Cloud Enterprise Network:Use shared services across multiple Cloud Enterprise Network instances

Scenario example

Take the preceding figure as an example. CEN1 contains transit router TR1, and CEN2 contains transit router TR2. To use VPC3 as the shared service VPC of the two CEN instances, attach VPC3 to TR1 and TR2 respectively, and then configure the routes of each VPC.

This configuration achieves the following results:

• VPC1 and VPC3 can communicate with each other.

• VPC2 and VPC3 can communicate with each other.

• VPC1 and VPC2 are isolated from each other. VPC1 and VPC2 are attached to different CEN instances, each transit router has its own route table, and the custom routes that you add connect VPC1 and VPC2 only to VPC3.

Considerations

Before you start, review the following constraints:

• CEN instance quota — By default, you can create up to 5 CEN instances with one Alibaba Cloud account.

• Transit router attachment quota — By default, you can attach one VPC to up to 5 transit routers.

• Resource planning — If you plan the resources by yourself, make sure that the CIDR blocks of the three VPCs do not overlap. In regions in which Enterprise Edition transit routers support multiple zones, you must create vSwitches in at least two different zones to implement zone-level disaster recovery.

• Quota increase — To request a higher quota, see Quotas.

Prerequisites

Complete the following configurations based on the scenario example:

• Create two CEN instances named CEN1 and CEN2. In each CEN instance, create one transit router, named TR1 and TR2 respectively. Both transit routers are in the China (Hangzhou) region.

• Create three VPCs. Do not attach them to the transit routers for now.

• Create three ECS instances named ECS1, ECS2, and ECS3, and deploy one in each of the three VPCs.

  The following table describes the resource configurations of the three VPCs:

For information about how to create each resource, see Create a CEN instance, Create a transit router instance, Create a VPC and a vSwitch, and Create an ECS instance.

The security group rules of the three ECS instances must allow ICMP traffic. Configure the rules before you test connectivity in Step 3. For instructions, see View security group rules and Add security group rules.

The inbound rules of the security group must include a rule whose authorization policy is Allow, protocol type is All ICMP(IPv4), and authorization object is 0.0.0.0/0 (all IPv4 addresses).

Step 1: Attach the VPCs to the transit routers

In this step, you create four VPC attachments: two on TR1 and two on TR2. The following steps describe the general procedure for creating one VPC attachment. The values that differ between the four attachments are listed in the first table that follows the steps, and the values that are identical for all four attachments are listed in the second table.

1. Log on to the CEN console.On the CEN Instance page, click the ID of the CEN instance that you want to manage. (For the target CEN instance, see the following table.)

2. On the Basic Information > Transit Router tab, find the transit router instance in the target region. In the Actions column, click Create Connection > Intra-region. (For the target transit router instance, see the following table.)

3. On the Create Intra-Region Connection page, configure the parameters based on the following two tables, and then click OK.

   The following table lists the values that differ between the four VPC attachments.

The following table lists the parameters that you configure the same way for each of the four VPC attachments.

For descriptions of the three advanced options, see the following:

Associate with default route table of transit router (associates the VPC connection with the transit router's default route table), Propagate system routes to default route table of transit router (advertises VPC system routes to the transit router, enabling communication with other attached network instances), and Automatically create route that points to transit router and add to all route tables of current VPC (adds three routes — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — to all VPC route tables, with next hops pointing to the transit router; by default, transit routers do not advertise routes to VPCs). To customize routing, clear these checkboxes and configure route associations and propagation manually. See Manage routes.

Before you continue to Step 2, confirm that all four VPC attachments exist: TR1 has the attachments Attach1 and Attach3-1, and TR2 has the attachments Attach2 and Attach3-2.

Step 2: Configure the route tables of the VPCs

Add custom route entries to the route tables of the three VPCs. In this step, the route table of each VPC gets the routes that direct traffic to the shared service VPC or to the VPCs that use the shared service.

1. Log on to the Virtual Private Cloud console.

2. In the left-side navigation pane, click Route Table.

3. In the top menu bar, select the region in which the VPCs are deployed: China (Hangzhou).

4. On the Route Table page, find the route table of the VPC and click the instance ID of the route table.

5. On the route table details page, click the Route Entry List tab, and then click the Custom Route Entry tab.

6. Click Add Route Entry. In the Add Route Entry panel, enter the destination CIDR block listed in the following table. For Next Hop Type, select Transit Router, select the connection listed in the following table as the transit router, and then click OK.

7. Return to the Route Table page and repeat steps 4 to 6 for the remaining VPCs in the following table.

   The following table describes the custom route entries that you add for each VPC.

Before you continue to Step 3, confirm that the custom route entries of each route table match the preceding table: one entry in the route table of VPC1, one entry in the route table of VPC2, and two entries in the route table of VPC3.

Step 3: Test the connectivity

Before you test the connectivity, confirm that the security group rules of the three ECS instances allow ICMP traffic, as described in the prerequisites.

Log on to the ECS1 instance and run the ping command to access ECS3:

[root@iZbp1xxx ~]# ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=63 time=0.332 ms
64 bytes from 192.168.0.1: icmp_seq=2 ttl=63 time=0.970 ms
64 bytes from 192.168.0.1: icmp_seq=3 ttl=63 time=0.327 ms
64 bytes from 192.168.0.1: icmp_seq=4 ttl=63 time=0.355 ms
^C
--- 192.168.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3010ms
rtt min/avg/max/mdev = 0.327/0.496/0.970/0.273 ms
[root@iZbp1xxx ~]#

If the ping succeeds, VPC1 and VPC3 can communicate with each other.

Use the same method to verify the remaining connectivity and the isolation:

• Log on to the ECS2 instance and run the ping command to access ECS3. If the ping succeeds, VPC2 and VPC3 can communicate with each other.

• Log on to the ECS1 instance and run the ping command to access ECS2. If the ping fails, the networks of VPC1 and VPC2 are isolated from each other.

FAQ

How do I increase the CEN instance quota or the number of transit routers that a VPC can be attached to?

Both quotas are default values and can be increased. For instructions, see Quotas.

What do I do if the network is disconnected?

Check the routes, the security groups, and the firewall of the ECS operating system in sequence.

Take the routes in this topic as an example. For ECS1 to access ECS3, check the route table of VPC1, the route table of the transit router, and the route table of VPC3 in sequence to make sure that the route tables contain route entries for both directions.

For more information, see Troubleshoot ECS communication in CEN-connected VPCs.