Configure active/standby routes for VBRs - Cloud Enterprise Network

In scenarios where a data center connects to a VPC through multiple virtual border routers (VBRs) attached to an Enterprise Edition transit router, you can configure a routing policy to control route priority if the VBRs are in the same region. This allows you to set up an active/standby route configuration. Traffic is prioritized over the active link and automatically fails over to the standby link if the active link is disconnected.

Background information

According to the principles of transit router route priority, if two VBR instances in the same region are connected to an Enterprise Edition transit router and advertise routes to the same destination CIDR block with identical route attributes, the VBRs form an ECMP (equal-cost multipath routing) link. As a result, traffic from the VPC to the data center is distributed across both VBR instances.

However, some network plans or on-premises gateway devices do not support ECMP and require an active/standby configuration to access VPCs in the cloud. This can lead to asymmetric routing, where traffic to the VPC and traffic from the VPC follow different paths. To prevent this issue, you can modify the attributes of routes from your data center on Alibaba Cloud to designate active and standby routes. This ensures that traffic to your data center also uses the active/standby configuration, maintaining symmetric traffic paths.

Based on transit router route priority, you can use several methods to designate active/standby routes. This topic describes how to use a routing policy to control the priority of routes from your data center and forward traffic to the data center over an active/standby VBR link.

Example scenario

A company's data center is connected to Alibaba Cloud using two Express Connect circuits in the China (Hangzhou) region. An Enterprise Edition transit router provides network communication between the data center and a VPC. The company's network plan does not support ECMP for accessing the VPC. The company needs to configure an active/standby link for traffic between the data center and the VPC. Traffic must be prioritized through the active link. If the active link is disconnected, traffic must automatically fail over to the standby link. After the active link is restored, traffic must automatically switch back to the active link.

Note

In this scenario, both VBR1 and VBR2 use static routes.

Prerequisites

Before you begin, make sure that your data center is connected to Alibaba Cloud and that the data center and VPC can communicate. The following table describes the CIDR blocks and network configurations in this scenario.

Click to view the CIDR blocks and related network configurations.

Instance or resource	CIDR block and IP address	Related network configuration
VPC	VPC CIDR block: 10.0.0.0/16 vSwitch CIDR blocks: 10.0.30.0/24 and 10.0.40.0/24 ECS IP address: 10.0.30.104	The VPC is connected to the transit router in the US (Silicon Valley) region. All Advanced Settings are enabled for the connection. As a result, the transit router automatically adds the following three custom route entries to the system route table of the VPC. The three route entries have destination CIDR blocks of `192.168.0.0/16`, `172.16.0.0/12`, and `10.0.0.0/8`, a next hop of a transit router, and a status of Active.
Transit router in US (Silicon Valley)	-	An inter-region connection is created between the transit router in the US (Silicon Valley) region and the transit router in the Germany (Frankfurt) region. This ensures that the transit router in the US (Silicon Valley) region learns the route to the data center (`192.168.0.0/16`). On the Transit Router Route Table page for the TR in US (Silicon Valley), view the route entries in the system route table and confirm that a route entry for the destination CIDR block `192.168.0.0/16` has been automatically learned, the next hop resource type is TR, and the status is Active.
Transit router in Germany (Frankfurt)	-	VBR1 and VBR2 are connected to the transit router in the Germany (Frankfurt) region. Make sure that the transit router learns the route to the data center (`192.168.0.0/16`) from both VBR1 and VBR2. The next hop type of both routes is VBR, and the status is Ready. Also, make sure that the transit router in the Germany (Frankfurt) region learns the routes to the VPC (`10.0.30.0/24` and `10.0.40.0/24`) through the inter-region connection. The next hop type is Transit Router, and the status is Active.
VBR1	Alibaba Cloud Side IPv4 Address: 10.99.0.2 Data Center Side IPv4 Address: 10.99.0.1 IPv4 Subnet Mask: 255.255.255.252	VBR1 is connected to the transit router in the Germany (Frankfurt) region. All Advanced Settings are enabled for the connection. A custom route entry that points to the data center is added to VBR1: Destination CIDR block: the CIDR block of the data center (`192.168.0.0/16`) Next hop instance: Express Connect circuit	VBR1 learns the routes to the VPC (`10.0.30.0/24` and `10.0.40.0/24`) from the transit router in the Germany (Frankfurt) region.
VBR2	Alibaba Cloud Side IPv4 Address: 10.1.0.1 Data Center Side IPv4 Address: 10.1.0.2 IPv4 Subnet Mask: 255.255.255.252	VBR2 is connected to the transit router in the Germany (Frankfurt) region. All Advanced Settings are enabled for the connection. A custom route entry that points to the data center is added to VBR2: Destination CIDR block: the CIDR block of the data center (`192.168.0.0/16`) Next hop instance: Express Connect circuit	VBR2 learns the routes to the VPC (`10.0.30.0/24` and `10.0.40.0/24`) from the transit router in the Germany (Frankfurt) region.
Data center	CIDR block for communication with the VPC: `192.168.0.0/16` Client IP address: 192.168.10.135	CPE1 Has a static route to the VPC (`10.0.0.0/16`), with the next hop pointing to VBR1. CPE2 Has a static route to the VPC (`10.0.0.0/16`), with the next hop pointing to VBR2.

