Cloud Enterprise Network:FAQ

FAQ quick links

Same-region cross-account VPC interconnection

Yes.

No bandwidth plan or inter-region connection is required:

• Connect VPCs across accounts

• Use CEN and Basic Edition transit routers to connect VPCs in different regions and Alibaba Cloud accounts

Cross-region communication for same-account VPCs

Yes.

Follow the instructions below, skipping cross-account VPC authorization steps.

• Use Enterprise Edition transit routers to connect VPCs across regions and accounts

• Use CEN and Basic Edition transit routers to connect VPCs in different regions and Alibaba Cloud accounts

Transit router instances per region

Within a CEN instance, only one transit router can exist per region. Network instances must attach to the same CEN to communicate.

You can create multiple CEN instances (isolated by default), each with its own transit router in the same region.

For example, China (Hangzhou) can have one transit router for CEN instance 1 and another for CEN instance 2.

CEN vs. VBR-to-VPC connection

Both CEN and VBR-to-VPC connections (Express Connect) connect a data center to a VPC, but differ in network connection, route management, and billing.

Differences between CEN and VPC peering connections

Both CEN and VPC peering connections enable private communication between VPCs, but differ in scale, topology, scalability, route configuration, and billing.

Check inter-region communication latency

Create an inter-region connection and check its monitoring data for latency. Inter-region connections. Monitor inter-region connections.

Why is CEN internal network latency sometimes higher than public network latency?

Cloud Enterprise Network (CEN) provides inter-VPC private network connectivity, not WAN (Wide Area Network) acceleration. When you access resources across regions, data packets travel through underlying physical links, and the resulting latency is determined by the physical distance between regions. This is a physical constraint that CEN cannot overcome. The low-latency advantage of CEN is more significant for cross-border links and less noticeable for non-cross-border links.

To compare latency, check the monitoring data for inter-region connections.

Connect VPCs across accounts with CEN

For example, to connect VPC1 (account A), VPC2 (account B), and VPC3 (account C): grant cross-account authorization to the CEN instance in account A for VPC2 and VPC3, then attach them to enable communication. Connect VPCs across accounts and Use CEN and Basic Edition transit routers to connect VPCs in different regions and accounts.

Console error: Forbidden.AttachChildInstanceAcrossBid

A transit router can connect to a cross-account VPC only if both belong to the same account type (China site or International site).

For example, a China site transit router can only connect to China site VPCs, and an International site transit router can only connect to International site VPCs.

For other VPC connectivity solutions, see network connectivity.

Error connecting a VBR to a transit router

VPC connection for non-upgraded transit routers

When you connect a VPC to an Enterprise Edition transit router that has not been upgraded, you must specify a primary and a secondary zone for the transit router. The VPC must have at least one vSwitch in each of these zones, and each vSwitch must have at least one available IP address. During the connection process, the transit router creates an elastic network interface (ENI) in a vSwitch in each zone. Each ENI consumes one IP address and connects the VPC to the Enterprise Edition transit router.

By default, traffic from the VPC is routed to the Enterprise Edition transit router through the ENI in the primary zone. If the ENI in the primary zone becomes unavailable, traffic automatically fails over to the ENI in the secondary zone.

When you specify the zones, note the following:

• The primary and secondary zones must belong to the same VPC, and each zone must contain at least one vSwitch.

• The route table and network ACL associated with the vSwitch containing the ENI affect how the VPC processes traffic from the Enterprise Edition transit router. If the vSwitches in the primary and secondary zones are associated with different route tables or network ACLs, traffic may be handled inconsistently during a failover. Network ACL.

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. Go to the Basic Information > Transit Router tab and click the ID of the transit router that you want to manage.

4. On the Connection with Peer Network Instance page, configure the parameters for the network instance and click OK.

   The following table describes only the relevant parameters. For all parameters, see Create VPC connections.

   Parameter	Description
   Instance Type	Select VPC.
   Region	Select the region where the VPC is deployed.
   Transit Router	The system automatically displays the transit router in the current region.
   Select the primary and secondary zones for the transit router.	Select the primary and secondary zones for the transit router. After you select the zones, the system creates an ENI in a vSwitch in each of the specified zones.
   Networks	Select the VPC instance ID.
   vSwitch	Select a vSwitch in each of the primary and secondary zones.

VPC communication without route synchronization

Route synchronization propagates routes from an Enterprise Edition transit router to attached network instances. If disabled, manually add routes to the peer network in the VPC's route table.

Without route synchronization, use one of the following methods:

• When you create a VPC connection, select the Auto-add transit router routes to all VPC route tables advanced feature. Create a VPC connection.

