Create a routing policy using CreateCenRouteMap - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

Creates a route map for Cloud Enterprise Network (CEN) to filter route information and customize network connectivity management on Alibaba Cloud.

Operation description

Route maps are sorted by priority. A smaller priority value indicates a higher priority. Each route map is a collection of conditional statements and execution statements. When a policy is executed, routing starts matching conditional statements from the policy with the highest priority. For routing that meets all match conditions, the policy will permit or deny the routing based on the policy action. Modifying the route property is supported for permitted routing. For routing that does not meet all match conditions, the system permits the routing to pass by default. For more information, see Route map overview.

The CreateCenRouteMap operation is asynchronous. After you invoke this operation, the system returns a route map ID, but the route map is not immediately created. The creation node is still running in the background. You can invoke the DescribeCenRouteMaps operation to query the status of the route map.

If the route map is in the Creating state, the route map is being created. In this state, you can only execute query operations.
If the route map is in the Active state, the route map is created.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:CreateCenRouteMap

create

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
CenId	string	Yes	The Cloud Enterprise Network (CEN) instance ID.	cen-7qthudw0ll6jmc****
CenRegionId	string	Yes	The ID of the region where the route map is applied. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-hangzhou
TransmitDirection	string	Yes	The application direction of the route map. Valid values: RegionIn: the direction in which routes are transmitted to the regional gateway of the CEN instance. For example, routes are advertised from a network instance in a region to the regional gateway in the same region, or routes are advertised from another region to the regional gateway. RegionOut: the direction in which routes are transmitted from the regional gateway of the CEN instance. For example, routes are advertised from the regional gateway to a network instance in the same region, or to a regional gateway in another region. Valid values: RegionOut : The direction in which routes are transmitted from the regional gateway. RegionIn : The direction in which routes are transmitted to the regional gateway.	RegionIn
Description	string	No	The description of the route map. The description must be 1 to 256 characters in length, and cannot start with http:// or https://. The description can be left empty.	desctest
Priority	integer	Yes	The policy priority of the route map. Valid values: 1 to 100. A smaller value indicates a higher priority. Note The policy priority of each route map applied to the same region in the same direction must be unique. When the policy is executed, the system matches routing against the conditional statements of the policy with the smallest priority value first. Therefore, specify the policy priority based on the expected match order.	3
MapResult	string	Yes	The action to be performed when a route meets all match conditions. Valid values: Permit: permits the matched route. Deny: denies the matched route. Valid values: Permit : Permits the matched route. Deny : Denies the matched route.	Permit
NextPriority	integer	No	Policy priority of the next route map to be associated. You can set this parameter only when MapResult is set to Permit. Only permitted routes are matched against the next associated route map. The next route map to be associated must be applied to the same region and in the same direction as the current route map. Policy priority of the next route map to be associated must be lower than that of the current route map.	20
CidrMatchMode	string	No	The match mode of the prefix list. Valid values: Include: fuzzy match. A route meets the match condition if the route prefix in the match condition contains the prefix of the route. For example, if the match condition is 10.10.0.0/16, a route with the prefix 10.10.1.0/24 meets the condition. Complete: exact match. A route meets the match condition only if the route prefix in the match condition is exactly the same as the prefix of the route. For example, if the match condition is 10.10.0.0/16, only a route with the prefix 10.10.0.0/16 meets the condition. Valid values: Complete : Exact match. Include : Fuzzy match.	Include
AsPathMatchMode	string	No	The match mode of the AS path list. Valid values: Include: fuzzy match. A route meets the match condition if the AS path in the match condition overlaps with the AS path of the route. Complete: exact match. A route meets the match condition only if the AS path in the match condition is exactly the same as the AS path of the route. Valid values: Complete : Exact match. Include : Fuzzy match.	Include
CommunityMatchMode	string	No	The match mode of the community. Valid values: Include: fuzzy match. A route meets the match condition if the community in the match condition overlaps with the community of the route. Complete: exact match. A route meets the match condition only if the community in the match condition is exactly the same as the community of the route. Contain: contain match. A route meets the match condition only if the community of the route contains all communities specified in the match condition. Valid values: Complete : Exact match. Include : Fuzzy match. Contain : Contain match.	Include
CommunityOperateMode	string	No	The action mode of the community. Valid values: Additive: adds a community to the route. Replace: replaces the existing community of the route. This parameter specifies the action to be performed after a route meets the match conditions. Valid values: Replace : Replaces the existing community of the route. Additive : Adds a community to the route.	Additive
Preference	integer	No	The priority of the route to be modified. Valid values: 1 to 100. The default priority of a route is 50. A smaller value indicates a higher priority. This parameter specifies the action to be performed after a route meets the match conditions.	50
