Cloud Enterprise Network:Use an Enterprise Edition transit router to enable IPv6 communication between cross-region VPCs

Prerequisites

Before you begin, make sure you have:

• An IPv4 VPC in each of the China (Hangzhou) and China (Shanghai) regions, with ECS instances running deployed applications. For details, see Create a VPC with an IPv4 CIDR block.

• A Cloud Enterprise Network (CEN) instance. For details, see Create a CEN instance.

• Security group rules on ECS1 and ECS2 that allow ICMPv6 inbound traffic. Add an inbound rule with the protocol set to ICMPv6 and the authorization object set to ::/0. For details, see Add a security group rule.

Steps overview

1. Enable IPv6 for VPCs

2. Assign IPv6 addresses to ECS instances

3. Create transit routers

4. Create VPC connections

5. Create an inter-region connection

6. Enable route synchronization

7. Test network connectivity

Step 1: Enable IPv6 for VPCs

To establish IPv6 communication for a VPC, you must first enable the IPv6 feature. Perform these steps for both VPC1 and VPC2.

1. Log on to the VPC console.

2. In the top navigation bar, select the region where the VPC resides.

3. On the VPC page, find the VPC and click Enable IPv6 in the IPv6 CIDR Block column.

4. In the Enable IPv6 dialog box, set IPv6 CIDR Block Type to Assign BGP (Multi-ISP), select Automatically Enable IPv6 for All vSwitches, and click OK.

   • If you do not select Automatically Enable IPv6 for All vSwitches, assign an IPv6 CIDR block to each vSwitch individually. For details, see Enable IPv6 for a vSwitch.

   • After enablement, the system assigns IPv6 CIDR blocks to the VPC and its vSwitches. View them in the IPv6 CIDR Block column on the VPC or vSwitch page.

   

Step 2: Assign IPv6 addresses to ECS instances

Each ECS instance must have an IPv6 address before you can establish IPv6 communication. In this example, ECS1 and ECS2 both run Alibaba Cloud Linux 3.2104 LTS (64-bit).

1. Assign an IPv6 address to each ECS instance. For details, see Assign an IPv6 address to an existing instance.

   If an IPv6 address was already assigned when you created the ECS instance, skip this step.

2. Configure the IPv6 addresses on the ECS instances. For details, see IPv6 communication.

The following screenshots show the IPv6 addresses assigned to ECS1 and ECS2.

IPv6 address of ECS1

IPv6 address of ECS2

Step 3: Create transit routers

Create one transit router in each region — China (Hangzhou) for VPC1 and China (Shanghai) for VPC2. The transit routers handle inter-region routing between the VPCs.

1. Log on to the Cloud Enterprise Network console.

2. On the Instances page, click the ID of the CEN instance.

3. Go to Basic Information > Transit Router and click Create Transit Router.

4. In the Create Transit Router dialog box, set the Region parameter and keep all other parameters at their default values. Click OK. For parameter details, see Create a transit router.

Transit router creation takes a few minutes. Wait until the transit router status changes to Active before proceeding to the next step.

Repeat this step to create a transit router in the other region.

Step 4: Create VPC connections

Connect each VPC to its regional transit router.

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. On the Basic Information > Transit Router tab, find the transit router and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, configure the parameters and click OK.

Connect VPC1 to the transit router in China (Hangzhou) and VPC2 to the transit router in China (Shanghai). The table below describes the key parameters. Keep all other parameters at their default values. For full parameter details, see Create a VPC connection.

Repeat this step to create the VPC connection in the other region.

Step 5: Create an inter-region connection

After connecting the VPCs to their transit routers, create an inter-region connection to allow cross-region traffic between them.

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. On the Basic Information > Transit Router tab, find a transit router and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, configure the parameters and click OK.

The table below describes the key parameters. Keep all other parameters at their default values. For details, see Create an inter-region connection.

Step 6: Enable route synchronization

By default, Enterprise Edition transit routers do not advertise IPv6 routes to connected VPCs. Enable route synchronization so the transit routers can push IPv6 routes to VPC1 and VPC2.

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. On the Basic Information > Transit Router tab, click the ID of the transit router in China (Hangzhou).

4. On the Intra-region Connections tab, find the VPC1 connection and enable route synchronization in the Route Synchronization column.

5. Repeat this step for the VPC2 connection on the transit router in China (Shanghai).

After route synchronization is enabled, the transit router automatically pushes routes to the connected VPCs. Click Details in the Route Synchronization column to verify the synchronized routes on the Network Routes tab.

Routes of VPC1

Routes of VPC2

Step 7: Test network connectivity

Verify that VPC1 and VPC2 can communicate over IPv6.

1. Log on to ECS1 in VPC1. For connection methods, see Connect to an ECS instance.

2. Run the following command to ping ECS2 in VPC2 using its IPv6 address:

   ping6 <IPv6 address of ECS2>

If ECS1 receives ICMP echo reply packets as shown below, IPv6 communication between the two VPCs is working correctly.

Step 1: Create resources

1. Create a working directory and navigate into it.

   mkdir tf-CenIpv6 && cd tf-CenIpv6

2. Create the main.tf configuration file.

   touch main.tf

3. Open main.tf, paste the following configuration, and save the file. This file defines all required resources, including two VPCs, four vSwitches, two ECS instances with IPv6 enabled, security groups, a CEN instance, two transit routers, VPC attachments, and an inter-region peer attachment.

   variable "pname" {
     description = "The prefix name for resources"
     type        = string
     default     = "tf-CenIpv6"
   }
   
   variable "default_region_id" {
     description = "The default region id"
     type        = string
     default     = "cn-hangzhou"
   }
   
   variable "hangzhou_region_id" {
     description = "The hangzhou region id"
     type        = string
     default     = "cn-hangzhou"
   }
   
   variable "shanghai_region_id" {
     description = "The shanghai region id"
     type        = string
     default     = "cn-shanghai"
   }
   
   variable "hangzhou_az_list" {
     description = "List of availability zones to use"
     type        = list(string)
     default     = ["cn-hangzhou-j", "cn-hangzhou-k"]
   }
   
   variable "shanghai_az_list" {
     description = "List of availability zones to use"
     type        = list(string)
     default     = ["cn-shanghai-m", "cn-shanghai-n"]
   }
   
   # --- provider ---
   provider "alicloud" { # default hangzhou
     region = var.default_region_id
   }
   
   provider "alicloud" {
     alias  = "hangzhou"
     region = var.hangzhou_region_id
   }
   
   provider "alicloud" {
     alias  = "shanghai"
     region = var.shanghai_region_id
   }
   
   # --- 2 vpc and 4 vsw ---
   resource "alicloud_vpc" "vpc1" {
     provider    = alicloud.hangzhou
     vpc_name    = "${var.pname}-vpc1"
     cidr_block  = "10.0.0.0/16"
     enable_ipv6 = true
   }
   resource "alicloud_vpc" "vpc2" {
     provider    = alicloud.shanghai
     vpc_name    = "${var.pname}-vpc2"
     cidr_block  = "172.16.0.0/16"
     enable_ipv6 = true
   }
   resource "alicloud_vswitch" "vsw1-1" {
     provider             = alicloud.hangzhou
     vpc_id               = alicloud_vpc.vpc1.id
     cidr_block           = "10.0.0.0/24"
     zone_id              = var.hangzhou_az_list[0]
     vswitch_name         = "${var.pname}-vsw1-1"
     enable_ipv6          = true
     ipv6_cidr_block_mask = 1 # existed
   }
   resource "alicloud_vswitch" "vsw1-2" {
     provider             = alicloud.hangzhou
     vpc_id               = alicloud_vpc.vpc1.id
     cidr_block           = "10.0.1.0/24"
     zone_id              = var.hangzhou_az_list[1]
     vswitch_name         = "${var.pname}-vsw1-2"
     enable_ipv6          = true
     ipv6_cidr_block_mask = 2
   }
   resource "alicloud_vswitch" "vsw2-1" {
     provider             = alicloud.shanghai
     vpc_id               = alicloud_vpc.vpc2.id
     cidr_block           = "172.16.0.0/24"
     zone_id              = var.shanghai_az_list[0]
     vswitch_name         = "${var.pname}-vsw2-1"
     enable_ipv6          = true
     ipv6_cidr_block_mask = 3
   }
   resource "alicloud_vswitch" "vsw2-2" {
     provider             = alicloud.shanghai
     vpc_id               = alicloud_vpc.vpc2.id
     cidr_block           = "172.16.1.0/24"
     zone_id              = var.shanghai_az_list[1]
     vswitch_name         = "${var.pname}-vsw2-2"
     enable_ipv6          = true
     ipv6_cidr_block_mask = 4
   }
   