Procedure

Step 1: Specify routes to the data center

Configure a routing policy.

You need to configure a routing policy for the transit router that the VBR instances are attached to. Use the routing policy to modify route attributes and specify the active and standby routes.

Log on to the CEN (Cloud Enterprise Network) console. On the CEN Instance page, find the CEN instance that contains the transit router and click the instance ID.
On the Basic Settings > Transit Router tab, click the ID of the transit router instance that the VBRs are attached to.
On the details page of the transit router instance, click the Route Table tab. On the Route Maps tab, click Add Route Map.

Configure two routing policies to specify the active and standby routes to the data center. Use the default values for other parameters.

Routing policy 1	Routing policy 2
For routes from the VBR1 instance, set the Route Priority to 10. The smaller the Route Priority value, the higher the route's priority.	Set the Route Priority to 20 for routes from the VBR2 instance. This configures routes from VBR2 as standby routes.
Policy Priority: 10. Applied to Route Table: the route table of the transit router. Policy Direction: RegionIn. Match Condition: Select Source Instance IDs and enter the ID of the VBR1 instance. Policy Action: Select Allow. Set Attributes: Click Add Action Object, select Route Priority, and enter 10.	Policy Priority: 20. Applied to Route Table: the route table of the transit router. Policy Direction: RegionIn. Match Condition: Select Source Instance IDs and enter the ID of the VBR2 instance. Policy Action: Select Allow. Set Attributes: Click Add Action Object, select Route Priority, and enter 20.

After you configure the routing policies, go to the Route Entry tab. The status of the routes from the VBR2 instance changes to Backup.

Configure a health check for the VBR instances.

To enable automatic failover between the active and standby links, you must configure a health check for the VBR instances in the CEN console. If the health check for the VBR instance on the active link fails, the transit router automatically switches traffic to the standby link. After the active link is restored, the transit router automatically switches traffic back to the active link.

In the left-side navigation pane, click VBR Health Check.
On the VBR Health Check page, select the region where the VBR instances are deployed and click Add Health Check.

Configure health checks for VBR1 and VBR2. Use the default values for other parameters.

Health check 1	Health check 2
CEN Instance: Select the CEN instance to which the transit router belongs. Virtual Border Router (VBR): Select VBR1. Source IP: Select Automatic IP Address. Destination IP: Enter the Data Center Side IPv4 Address of VBR1. Switch Route: Keep this feature enabled.	CEN Instance: Select the CEN instance to which the transit router belongs. Virtual Border Router (VBR): Select VBR2. Source IP: Select Automatic IP Address. Destination IP: Enter the Data Center Side IPv4 Address of VBR2. Switch Route: Keep this feature enabled.

In your data center, configure a return route for the VBR health check.
You must add a route entry in your data center for the health check's source IP address with a 32-bit subnet mask. The next hop of the route entry must point to the corresponding Express Connect circuit. Otherwise, the health check probe packets (pings) cannot return along the original path, and Alibaba Cloud may incorrectly determine that the Express Connect circuit is unavailable.

(Optional) Configure an alert rule for the VBR instance.
When a health check detects a link failure, it automatically triggers a route switchover but does not send you notifications. We recommend that you also configure an alert rule for the VBR instance. This ensures you receive notifications if an Express Connect circuit fails.

Step 2: Specify routes to the VPC

The data center can access the VPC through CPE1 or CPE2. To ensure that traffic paths to the VPC and to the data center are symmetric, you must also specify active and standby routes to the VPC in your data center. Configure your data center to prioritize CPE1 for VPC access. You also need to configure health checks and route failover to ensure that the data center automatically uses CPE2 to access the VPC if the CPE1 connection is disconnected. After the CPE1 connection is restored, the data center must automatically switch back to CPE1.

Step 3: Test the active/standby links

After you configure the active/standby routes, you can use the Express Connect fault drill feature to interrupt the primary link and test whether the active and standby links can automatically switch over. During the test, you can run the traceroute -I <destination IP address> command on the client in your data center and on the ECS instance to trace the traffic path and check whether the traffic is transmitted along the expected path.

Note

The -I parameter indicates that test packets are sent over the ICMP protocol. Ensure that the access control rules in your data center and the ECS security group rules allow ICMP traffic between your data center network segment and the VPC network segment.
The data center client in this article uses a CentOS Stream 9 64-bit operating system. If your operating system does not support the traceroute command, install the command first.
If your device cannot trace the traffic path with the traceroute command, you can also determine the traffic path by viewing the monitoring charts for the VBR connection in the CEN console.

