How to use a routing policy to restrict connectivity between CIDR blocks - Cloud Enterprise Network

This topic describes how to use a routing policy to restrict connectivity between a VPC and a specific CIDR block.

Prerequisites

Note

This topic applies only to Basic Edition transit routers.

Your data center is connected to Alibaba Cloud using Express Connect. For more information, see Connect a data center to an ECS instance by using Express Connect.
You have created a CEN instance and attached the required network instances. For more information, see Create a CEN instance and Attach network instances.

Background information

By default, a CEN instance allows full-mesh connectivity between all attached network instances, such as VPCs, VBRs, and CCN instances. However, in some scenarios, you may need to restrict connectivity between a VPC and a specific CIDR block advertised by a VBR or CCN instance. 限制网段间互通

As shown in the preceding figure, a VBR learns two routes from a data center over BGP: a route to CIDR block 1 and a route to CIDR block 2. Both the VPC and the VBR are attached to a CEN instance. By default, the VPC can communicate with both CIDR block 1 and CIDR block 2 in the data center. If you want to prevent the VPC from communicating with CIDR block 1, you can create a routing policy to block this route. Connectivity to CIDR block 2 remains unaffected.

Step 1: Create a route rejection policy

Create a routing policy to reject the route to CIDR block 1 learned from the VBR.

Log on to the CEN console.
On the CEN Instance page, find your CEN instance and click its ID.
On the details page of the CEN instance, find the region where you want to create the routing policy and click the ID of the transit router.
On the transit router details page, click the Route Table tab, and then click Route Maps.
On the Route Maps page, click Add Route Map. Configure the parameters as follows and click OK.
- Policy Priority: Enter 20. A smaller value indicates a higher priority.
- Region: Select China (Hangzhou).
- Policy Direction: Select RegionIn.
- Match Condition: Add the following two conditions:
  - For Source Instance IDs, enter the ID of the VBR instance.
  - For Route Prefix, enter 192.168.0.0/24. For Match method, select Exact Match.
- Policy Action: Select Deny.
After you create the routing policy, you can verify its effect on the Network Instance Route Table tab. Before the policy is applied, the route table shows an available route to 192.168.0.0/24, with the next hop being the transit router in the China (Hangzhou) region. After the policy is applied, this route is filtered out and removed from the Network Routes tab of the transit router, confirming that the Reject action is effective.

Step 2: Test network connectivity

Test the connectivity from the VPC to CIDR block 1 in the data center.
1. Log on to an ECS instance in the VPC.
2. Run the ping command to ping an IP address in CIDR block 1 of the IDC to verify connectivity.
  The ECS instance cannot access the IP address in CIDR block 1.
```
[root@xxx ~]# ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
^C
--- 192.168.0.1 ping statistics ---
17 packets transmitted, 0 received, 100% packet loss, time 15999ms
```

Test the connectivity from the VPC to CIDR block 2 in the data center.

Log on to an ECS instance in the VPC.

By using the ping command, ping the IP address of CIDR block 2 on the IDC side to verify that the communication is normal.

The ECS instance can access the IP address in CIDR block 2.

C:\Users\Administrator>ping 10.0.0.1

Pinging 10.0.0.1 with 32 bytes of data:
Reply from 10.0.0.1: bytes=32 time<1ms TTL=128
Reply from 10.0.0.1: bytes=32 time<1ms TTL=128
Reply from 10.0.0.1: bytes=32 time<1ms TTL=128
Reply from 10.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.0.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms