When you connect a data center to a virtual private cloud (VPC) on Alibaba Cloud by using two Express Connect circuits and establishing connections between virtual border routers (VBRs) and the VPC in Express Connect, you must configure health checks for the data center and VBRs to test the connectivity of the Express Connect circuits. If one of the Express Connect circuits is declared unhealthy, the system automatically routes network traffic over the other Express Connect circuit that works as expected.
Background information
By default, Alibaba Cloud sends a probe packet every two seconds over an Express Connect circuit from the source IP address to the destination IP address in a data center. If the probe packet is returned, the Express Connect circuit works as expected. If no responses are returned for eight consecutive probe packets, the Express Connect circuit is down.
Make sure that responses for probe packets can be returned from the destination IP address. Do not limit the probe packet rate or block probe packets.
If you create a VBR-to-VPC connection, you can use one of the following methods to configure health checks:
Add a static route to the VBR
If you use this method, you must configure the source IP address of health checks on the VBR. The subnet mask of this source IP address is 32 bits in length. From the perspective of the return route, the next hop of the route on the VBR is the corresponding VPC. You must also manually configure a route that points to the corresponding Express Connect circuit in the data center. The source IP address of this route is the source IP address of health checks, and the subnet mask of this source IP address is 32 bits in length.
Configure BGP routing for the VBR
If you use this method, you must configure the source IP address of health checks on the VBR. The subnet mask of this source IP address is 32 bits in length. From the perspective of the return route, the next hop of the route on the VBR is the corresponding VPC. Then, you must advertise the Border Gateway Protocol (BGP) CIDR block of the VPC on the VBR.
If throttling such as Control Plane Policing (CoPP) on Cisco devices or local attack defense is enabled for the gateway devices in the data center, probe packets may be dropped. As a result, the system may frequently switch between the two Express Connect circuits. We recommend that you disable CoPP throttling for the gateway devices in the data center.
Prerequisites
Equal-cost multi-path (ECMP) routing is configured by using two Express Connect circuits. For more information, see Configure ECMP between an on-premises data center and Alibaba Cloud, Establish active/standby connections between a data center and Alibaba Cloud, or Create active/standby connections and configure BGP routing.
Add a static route to the VBR
Configure health checks on a VBR
If you create a VBR-to-VPC connection across accounts, you must configure health checks for the VBR by using the acceptor account.
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, choose .
On the VBR-to-VPC page, find the peering connection that you want to manage and click Health Check in the Actions column.
In the Health Check panel, click Configure.
In the Edit VBR panel, configure the parameters that are described in the following table to configure health checks and click OK.
Parameter
Description
Network Type
The network type of the VBR. In this example, only IPv4 Routing is supported.
Source IP
An idle private IP address from the connected VPC.
Destination IP
The private IP address of the interface on the gateway device in the data center.
Send Packet Every (Seconds)
The interval at which probe packets are sent for health checks. Unit: seconds.
Default value: 2. Valid values: 2 to 3.
Packets Detected
The number of probe packets that are sent for health checks. Unit: packet.
Default value: 8. Valid values: 3 to 8.
Configure health checks in the data center
You must configure the return route of probe packets and health checks in the data center, and then configure the gateway device to route network traffic based on health check results to achieve network redundancy.
Configure the return route of probe packets in the data center.
ImportantBefore you configure health checks in the data center, you must configure the return route of probe packets in the data center.
The configuration commands may vary based on gateway devices. The following example is for reference only. For more information about the configuration commands, consult the vendor of your gateway device.
# Configure the return route of probe packets. ip route <Source IP address 1 for health checks> 255.255.255.255 <IP address 1 of the VBR> ip route <Source IP address 2 for health checks> 255.255.255.255 <IP address 2 of the VBR>
Configure health checks in the data center.
You can configure Bidirectional Forwarding Detection (BFD) or Network Quality Analyzer (NQA) on the gateway device in the data center to test the reachability of routes destined for VBRs. For more information about the configuration commands, consult the vendor of your gateway device.
Configure the gateway device to route network traffic based on health check results.
The configuration may vary based on the network environment. For more information about the configuration commands, consult the vendor of your gateway device.
Configure BGP routing for the VBR
Configure health checks on a VBR
If you create a VBR-to-VPC connection across accounts, you must configure health checks for the VBR by using the acceptor account.
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, choose .