  The system automatically adds routes with the destination CIDR blocks 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 to all route tables in the VPC. The next hop for these routes is the VPC connection.

  Important

  If a route table in the VPC already contains a route with one of these destination CIDR blocks, the system cannot automatically add the new route. You must manually add a route that points to the VPC connection.

  When you create the VPC connection, you can click Check Route to check if these routes exist in the network instance.

• Manually add a route to the VPC's route table pointing to the peer network instance, with the transit router as the next hop. Use custom route tables to manage network traffic.

VBRs in a CEN fail to learn routes

Cause

When a VBR is attached to a CEN, the system adds a default routing policy (direction: Egress Regional Gateway, priority: 5000, action: Reject) that blocks VBR-to-VBR communication on the same transit router. A Basic Edition transit router has only one route table. Default routing policies.

Solution

This automatic routing policy has a priority of 5000 and cannot be modified. To override it, add a custom routing policy with a higher priority (a value less than 5000) to permit VBR-to-VBR communication. Use routing policies.

VBR instance cannot learn VPC routes

The troubleshooting steps depend on the edition of the transit router that connects the VBR and VPC instances.

Enterprise edition transit router

If the instances are connected to an enterprise edition transit router, follow these steps:

1. Use path analysis and transit router instance diagnostics. Use path analysis. Diagnose a transit router instance.

2. If the VBR and VPC are in different regions, ensure an inter-region connection exists between the two transit routers. Use an enterprise edition transit router to create an inter-region connection.

3. Ensure that the route table of the transit router connected to the VBR instance contains a route to the VPC instance.

4. Check the routing policies on the transit router connected to the VBR. Ensure the policies allow the VBR to learn routes from the VPC. Routing Policy 1.0.

Basic edition transit router

If the VBR and VPC instances are connected to a basic edition transit router, follow these steps:

1. If the VBR and VPC are in different regions, ensure an inter-region connection exists between the two transit routers. Use a basic edition transit router to create an inter-region connection.

2. Ensure that the route table of the basic edition transit router connected to the VBR instance contains a route to the VPC instance.

   By default, a basic edition transit router automatically learns VBR routes and VPC system routes. To learn other VPC routes, advertise them. Advertise routes to a transit router.

3. Check the routing policies on the basic edition transit router connected to the VBR. Ensure the policies allow the VBR to learn VPC routes. Routing Policy 1.0.

VPC fails to learn CEN routes

Troubleshoot the issue based on the edition of the connected transit router:

Enterprise Edition transit router

1. By default, a VPC does not learn routes from an Enterprise Edition transit router upon connection. You must associate the VPC connection with the transit router's route table and enable route synchronization. After you enable route synchronization, the VPC automatically learns route entries from the associated route table. Ensure that the route table contains the required routes.

   For instructions, see Create an associated forwarding and Enable route synchronization.

2. Check for any route entry conflicts between the route table of the Enterprise Edition transit router and the route table of the VPC.

3. Check the routing policies on the Enterprise Edition transit router's route table. Ensure that the policies allow the VPC to learn routes. Routing Policy 1.0.

Basic Edition transit router

By default, a VPC connected to a Basic Edition transit router automatically learns route entries from its route table. If the VPC fails to learn route entries, perform the following steps:

1. Ensure that the Basic Edition transit router's route table contains the required routes.

2. Check for any route entry conflicts between the route table of the Basic Edition transit router and the route table of the VPC.

3. Check the routing policies on the Basic Edition transit router's route table. Ensure that the policies allow the VPC to learn routes. Routing Policy 1.0.

Route conflicts in VPC or CEN

Resolve route conflicts in a VPC route table or in CEN.

Resolve overlapping CIDR blocks

How to resolve overlapping CIDR blocks for vSwitches in a VPC within a Cloud Enterprise Network.

Troubleshooting service access failure in CEN

• If both network instances use basic edition transit routers, create an inter-region connection between them. Use a basic edition transit router to create an inter-region connection.

  By default, a basic edition transit router provides 1 Kbps of inter-region bandwidth. This bandwidth is for connectivity testing only and does not support service traffic.

• If at least one network instance is connected to an enterprise edition transit router, create an inter-region connection between the transit routers. Use an enterprise edition transit router to create an inter-region connection.

Troubleshoot SAG access to cloud services via an Enterprise Edition transit router

1. Ensure that at least one VPC in the cloud service's region is connected to the Enterprise Edition transit router. Create a VPC connection by using an Enterprise Edition transit router.