Execute the traceroute -I <target IP address> command on the ECS instance and the local data center client, respectively, to view the current traffic transmission path.
Log on to the Express Connect console and configure a fault drill to disconnect the active link. After the fault drill starts, check the traffic paths on the ECS instance and on the client in the data center. The following table describes the fault drill configurations.
- Region: Select Germany (Frankfurt).
- Drill Resource: Select Virtual Border Router (VBR).
- Instances: Select VBR1.
- Drill Mode: Select Start Now.
- Drill Duration: 5 minutes.

After the fault drill is complete, the active link is automatically restored. Check the traffic paths on the ECS instance and on the client in the data center again.

The traffic paths to and from the VPC are symmetric. Traffic is prioritized over the active link. If the active link is disconnected, traffic automatically fails over to the standby link. After the active link is restored, traffic automatically switches back to the active link. A brief traffic interruption may occur during the link switchover.

Device

Current traffic path

Active link disconnected

Active link restored

Client in the data center

Run the traceroute command on a client in the local data center, where the second hop passes through 10.99.0.2 to reach the destination 10.0.30.104:

[e xxx ]$ traceroute -I 10.0.30.104
traceroute to 10.0.30.104 (10.0.30.104), 30 hops max, 60 byte packets
1  100.64.0.113 (100.64.0.113)  0.729 ms  *  *
2  10.99.0.2 (10.99.0.2)  0.513 ms  0.653 ms  *
3  *  *  *
4  10.0.30.104 (10.0.30.104)  150.274 ms  150.269 ms  150.267 ms

[exxxZ ~]$ traceroute -I 10.0.30.104
traceroute to 10.0.30.104 (10.0.30.104), 30 hops max, 60 byte packets
1  100.64.0.129 (100.64.0.129)  0.636 ms  0.845 ms  1.120 ms
2  10.1.0.1 (10.1.0.1)  0.526 ms  0.675 ms  0.809 ms
3  *  *  *
4  10.0.30.104 (10.0.30.104)  150.429 ms  150.427 ms  150.424 ms

After the primary link is restored, run traceroute on a client in your local IDC. The second hop passes through 10.99.0.2 again, indicating that traffic has switched back to the primary link.

[exxx ~]$ traceroute -I 10.0.30.104
traceroute to 10.0.30.104 (10.0.30.104), 30 hops max, 60 byte packets
1  100.64.0.113 (100.64.0.113)  0.765 ms  1.041 ms  1.220 ms
2  10.99.0.2 (10.99.0.2)  0.524 ms  0.804 ms  0.961 ms
3  *  *  *
4  10.0.30.104 (10.0.30.104)  150.156 ms  150.153 ms  150.150 ms

ECS instance

When you run the traceroute command on an ECS instance to test the link, the fourth hop shows a next hop address of 10.99.0.1, which indicates that the traffic passes through this node to reach the destination address.

~]$ traceroute -I 192.168.10.135
traceroute to 192.168.10.135 (192.168.10.135), 30 hops max, 60 byte packets
 1  * * *
 2  100.64.0.145 (100.64.0.145)  150.614 ms  150.947 ms  151.166 ms
 3  100.64.0.145 (100.64.0.145)  151.386 ms  151.658 ms  151.894 ms
 4  10.99.0.1 (10.99.0.1)  150.482 ms  150.563 ms  150.657 ms
 5  192.168.10.135 (192.168.10.135)  150.399 ms  150.396 ms  150.393 ms

Run the traceroute command on the ECS instance. The address of the fourth hop changes to 10.1.0.2, indicating that traffic has failed over to the standby link.

~]$ traceroute -I 192.168.10.135
traceroute to 192.168.10.135 (192.168.10.135), 30 hops max, 60 byte packets
 1  * * *
 2  100.64.0.225 (100.64.0.225)  151.232 ms  151.230 ms  151.529 ms
 3  100.64.0.225 (100.64.0.225)  151.762 ms  151.994 ms  152.374 ms
 4  10.1.0.2 (10.1.0.2)  150.702 ms  150.699 ms  150.696 ms
 5  192.168.10.135 (192.168.10.135)  150.692 ms  150.691 ms  150.688 ms

After you restore the primary VPC, run the traceroute command on the ECS instance. The fourth hop reverts to 10.99.0.1, which indicates that traffic has switched back to the primary link.

~]$ traceroute -I 192.168.10.135
traceroute to 192.168.10.135 (192.168.10.135), 30 hops max, 60 byte packets
 1  * * *
 2  100.64.0.145 (100.64.0.145)  150.959 ms  151.269 ms  151.626 ms
 3  100.64.0.145 (100.64.0.145)  151.858 ms  152.054 ms  152.276 ms
 4  10.99.0.1 (10.99.0.1)  150.849 ms  150.891 ms  151.028 ms
 5  192.168.10.135 (192.168.10.135)  150.738 ms  150.734 ms  150.732 ms

FAQ

Active/standby routes for Basic Edition transit routers

You can also follow the steps in this topic to configure active/standby routes for a Basic Edition transit router. The console UI for a Basic Edition transit router may differ from the UI for an Enterprise Edition transit router. For more information, see the relevant documentation.

If you cannot use the traceroute command to trace the traffic path, you can view the VBR instance monitoring charts in the Express Connect console to learn about the traffic path.