On the VBR-to-VPC page, find the peering connection that you want to manage and click Health Check in the Actions column.
In the Health Check panel, click Configure.
In the Edit VBR panel, configure the parameters that are described in the following table to configure health checks and click OK.
Parameter
Description
Network Type
The network type of the VBR. In this example, only IPv4 Routing is supported.
Source IP
An idle private IP address from the connected VPC.
Destination IP
The private IP address of the interface on the gateway device in the data center.
Send Packet Every (Seconds)
The interval at which probe packets are sent for health checks. Unit: seconds.
Default value: 2. Valid values: 2 to 3.
Packets Detected
The number of probe packets that are sent for health checks. Unit: packet.
Default value: 8. Valid values: 3 to 8.
Add a route that points to the VPC to the VBR
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, click Virtual Border Routers (VBRs).
On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.
On the details page of the VBR, click the tab and then the Custom Route Entry tab. Then, click Add Route.
In the Add Route panel, configure the parameters that are described in the following table and click OK.
Parameter
Description
Next Hop Type
The type of the next hop.
In this example, VPC is selected.
Destination CIDR Block
The destination CIDR block.
In this example, the CIDR block of the source IP addresses for health checks is entered. The subnet masks of the source IP addresses are 32 bits in length. Example: 192.168.0.1/32.
Next Hop
The instance that is used as the next hop.
In this example, the destination VPC is selected.
Description
The description of the route.
Advertise the BGP CIDR block on the VBR
Before you advertise the BGP CIDR block on the VBR, make sure that a route that points to the VPC is configured for the VBR.
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, click Virtual Border Routers (VBRs).
On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.
On the details page of the VBR, click the Advertised BGP Subnets tab, and then click Advertise BGP Subnet.
In the Advertise BGP Subnet panel, enter the CIDR block of the source IP addresses for health checks in the Advertised Subnet field and click OK. The subnet masks of the source IP addresses are 32 bits in length. Example: 192.168.0.1/32.
What to do next
Clear health check settings
You can clear the settings of health checks that are configured on VBRs.
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, choose .
On the VBR-to-VPC page, find the peering connection that you want to manage and click in the Actions column.
In the Health Check panel, click Clear. In the Clear Health Check Settings message, click OK.
Configure alert rules about health checks in the CloudMonitor console
Log on to the CloudMonitor console.
In the left-side navigation pane, choose .
On the Alert Rules page, click Create Alert Rule.
In the Create Alert Rule panel, select Express Connect - Peering Connections, Express Connect - VBR, or Express Connect - Physical Connections from the Product drop-down list, configure the parameters that are described in the following table, and then click OK.
The following table describes only the parameters that are relevant to this topic. For more information about how to configure other parameters, see Create an alert rule.
Click Add Rule. In the Config Rule Description panel, configure the parameters that are described in the following table and click OK.
Parameter
Description
Alert Rule
The name of the threshold-triggered alert rule.
Metric Type
The metric type of the threshold-triggered alert rule. In this example, Single Metric is selected. For more information about how to configure multiple metrics and dynamic thresholds, see Create an alert template. Valid values:
Single Metric
Multiple Metrics
Smart Threshold
Metric
The metric that you want to monitor. The following content describes the metrics for peering connections, VBRs, and physical connections:
Express Connect - Peering Connections
RouterInterfaceLossRate: the packet loss rate monitored by health checks between the Express Connect circuit and the VPC.
RouterInterfaceResponseTime: the network latency monitored by health checks between the Express Connect circuit and the VPC. Unit: millisecond.
Express Connect - VBR
VbrHealthyCheckLatency: the network latency monitored by health checks between the Express Connect circuit and the VBR. Unit: microsecond.
VbrHealthyCheckLossRate: the packet loss rate monitored by health checks between the Express Connect circuit and the VBR.
Express Connect - Physical Connections
PhysicalConnectionStatus: the connection status of the Express Connect circuit.
Threshold and Alert Level
The alert conditions, alert threshold, and alert level of the alert rule.
Chart Preview
The chart in which the monitoring data of the selected metric is displayed.
References
ModifyRouterInterfaceAttribute: modifies the configuration of a router interface.
DescribeRouterInterfaces: queries router interfaces in a region.
DescribeRouterInterfaceAttribute: queries the configuration of a router interface.
AddBgpNetwork: advertises a BGP network.