Review these recommendations before connecting network instances through a transit router.
-
To connect a virtual private cloud (VPC) to an Enterprise Edition transit router, the VPC needs a vSwitch in a zone that the transit router supports. Create a dedicated vSwitch for this purpose — do not reuse vSwitches that carry service traffic. Follow these rules when creating the vSwitch:
-
Use the smallest CIDR block that meets your needs to prevent IP address waste. The subnet mask length should not exceed 28 bits.
For example, you can use 192.168.10.0/28.
Associate all vSwitches used for VPC connections with the same network access control list (ACL). If no access control is needed, configure the ACL to allow all inbound and outbound traffic. Apply separate ACLs to vSwitches that carry service traffic.
Associate all vSwitches used for VPC connections with the same VPC route table.
-
-
Use BGP dynamic routing for IPsec-VPN connections attached to an Enterprise Edition transit router. BGP enables automatic route propagation and failover, which avoids manual route updates when topology changes.
If your on-premises gateway supports equal-cost multi-path routing (ECMP), enable it to distribute traffic across multiple VPN tunnels and increase throughput.
When both a virtual border router (VBR) and an IPsec-VPN connection are attached to the same Enterprise Edition transit router, enable route learning on both attachments. Route learning automatically advertises routes from the VBR and VPN attachment to the transit router's route tables, eliminating the need for manual route configuration.
Keep route tables to the minimum required by your topology. Use the default route table if one route table is sufficient. If multiple route tables are needed, group network instances by service type and assign each group to the appropriate route table. Proliferating route tables increases management complexity without improving performance.
Each transit router is built for high availability — you do not need to deploy multiple transit routers to achieve it.
-
After connecting a network instance to the transit router, configure redundant routes to protect against single points of failure. Apply this to the following scenarios at a minimum:
VPC connections: Attach a vSwitch in each zone supported by the Enterprise Edition transit router. Multi-zone attachment enables zone-level disaster recovery and reduces data transmission latency.
On-premises connectivity: Create multiple VPN attachments between your on-premises network and the transit router to enable ECMP. Alternatively, pair a VPN attachment with a VBR connection as active and standby links.