Cloud Enterprise Network:Connect VPCs across accounts

Scenario

Suppose you have two Alibaba Cloud accounts:

• Account A: has two VPCs (VPC1 and VPC2) and one CEN (CEN1).

• Account B has a VPC (VPC3).

VPC1 and VPC2 are already attached to CEN1 and can communicate with each other, as described in Communication between VPCs in the same region.

The goal is to attach VPC3 to CEN1 so all three VPCs can communicate.

Network plan for the three VPCs:

The steps in this guide apply to any valid IPv4 CIDR block, including non-RFC 1918 ranges such as 8.x.x.x and 121.x.x.x. The example scenario uses 10.0.0.0/16, 172.16.0.0/16, and 192.168.0.0/16, but the procedure works regardless of which CIDR blocks your VPCs use. The only requirement is that the CIDR blocks of the VPCs you want to connect must not overlap.

Procedure

This is a two-step process:

• Log on to Account B and grant Account A authorization to attach VPC3 to CEN1.

• Log on to Account A and attach VPC3 to CEN1.

Verify the connection

1. Ensure that the security group rules for all three ECS instances allow inbound ICMP traffic.

2. Log on to ECS3 in Account B and run ping to reach ECS1:

   ping 10.0.0.1

   [root@iZbp xxx ~]# ping 10.0.0.1
   PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
   64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=0.580 ms
   64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=0.421 ms
   64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=0.281 ms
   64 bytes from 10.0.0.1: icmp_seq=4 ttl=63 time=0.295 ms
   64 bytes from 10.0.0.1: icmp_seq=5 ttl=63 time=0.296 ms
   64 bytes from 10.0.0.1: icmp_seq=6 ttl=63 time=0.247 ms
   64 bytes from 10.0.0.1: icmp_seq=7 ttl=63 time=0.269 ms

   A successful ping confirms that VPC3 and VPC1 can communicate. Run ping 172.16.0.1 to verify connectivity between VPC3 and VPC2.

Routing

When the VPC attachment is created, the system automatically configures routing based on three advanced features enabled by default:

Three options are enabled by default: Associate with default route table of transit router (associates the VPC connection with the transit router's default route table), Propagate system routes to default route table of transit router (advertises VPC system routes to the transit router, enabling communication with other attached network instances), and Automatically create route that points to transit router and add to all route tables of current VPC (adds three routes — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — to all VPC route tables, with next hops pointing to the transit router; by default, transit routers do not advertise routes to VPCs). To customize routing, clear these checkboxes and configure route associations and propagation manually. See Route management.

FAQ