in different regions.
Cloud-to-on-premises communication: Connect multiple VPCs in the cloud to an on-premises data center.
In addition to network interconnection, you can use transit router capabilities in the following scenarios:
Filter VPC Access traffic: Use the route management capabilities of a transit router to direct VPC Access traffic to a security control server for traffic filtering. Only filtered traffic can communicate with each other, which improves network security. For more information, see Secure traffic exchange with an Enterprise transit router.
Allow isolated VPCs to use shared services: Use the route management capabilities of a transit router to allow isolated VPCs to access the same shared service. For more information, see Isolate VPCs and access shared services.
Cross-region QoS: Use traffic scheduling to add markers to different types of cross-region traffic and apply bandwidth limits to each traffic type based on marker values. This helps ensure cross-region bandwidth for different services and improves overall network efficiency. For more information, see Basic rate limiting QoS.
Cross-region network traffic analysis: A transit router provides flow logs. Flow logs help you capture traffic information transmitted by transit router instances and network instance connections, including cross-region connections, VPC connections, VPN connections, ECR connections, and VBR connections. For more information, see Flow logs.
Cloud multicast: After you connect network instances to a TR, you can create and manage a multicast network and use the TR as a multicast router to forward multicast traffic between network instances. For more information, see Manage multicast.
Benefits
CEN provides the following benefits:
| Large-scale global network interconnection | Low latency and high speed | High reliability and quality |
| Transit routers connect VPCs and on-premises data centers in multiple regions to enable global resource interconnect. In the same region, an Enterprise Edition transit router supports the interconnection of 1,000 VPCs to meet the needs of growing enterprise networks. | For resource interconnect within the same region, the maximum speed can reach the port forwarding rate of network devices. For global resource interconnect, overall network latency is much lower than that of public network communication, and the advantage is more apparent for cross-border links. In non-cross-border scenarios, such as communication within the same region or across regions within the Chinese mainland, latency is limited by physical distance and the advantage is not apparent. CEN provides private network peering between VPCs, not a wide area network acceleration service. | Transit routers support multi-zone deployment of forwarding nodes. Under normal conditions, traffic is forwarded through the nearest node. If a failure occurs, an automatic switchover redirects traffic to another zone to keep services uninterrupted. Multiple groups of transmission links connect any two nodes in the network. If an underlying link is interrupted, the network automatically converges without disrupting services. |
| Secure and flexible enterprise-grade networking | Pay-as-you-go and rapid delivery | One-stop O&M |
| Transit routers support custom routing policies. For example, you can isolate different security domains, configure a unified egress for demilitarized zones (DMZ), and build service chaining architectures. | Transit routers support pay-as-you-go billing. For resource interconnect within the same region, you pay only for connected network instances and traffic processed by transit routers. Cross-region links can be provisioned and reconfigured without fixed investments in equipment or circuits, which reduces network construction costs. | The console provides visualization management interfaces based on geographic locations and network resources. You can use these interfaces to view network topologies within and across regions, understand the operating status of the entire network, and improve O&M efficiency. |
Get started with Cloud Enterprise Network
You can get started with CEN in the following ways:
For console-based operations, use Connect VPCs in the same region.
Regions and zones supported by transit routers
For a complete list of the regions and zones that support transit routers, see Available regions and zones.
Packet loss and cross-border transmission
Alibaba Cloud provides a high-performance, low-latency private network that offers a secure cloud computing environment. During network transmission, network packets can be lost for various reasons, including network flow collisions, errors in the underlying network data-link layer, and other network failures. For its transmission network, Alibaba Cloud sets an operational target of a P99 hourly packet loss rate below 0.0001% for cross-region data transfers.
When you use CEN, note the following:
Only the traffic that you transfer through CEN travels over the Alibaba Cloud transmission network. If you transfer traffic between regions through CEN and have purchased sufficient bandwidth, CEN can minimize packet loss for your network.
The dedicated line that connects the Chinese mainland with overseas regions is provided by China Unicom. The same packet loss target applies to this dedicated line.