2. Ensure an inter-region connection exists between the transit router attached to the CCN instance and the Enterprise Edition transit router connected to the VPC. Create an inter-region connection by using an Enterprise Edition transit router.

3. Ensure the route table of the Enterprise Edition transit router contains a route to the cloud service, with its next hop set to the VPC connection. Configure access to cloud services.

4. Ensure that the route table of the transit router to which the CCN instance is attached contains a route to the CIDR block of the SAG instance.

5. Check the routing policies applied to the route tables of the transit router to which the CCN instance is attached and the Enterprise Edition transit router. Ensure that the routing policies propagate the CIDR blocks of the SAG instance and the cloud service. Routing policies 1.0.

6. Check the VPC's route table for a route entry to the SAG instance's CIDR block. If missing, manually add a route entry with the next hop set to the VPC connection. Create and manage a route table.

7. Check for route conflicts in the route tables of the transit router to which the CCN instance is attached, the Enterprise Edition transit router, and the VPC.

8. Check the access control policies.

   • Check for any access control policies configured on the SAG instance. Ensure that the policy allows the SAG instance to access the cloud service. Access control overview.

   • Check for any network ACLs configured on the VPC. Ensure that the network ACL allows the SAG instance to access the cloud service. Network ACL.

9. Ensure that the service using the SAG instance and the destination cloud service are running correctly.

Troubleshoot ECS communication in CEN-connected VPCs

Troubleshoot the issue based on the transit router edition connecting the VPCs:

Enterprise Edition transit router

If at least one VPC is connected to an Enterprise Edition transit router, follow these steps:

1. Verify that the ECS instances' VPCs are attached to the same CEN.

   For ECS instances to communicate, their VPCs must be attached to the same CEN. Create a VPC connection.

2. Use path analysis and transit router diagnostics to identify the problem. Use path analysis. Diagnose a transit router instance.

3. If the two VPCs are in different regions, ensure an inter-region connection exists between the two transit routers. Use an Enterprise Edition transit router to create an inter-region connection.

4. Check the network ACLs configured for both VPCs. Ensure that the rules allow traffic between the ECS instances. Network ACLs.

5. Check the security group rules applied to the ECS instances. Ensure that the security group rules allow traffic to flow between the ECS instances. For more information, see Query security group rules and Add a security group rule.

6. Verify that the required CIDR blocks have been published to the transit router. Publish a route to a transit router.

7. Check the route table of the transit router for routing policies. Ensure that the routing policies permit traffic between the required CIDR blocks.

8. Check for route entry conflicts between the route tables of the transit router and the VPCs.

   You must resolve any route conflicts. What do I do if a "Route Conflict" error is reported for a VPC or CEN? What do I do if the CIDR blocks of VSwitches in a CEN-attached VPC overlap?

9. If the issue persists, capture packets on the ECS instances to check for incoming traffic.

Basic Edition transit router

If both VPCs are connected to Basic Edition transit routers, follow these steps:

1. Verify that the ECS instances' VPCs are attached to the same CEN.

   For ECS instances to communicate, their VPCs must be attached to the same CEN. Create a VPC connection.

2. If the two VPCs are in different regions, ensure an inter-region connection exists between the two transit routers. Use a Basic Edition transit router to create an inter-region connection.

3. Check the network ACLs configured for both VPCs. Ensure that the rules allow traffic between the ECS instances. Network ACLs.

4. Check the security group rules applied to the ECS instances. Ensure that the security group rules allow traffic to flow between the ECS instances. For more information, see Query security group rules and Add a security group rule.

5. Verify that the required CIDR blocks have been published to the transit router.

   By default, a Basic Edition transit router automatically learns a VPC's system routes. To learn other VPC routes, publish them. Publish a route to a transit router.

6. Check the route table of the transit router for routing policies. Ensure that the routing policies permit traffic between the required CIDR blocks.

7. Check for route entry conflicts between the route tables of the transit router and the VPCs.

   You must resolve any route conflicts. What do I do if a "Route Conflict" error is reported for a VPC or CEN? What do I do if the CIDR blocks of VSwitches in a CEN-attached VPC overlap?

8. If the issue persists, capture packets on the ECS instances to check for incoming traffic.

Troubleshoot telnet failures for CEN-connected VPCs

What to do when telnet fails but ping succeeds between VPC instances connected via Cloud Enterprise Network.

Cannot ping Express Connect interface IPs

For a solution, see What to do if you cannot ping the Alibaba Cloud side and customer side IP addresses after you enable an Express Connect circuit.

How do I troubleshoot network connectivity issues after creating a VBR connection?

