All Products
Search
Document Center

Express Connect:Configure and manage health checks

Last Updated:Mar 19, 2024

When you connect a data center to a virtual private cloud (VPC) on Alibaba Cloud by using two Express Connect circuits and establishing connections between virtual border routers (VBRs) and the VPC in Express Connect, you must configure health checks for the data center and VBRs to test the connectivity of the Express Connect circuits. If one of the Express Connect circuits is declared unhealthy, the system automatically routes network traffic over the other Express Connect circuit that works as expected.

Background information

By default, Alibaba Cloud sends a probe packet every two seconds over an Express Connect circuit from the source IP address to the destination IP address in a data center. If the probe packet is returned, the Express Connect circuit works as expected. If no responses are returned for eight consecutive probe packets, the Express Connect circuit is down.

Warning

Make sure that responses for probe packets can be returned from the destination IP address. Do not limit the probe packet rate or block probe packets.

If you create a VBR-to-VPC connection, you can use one of the following methods to configure health checks:

  • Add a static route to the VBR

    If you use this method, you must configure the source IP address of health checks on the VBR. The subnet mask of this source IP address is 32 bits in length. From the perspective of the return route, the next hop of the route on the VBR is the corresponding VPC. You must also manually configure a route that points to the corresponding Express Connect circuit in the data center. The source IP address of this route is the source IP address of health checks, and the subnet mask of this source IP address is 32 bits in length.

  • Configure BGP routing for the VBR

    If you use this method, you must configure the source IP address of health checks on the VBR. The subnet mask of this source IP address is 32 bits in length. From the perspective of the return route, the next hop of the route on the VBR is the corresponding VPC. Then, you must advertise the Border Gateway Protocol (BGP) CIDR block of the VPC on the VBR.

Note

If throttling such as Control Plane Policing (CoPP) on Cisco devices or local attack defense is enabled for the gateway devices in the data center, probe packets may be dropped. As a result, the system may frequently switch between the two Express Connect circuits. We recommend that you disable CoPP throttling for the gateway devices in the data center.

配置健康检查

Prerequisites

Equal-cost multi-path (ECMP) routing is configured by using two Express Connect circuits. For more information, see Configure ECMP between an on-premises data center and Alibaba Cloud, Establish active/standby connections between a data center and Alibaba Cloud, or Create active/standby connections and configure BGP routing.

Add a static route to the VBR

Configure health checks on a VBR

Note

If you create a VBR-to-VPC connection across accounts, you must configure health checks for the VBR by using the acceptor account.

  1. Log on to the Express Connect console.

  2. In the top navigation bar, select a region. In the left-side navigation pane, choose VPC Peering Connections > VBR-to-VPC.

  3. On the VBR-to-VPC page, find the peering connection that you want to manage and click Health Check in the Actions column.

  4. In the Health Check panel, click Configure.

  5. In the Edit VBR panel, configure the parameters that are described in the following table to configure health checks and click OK.

    Parameter

    Description

    Network Type

    The network type of the VBR. In this example, only IPv4 Routing is supported.

    Source IP

    An idle private IP address from the connected VPC.

    Destination IP

    The private IP address of the interface on the gateway device in the data center.

    Send Packet Every (Seconds)

    The interval at which probe packets are sent for health checks. Unit: seconds.

    Default value: 2. Valid values: 2 to 3.

    Packets Detected

    The number of probe packets that are sent for health checks. Unit: packet.

    Default value: 8. Valid values: 3 to 8.

Configure health checks in the data center

You must configure the return route of probe packets and health checks in the data center, and then configure the gateway device to route network traffic based on health check results to achieve network redundancy.

  1. Configure the return route of probe packets in the data center.

    Important

    Before you configure health checks in the data center, you must configure the return route of probe packets in the data center.

    The configuration commands may vary based on gateway devices. The following example is for reference only. For more information about the configuration commands, consult the vendor of your gateway device.

    # Configure the return route of probe packets.
    ip route <Source IP address 1 for health checks> 255.255.255.255 <IP address 1 of the VBR>
    ip route <Source IP address 2 for health checks> 255.255.255.255 <IP address 2 of the VBR>
  2. Configure health checks in the data center.

    You can configure Bidirectional Forwarding Detection (BFD) or Network Quality Analyzer (NQA) on the gateway device in the data center to test the reachability of routes destined for VBRs. For more information about the configuration commands, consult the vendor of your gateway device.

  3. Configure the gateway device to route network traffic based on health check results.

    The configuration may vary based on the network environment. For more information about the configuration commands, consult the vendor of your gateway device.

Configure BGP routing for the VBR

Configure health checks on a VBR

Note

If you create a VBR-to-VPC connection across accounts, you must configure health checks for the VBR by using the acceptor account.

  1. Log on to the Express Connect console.

  2. In the top navigation bar, select a region. In the left-side navigation pane, choose VPC Peering Connections > VBR-to-VPC.