SourceInstanceIdsReverseMatch	boolean	No	Specifies whether to use the exclude match mode for the source instance ID list. Valid values: false (default): no. A route meets the match condition if the source instance ID of the route is in SourceInstanceIds.N. true: yes. A route meets the match condition if the source instance ID of the route is not in SourceInstanceIds.N.	false
DestinationInstanceIdsReverseMatch	boolean	No	Specifies whether to use the exclude match mode for the destination instance ID list. Valid values: false (default): no. A route meets the match condition if the destination instance ID of the route is in DestinationInstanceIds.N. true: yes. A route meets the match condition if the destination instance ID of the route is not in DestinationInstanceIds.N.	false
MatchAddressType	string	No	The IP address type of the routes to be matched. Valid values: IPv4: matches only IPv4 routes. IPv6: matches only IPv6 routes. If this parameter is left empty, all types of routes are matched.	IPv4
TransitRouterRouteTableId	string	No	The ID of the route table of the transit router. If you do not specify a route table ID, the route map is automatically associated with the default route table of the transit router.	vtb-gw8nx3515m1mbd1z1****
SourceInstanceIds	array	No	The list of source instance IDs to be matched. You can enter the IDs of the following types of instances: Virtual Private Cloud (VPC) instance IDs Virtual Border Router (VBR) instance IDs Cloud Connect Network (CCN) instance IDs Smart Access Gateway (SAG) instance IDs IPsec connection IDs You can enter up to 64 instance IDs.	vpc-adeg3544fdf34vf****
	string	No	The list of source instance IDs to be matched. You can enter the IDs of the following types of instances: Virtual Private Cloud (VPC) instance IDs Virtual Border Router (VBR) instance IDs Cloud Connect Network (CCN) instance IDs Smart Access Gateway (SAG) instance IDs IPsec connection IDs You can enter up to 64 instance IDs.	vpc-adeg3544fdf34vf****
DestinationInstanceIds	array	No	The list of destination instance IDs to be matched. You can enter the IDs of the following types of instances: Virtual Private Cloud (VPC) instance IDs Virtual Border Router (VBR) instance IDs Cloud Connect Network (CCN) instance IDs Smart Access Gateway (SAG) instance IDs IPsec connection IDs You can enter up to 64 instance IDs. Note The destination instance ID list takes effect only when the application direction of the route map is set to RegionOut and the destination instance IDs are the IDs of instances in the local region.	vpc-afrfs434465fdf****
	string	No	The list of destination instance IDs to be matched. You can enter the IDs of the following types of instances: Virtual Private Cloud (VPC) instance IDs Virtual Border Router (VBR) instance IDs Cloud Connect Network (CCN) instance IDs Smart Access Gateway (SAG) instance IDs IPsec connection IDs You can enter up to 64 instance IDs. Note The destination instance ID list takes effect only when the application direction of the route map is set to RegionOut and the destination instance IDs are the IDs of instances in the local region.	vpc-afrfs434465fdf****
SourceRouteTableIds	array	No	The list of source route table IDs to be matched. You can enter up to 64 route table IDs.	vtb-adfr233vf34rvd4****
	string	No	The list of source route table IDs to be matched. You can enter up to 64 route table IDs.	vtb-adfr233vf34rvd4****
DestinationRouteTableIds	array	No	The list of destination route table IDs to be matched. You can enter up to 64 route table IDs. Note The destination route table ID list takes effect only when the application direction of the route map is set to RegionOut and the destination route table IDs are the IDs of route tables of network instances in the local region.	vtb-adefrgtr144vf****
	string	No	The list of destination route table IDs to be matched. You can enter up to 64 route table IDs. Note The destination route table ID list takes effect only when the application direction of the route map is set to RegionOut and the destination route table IDs are the IDs of route tables of network instances in the local region.	vtb-adefrgtr144vf****
SourceRegionIds	array	No	The list of source region IDs to be matched. You can enter up to 64 region IDs. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-beijing
	string	No	The list of source region IDs to be matched. You can enter up to 64 region IDs. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-beijing
SourceChildInstanceTypes	array	No	The list of source instance types to be matched. The following instance types are supported: VPC: VPC instance. VBR: border router instance. CCN: CCN instance. VPN: VPN gateway instance or IPsec connection. If an IPsec connection or SSL server is attached to a VPN gateway instance, the VPC associated with the VPN gateway instance must be connected to a forward router instance, and the VPN gateway instance must run the BGP dynamic routing routable protocol for this parameter to take effect. If an IPsec connection is directly attached to a forward router instance, this parameter takes effect. You can enter multiple instance types.	VPC
	string	No	The list of source instance types to be matched. The following instance types are supported: VPC: VPC instance. VBR: border router instance. CCN: CCN instance. VPN: VPN gateway instance or IPsec connection. If an IPsec connection or SSL server is attached to a VPN gateway instance, the VPC associated with the VPN gateway instance must be connected to a forward router instance, and the VPN gateway instance must run the BGP dynamic routing routable protocol for this parameter to take effect. If an IPsec connection is directly attached to a forward router instance, this parameter takes effect. You can enter multiple instance types.	VPC
DestinationChildInstanceTypes	array	No	The list of destination instance types to be matched. The following instance types are supported: VPC: VPC instance. VBR: VBR instance. CCN: CCN instance. VPN: IPsec connection. Note If an IPsec connection or SSL server is associated with a VPN gateway instance and connected to a transit router instance through the VPC associated with the VPN gateway instance, this parameter does not take effect. This parameter takes effect only when an IPsec connection is directly associated with a transit router instance. You can enter multiple instance types. Note The destination instance type list takes effect only when the application direction of the route map is set to RegionOut and the destination instance types are the types of instances in the local region.	VPC
	string	No	The list of destination instance types to be matched. The following instance types are supported: VPC: VPC instance. VBR: VBR instance. CCN: CCN instance. VPN: IPsec connection. Note If an IPsec connection or SSL server is associated with a VPN gateway instance and connected to a transit router instance through the VPC associated with the VPN gateway instance, this parameter does not take effect. This parameter takes effect only when an IPsec connection is directly associated with a transit router instance. You can enter multiple instance types. Note The destination instance type list takes effect only when the application direction of the route map is set to RegionOut and the destination instance types are the types of instances in the local region.	VPC
DestinationCidrBlocks	array	No	The prefix list to be matched. The CIDR blocks in the prefix list must be in CIDR format. You can enter up to 64 CIDR blocks. Both IPv4 and IPv6 formats are supported.	10.10.10.0/24
	string	No	The prefix list to be matched. The CIDR blocks in the prefix list must be in CIDR format. You can enter up to 64 CIDR blocks. Both IPv4 and IPv6 formats are supported.	10.10.10.0/24
RouteTypes	array	No	The list of route types to be matched. The following route types are supported: System: system routing, which is automatically generated by the system. Custom: custom routing, which is manually added by a user. BGP: BGP routing, which is propagated through the BGP routable protocol. You can enter multiple route types.	System
	string	No	The list of route types to be matched. The following route types are supported: System: system routing, which is automatically generated by the system. Custom: custom routing, which is manually added by a user. BGP: BGP routing, which is propagated through the BGP routable protocol. You can enter multiple route types.	System
MatchAsns	array	No	The AS path list to be matched. You can enter up to 64 AS numbers. Note Only AS SEQUENCE is supported. AS SET, AS CONFED SEQUENCE, and AS CONFED SET are not supported. This means only AS number lists are supported, and sets and sub-lists are not supported.	65501
	integer	No	The AS path list to be matched. You can enter up to 64 AS numbers. Note Only AS SEQUENCE is supported. AS SET, AS CONFED SEQUENCE, and AS CONFED SET are not supported. This means only AS number lists are supported, and sets and sub-lists are not supported.	65501
MatchCommunitySet	array	No	The community set to be matched. Each community must be in the format of n:m, where n and m are integers from 1 to 65535. Communities must comply with RFC 1997. Large communities (RFC 8092) are not supported. You can enter up to 64 communities. Note Incorrect community configurations may prevent routes from being advertised to the on-premises data center.	65501:1
	string	No	The community set to be matched. Each community must be in the format of n:m, where n and m are integers from 1 to 65535. Communities must comply with RFC 1997. Large communities (RFC 8092) are not supported. You can enter up to 64 communities. Note Incorrect community configurations may prevent routes from being advertised to the on-premises data center.	65501:1
OperateCommunitySet	array	No	The community set to be operated. Each community must be in the format of n:m, where n and m are integers from 1 to 65535. Communities must comply with RFC 1997. Large communities (RFC 8092) are not supported. You can enter up to 32 communities. Note Incorrect community configurations may prevent routes from being advertised to the on-premises data center.	65501:1
	string	No	The community set to be operated. Each community must be in the format of n:m, where n and m are integers from 1 to 65535. Communities must comply with RFC 1997. Large communities (RFC 8092) are not supported. You can enter up to 32 communities. Note Incorrect community configurations may prevent routes from being advertised to the on-premises data center.	65501:1
PrependAsPath	array	No	The AS path to be prepended when the regional gateway receives or performs publish route entry. The requirements for configuring the prepended AS path vary based on the application direction of the policy: If the application direction is RegionIn, you must configure the source instance ID list and source region in the match conditions, and the source region must be the same as the region where the policy is applied. If the application direction is RegionOut, you must configure the destination instance ID list in the match conditions. This parameter specifies the action to be executed after routing meets the match conditions. You can enter up to 32 AS numbers.	65501
	integer	No	The AS path to be prepended when the regional gateway receives or performs publish route entry. The requirements for configuring the prepended AS path vary based on the application direction of the policy: If the application direction is RegionIn, you must configure the source instance ID list and source region in the match conditions, and the source region must be the same as the region where the policy is applied. If the application direction is RegionOut, you must configure the destination instance ID list in the match conditions. This parameter specifies the action to be executed after routing meets the match conditions. You can enter up to 32 AS numbers.	65501
DestinationRegionIds	array	No	The list of destination region IDs to be matched. You can enter up to 64 region IDs.
	string	No	The list of destination region IDs to be matched. You can enter up to 64 region IDs.	cn-beijing