If network connectivity issues occur after you create a VBR connection, troubleshoot based on the following scenarios:

Scenario 1: VBR route is missing and ECS cannot access on-premises IDC

If ECS instances in your VPC cannot access on-premises IDC CIDR blocks through Express Connect, check the route table of the virtual border router (VBR) to determine whether a route entry pointing to the ECS CIDR block has been added. If the route entry is missing, manually add it.

Scenario 2: Express Connect interconnection IP address cannot be pinged after VLAN configuration is canceled

This issue is usually caused by physical link or peer device configuration problems. Take the following actions:

1. Contact your carrier to perform segmented testing to identify where the problem is occurring.

2. Check the ARP learning status on the peer device.

3. Verify that network interfaces are correctly connected, that there are no configuration errors, and that no intermediate security or transport device is blocking traffic.

Scenario 3: Access failure caused by a mismatch between private domain name resolution and the route table

If the CIDR block resolved by a private domain name (for example, a CIDR block in the public IP address range that is used as a private address) is identified as a public IP address, route matching fails. To resolve this issue:

1. Add the CIDR block to the VPC.

2. Add a route entry in the VPC route table pointing to the transit router (TR).

Network connectivity fails after cross-account CEN authorization

Why does network connectivity fail after a cross-account VPC instance is authorized?.

"Unauthorized network instance" error during CEN firewall creation

Troubleshoot the "unauthorized network instance" error when creating a VPC firewall for a CEN.

Cannot attach cross-account VPC to CEN

Follow these steps to troubleshoot the issue:

1. Verify that the VPC instance and the CEN instance belong to accounts of the same type.

   For example, a VPC from an Alibaba Cloud China site account cannot be attached to a CEN from an Alibaba Cloud International site account.

2. Verify that the CEN instance has been authorized to access the cross-account VPC instance. VPC Instance Authorization.

Can I change a VPC connection associated with multiple vSwitches to be associated with only one vSwitch?

Yes. However, high availability will no longer be supported after the modification, and the modification process may cause traffic interruption. Take preventive measures in advance to avoid service disruption.

Modification method: Call the UpdateTransitRouterVpcAttachmentZones API operation and specify the RemoveZoneMappings parameter.

Why does the route table of a Basic Edition transit router contain route entries where the next hop points to a VPC in a different region?

This occurs because Basic Edition transit routers within the same Cloud Enterprise Network (CEN) instance propagate routes to each other by default, which is the standard routing logic of Basic Edition transit routers.

By default, an extremely small test bandwidth (1 Kbps) exists between Basic Edition transit routers and is used solely for network reachability testing. To carry cross-region production traffic, you must purchase a bandwidth plan and configure an inter-region connection.

If you need to customize and control route propagation, please upgrade to an Enterprise Edition transit router.

How do I route traffic for a single ECS instance through a backup dedicated line using a Basic Edition transit router?

A Basic Edition transit router does not support route matching for /32 host routes. You cannot configure a routing policy that directly targets a single ECS IP address. Use the following workaround instead:

1. Add a secondary CIDR block to the VPC and create a dedicated vSwitch and a dedicated route table within that CIDR block.

2. Move the target ECS instance to the new vSwitch.

3. Connect the backup dedicated line to CEN through a VBR (Virtual Border Router).

4. In the dedicated route table, add a static route with a more specific prefix (for example, /17) that covers the secondary CIDR block. Set the next hop to the backup VBR connection.

This approach isolates traffic for the target ECS instance and routes it through the backup dedicated line.

What should I do if an IP address range conflict occurs when attaching a VPC with Cloud Firewall (CFW) to a CEN route table?

The conflict occurs because the CEN route table has automatically learned VPC routes that overlap with the specific routes generated by Cloud Firewall. Use one of the following methods to resolve the conflict:

• Method 1: Configure a routing policy to deny the propagation of the conflicting VPC routes to the CEN route table.

• Method 2: Manually add more specific static routes to the CEN route table (for example, split a /26 CIDR block into two /27 CIDR blocks) to override the automatically learned routes and direct traffic through Cloud Firewall.

How do overseas self-built servers and other non-Alibaba Cloud resources access Alibaba Cloud resources deployed in Chinese mainland regions?

Non-Alibaba Cloud resources such as overseas self-built servers cannot connect to Alibaba Cloud CEN directly. Use the following approach:

1. Use Express Connect (leased line) or VPN Gateway to connect the overseas resources to an Alibaba Cloud VPC deployed in a region outside the Chinese mainland, such as China (Hong Kong), Singapore, or Germany.

2. Attach that VPC to your CEN instance to enable connectivity with Alibaba Cloud VPCs in Chinese mainland regions.