  3. On the VBR-to-VPC page, find the peering connection that you want to manage and click Health Check in the Actions column.

  4. In the Health Check panel, click Configure.

  5. In the Edit VBR panel, configure the parameters that are described in the following table to configure health checks and click OK.

    Parameter

    Description

    Network Type

    The network type of the VBR. In this example, only IPv4 Routing is supported.

    Source IP

    An idle private IP address from the connected VPC.

    Destination IP

    The private IP address of the interface on the gateway device in the data center.

    Send Packet Every (Seconds)

    The interval at which probe packets are sent for health checks. Unit: seconds.

    Default value: 2. Valid values: 2 to 3.

    Packets Detected

    The number of probe packets that are sent for health checks. Unit: packet.

    Default value: 8. Valid values: 3 to 8.

Add a route that points to the VPC to the VBR

  1. Log on to the Express Connect console.

  2. In the top navigation bar, select a region. In the left-side navigation pane, click Virtual Border Routers (VBRs).

  3. On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.

  4. On the details page of the VBR, click the Routes tab and then the Custom Route Entry tab. Then, click Add Route.

  5. In the Add Route panel, configure the parameters that are described in the following table and click OK.

    Parameter

    Description

    Next Hop Type

    The type of the next hop.

    In this example, VPC is selected.

    Destination CIDR Block

    The destination CIDR block.

    In this example, the CIDR block of the source IP addresses for health checks is entered. The subnet masks of the source IP addresses are 32 bits in length. Example: 192.168.0.1/32.

    Next Hop

    The instance that is used as the next hop.

    In this example, the destination VPC is selected.

    Description

    The description of the route.

Advertise the BGP CIDR block on the VBR

Note

Before you advertise the BGP CIDR block on the VBR, make sure that a route that points to the VPC is configured for the VBR.

  1. Log on to the Express Connect console.

  2. In the top navigation bar, select a region. In the left-side navigation pane, click Virtual Border Routers (VBRs).

  3. On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.

  4. On the details page of the VBR, click the Advertised BGP Subnets tab, and then click Advertise BGP Subnet.

  5. In the Advertise BGP Subnet panel, enter the CIDR block of the source IP addresses for health checks in the Advertised Subnet field and click OK. The subnet masks of the source IP addresses are 32 bits in length. Example: 192.168.0.1/32.

What to do next

Clear health check settings

You can clear the settings of health checks that are configured on VBRs.

  1. Log on to the Express Connect console.

  2. In the top navigation bar, select a region. In the left-side navigation pane, choose VPC Peering Connections > VBR-to-VPC.

  3. On the VBR-to-VPC page, find the peering connection that you want to manage and click Health Check in the Actions column.

  4. In the Health Check panel, click Clear. In the Clear Health Check Settings message, click OK.

Configure alert rules about health checks in the CloudMonitor console

  1. Log on to the CloudMonitor console.

  2. In the left-side navigation pane, choose Alerts > Alert Rules.

  3. On the Alert Rules page, click Create Alert Rule.

  4. In the Create Alert Rule panel, select Express Connect - Peering Connections, Express Connect - VBR, or Express Connect - Physical Connections from the Product drop-down list, configure the parameters that are described in the following table, and then click OK.

    The following table describes only the parameters that are relevant to this topic. For more information about how to configure other parameters, see Create an alert rule.

    Click Add Rule. In the Config Rule Description panel, configure the parameters that are described in the following table and click OK.

    Parameter

    Description

    Alert Rule

    The name of the threshold-triggered alert rule.

    Metric Type

    The metric type of the threshold-triggered alert rule. In this example, Single Metric is selected. For more information about how to configure multiple metrics and dynamic thresholds, see Create an alert template. Valid values:

    • Single Metric

    • Multiple Metrics

    • Smart Threshold

    Metric

    The metric that you want to monitor. The following content describes the metrics for peering connections, VBRs, and physical connections:

    • Express Connect - Peering Connections

      • RouterInterfaceLossRate: the packet loss rate monitored by health checks between the Express Connect circuit and the VPC.

      • RouterInterfaceResponseTime: the network latency monitored by health checks between the Express Connect circuit and the VPC. Unit: millisecond.

    • Express Connect - VBR

      • VbrHealthyCheckLatency: the network latency monitored by health checks between the Express Connect circuit and the VBR. Unit: microsecond.

      • VbrHealthyCheckLossRate: the packet loss rate monitored by health checks between the Express Connect circuit and the VBR.

    • Express Connect - Physical Connections

      PhysicalConnectionStatus: the connection status of the Express Connect circuit.

    Threshold and Alert Level

    The alert conditions, alert threshold, and alert level of the alert rule.

    Chart Preview

    The chart in which the monitoring data of the selected metric is displayed.

References