Response elements

Element	Type	Description	Example
	object	The response result.
RouteMapId	string	The ID of the route map.	cenrmap-w4yf7toozfol3q****
RequestId	string	The request ID.	62172DD5-6BAC-45DF-8D44-56SDF467BAC

Examples

Success response

JSON format

{
  "RouteMapId": "cenrmap-w4yf7toozfol3q****",
  "RequestId": "62172DD5-6BAC-45DF-8D44-56SDF467BAC"
}

Error codes

HTTP status code	Error code	Error message	Description
400	Forbidden.CenRouteMapExist	The specified CEN route map ID already exists.	The specified CEN route map ID already exists.
400	Invid.Parameter	When using PrependAsPath in the RegionIn, SourceRegionId must be local region Id.
400	InvalidOperation.NoEffictiveAction	No effective action be configured.	The error message returned because the specified action is invalid.
400	IncorrectStatus.TransitRouterInstance	The status of TransitRouter is incorrect.	The error message returned because the transit router is in an invalid state.
400	InvalidDescription	Description is invalid.	The error message returned because the description is invalid.
400	IllegalParam.ZoneId	The specified ZoneId is illegal.	The error message returned because the specified zone is invalid.
400	Forbidden.NoMedAuthorized	Med operation is unauthorized.	Unable to operate on the specified Med routing policy.
400	InvalidOperation.MedRouteMapExist	Operation is invalid because the default med route map already exist.	The operation is invalid because there is already a med routeMap with the next hop destination for this Ecr instance.
400	InvalidOperation.MedRouteMapNotAllowedOtherAction	Operation is invalid because the default med not allowed other action.	the med policy does not allow to configure other policies.
400	InvalidOperation.MedRouteMapActionMustPermit	Operation is invalid because the default med map result must be permit.	Operation is invalid because the default med map result must be permit.
400	InvalidParameter.MedRouteMapDestInstanceIds	Param DestInstanceIds must be ecr instance id.	The destination instance list of med routeMap must be ECR instance.
400	InvalidParameter.MedRouteMapDestInstanceType	Param DestChildInstanceTypes must be ecr.	The destination instance type of the med routeMap must be ECR.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	InvalidParameter.CenId	The specified parameter CenId is invalid.	The entered parameter CenId is invalid.
400	InvalidParameter.TransitRouterRouteTableId	The specified parameter TransitRouterRouteTableId is invalid.	The parameter TransitRouterRouteTableId entered is illegal.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.