Cloud Enterprise Network:How transit routers work

Routing

• Route table

  After network instances are connected to an Enterprise Edition transit router, routes of the network instances are stored in route tables. The Enterprise Edition transit router forwards traffic of the network instances based on the routes in the route table.

  Each Enterprise Edition transit router has a default route table. You can also create custom route tables for Enterprise Edition transit routers. Default route tables are isolated from custom route tables for access control.

• Associated forwarding

  Associated forwarding controls how network traffic is forwarded. An Enterprise Edition transit router can forward network traffic for a network instance by querying routes only after the network instance connection is associated with the route table.

  Each network instance connection can have an associated forwarding correlation with the route tables of only one Enterprise Edition transit router.

• Route learning

  Route learning controls how a network instance advertises routes. The routes of a network instance can be advertised to an Enterprise Edition transit router only after you enable route learning between the network instance connection and the route tables of the transit router.

  You can enable route learning between the network instance connection and the route tables of one or more Enterprise Edition transit routers. Then, routes can be advertised from the network instance to the route tables.

• Custom route entries

  You can add custom routes to the route tables of an Enterprise Edition transit router to manage traffic forwarding.

• Default route behavior

  After a network instance is connected to an Enterprise Edition transit router, no routes are advertised to the network instance by default. You can enable route synchronization to turn on the feature. For more information, see Route synchronization.

• Click to see more routing control features

  • Prefix list

    The route tables of Enterprise Edition transit routers can be associated with prefix lists. After association, the system automatically adds the routes that point to the CIDR blocks in the prefix list to the route table of the transit router. This reduces your workload.

  • Routing policy

    You can configure routing policies to control route advertisement for the route tables of an Enterprise Edition transit router. You can add a routing policy to specify whether to advertise the routes in transit routers to network instances or other transit routers. You can modify routing policies to adjust the attributes of routes.

    When you add a routing policy, you must specify a route table of an Enterprise Edition transit router. The routing policy is associated with the specified route table and is used to filter and modify the routes in the route table.

    If a VBR or an IPsec-VPN connection is connected to an Enterprise Edition transit router, the system automatically adds a route whose priority is 5000, action is Reject, and direction is Egress Regional Gateway to the route table. This route forbids network communication between the VBR or IPsec-VPN connection and other VBRs or IPsec-VPN connections that are also connected to the transit router. For more information, see Default routing policy.

  • Aggregated routes

    After you connect a VPC to an Enterprise Edition transit router, you can aggregate multiple specific routes in the transit router route table that is associated with the VPC into one aggregate route. After route synchronization is enabled for the VPC, the aggregate route, instead of the specific routes, is automatically advertised to the VPC. Route aggregation reduces the number of routes and accelerates route synchronization.

  • Multi-region VBR equal-cost routes

    An Enterprise Edition transit router may learn routes from multiple VBRs. If the routes have the same attributes other than region IDs, network traffic is forwarded based on the region IDs in alphabetical order. If Multi-region Equal-cost Multi-path (ECMP) routing is enabled for VBRs and the routes have the same attributes other than region IDs, those routes are considered equal-cost routes.

Route priority

Traffic that enters Enterprise Edition transit routers is routed based on the Longest Prefix Match principle. In cases where there are multiple routes to the same destination CIDR block, the routing is determined in the following order of priority:

• If there is a static or dynamic route entry in the route table with the VPC connection as the next hop, any learned route entries from other network instances with the same destination will be marked as conflicting.

• If there is a dynamic route entry sourced from a VPC, any learned route entries from other network instances with the same destination will be marked as conflicting.

• If there is a static or dynamic route entry that is not sourced from a VPC, any learned route entries from a VPC with the same destination will be marked as conflicting.

  Note

  VPCs and on-premises networks host different services. There should be no active-standby or Equal-Cost Multi-Path (ECMP) relationships between overlapping CIDR blocks across VPCs or hybrid clouds.

  To prevent conflicts, a transit router uses route conflict rules. When receiving a duplicate route from another service, it blocks connectivity between the new and existing networks without disrupting traffic for existing services. This ensures no impact on production workloads.

For route entries that point to a data center and do not cause routing conflicts, the route priority will be determined by comparing the following items in order:

1. Static routes in route tables: Static routes manually configured in the route table have the highest priority, including custom route entries and entries of prefix lists. When both are configured, they automatically form ECMP routes.

2. Dynamic routes: If route entries are automatically learned, the priority is determined in the following order of priority: 

   1. Type of source instance: The priority is in the descending order: VBR instances > Express Connect Router (ECR) instances > Cloud Connect Network (CCN) instances > IPsec connections (VCO).

   2. Type of route entry in source route table: BGP route entries take precedence over custom route entries.

   3. As-Path: Routes with shorter BGP AS_PATH length are preferred.

   4. Next hop: Intra-region connections are prioritized over inter-region ones.

   5. Routing policy: Select a route entry based on priority specified by the routing policy. A lower value indicates a higher priority.

   6. If none of the above rules determine the route priority, the following applies:

      • For intra-region next hops: ECMP routing is enabled.

      • For inter-region next hops: If the transit router route table has multi-region ECMP Routing for VBRs enabled and the source instance is a VBR or ECR, ECMP is enabled. If disabled, priority is determined by comparing the region IDs of the next-hop transit routers. Entries with alphabetically earlier region IDs are prioritized.