   # --- ecs1 ---
   resource "alicloud_instance" "ecs1" {
     provider             = alicloud.hangzhou
     instance_name        = "${var.pname}-ecs1"
     instance_type        = "ecs.e-c1m1.large"
     security_groups      = [alicloud_security_group.sg1.id]
     vswitch_id           = alicloud_vswitch.vsw1-1.id
     image_id             = "aliyun_3_x64_20G_qboot_alibase_20230727.vhd"
     system_disk_category = "cloud_essd"
     private_ip           = "10.0.0.1"
     ipv6_address_count   = 1
     instance_charge_type = "PostPaid"
     user_data = base64encode(<<-EOT
       #!/bin/bash
       echo ecs_ok > /root/ok.txt
       sudo acs-plugin-manager --exec --plugin=ecs-utils-ipv6
     EOT
     )
   }
   
   # --- ecs2 ---
   resource "alicloud_instance" "ecs2" {
     provider             = alicloud.shanghai
     instance_name        = "${var.pname}-ecs2"
     instance_type        = "ecs.e-c1m1.large"
     security_groups      = [alicloud_security_group.sg2.id]
     vswitch_id           = alicloud_vswitch.vsw2-1.id
     image_id             = "aliyun_3_x64_20G_qboot_alibase_20230727.vhd"
     system_disk_category = "cloud_essd"
     private_ip           = "172.16.0.1"
     ipv6_address_count   = 1
     instance_charge_type = "PostPaid"
     user_data = base64encode(<<-EOT
       #!/bin/bash
       echo ecs_ok > /root/ok.txt
       sudo acs-plugin-manager --exec --plugin=ecs-utils-ipv6
     EOT
     )
   }
   
   # sg
   resource "alicloud_security_group" "sg1" {
     provider = alicloud.hangzhou
     name     = "${var.pname}-sg1"
     vpc_id   = alicloud_vpc.vpc1.id
   }
   resource "alicloud_security_group_rule" "allow_inbound_ssh1" {
     provider          = alicloud.hangzhou
     type              = "ingress"
     ip_protocol       = "tcp"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = "22/22"
     priority          = 1
     security_group_id = alicloud_security_group.sg1.id
     cidr_ip           = "0.0.0.0/0"
   }
   resource "alicloud_security_group_rule" "allow_inbound_icmp1" {
     provider          = alicloud.hangzhou
     type              = "ingress"
     ip_protocol       = "icmp"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = "-1/-1"
     priority          = 1
     security_group_id = alicloud_security_group.sg1.id
     cidr_ip           = "0.0.0.0/0"
   }
   resource "alicloud_security_group_rule" "allow_inbound_ipv6_icmp1" {
     provider          = alicloud.hangzhou
     type              = "ingress"
     ip_protocol       = "all"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = "-1/-1"
     priority          = 1
     security_group_id = alicloud_security_group.sg1.id
     ipv6_cidr_ip      = "::/0"
   }
   
   resource "alicloud_security_group" "sg2" {
     provider = alicloud.shanghai
     name     = "${var.pname}-sg2"
     vpc_id   = alicloud_vpc.vpc2.id
   }
   resource "alicloud_security_group_rule" "allow_inbound_ssh2" {
     provider          = alicloud.shanghai
     type              = "ingress"
     ip_protocol       = "tcp"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = "22/22"
     priority          = 1
     security_group_id = alicloud_security_group.sg2.id
     cidr_ip           = "0.0.0.0/0"
   }
   resource "alicloud_security_group_rule" "allow_inbound_icmp2" {
     provider          = alicloud.shanghai
     type              = "ingress"
     ip_protocol       = "icmp"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = "-1/-1"
     priority          = 1
     security_group_id = alicloud_security_group.sg2.id
     cidr_ip           = "0.0.0.0/0"
   }
   resource "alicloud_security_group_rule" "allow_inbound_ipv6_icmp2" {
     provider = alicloud.shanghai
   
     type              = "ingress"
     ip_protocol       = "all"
     nic_type          = "intranet"
     policy            = "accept"
     port_range        = "-1/-1"
     priority          = 1
     security_group_id = alicloud_security_group.sg2.id
     ipv6_cidr_ip      = "::/0"
   }
   
   
   # --- cen and tr ---
   resource "alicloud_cen_instance" "cen1" {
     cen_instance_name = "${var.pname}-cen1"
   }
   resource "alicloud_cen_transit_router" "tr1" {
     provider            = alicloud.hangzhou
     transit_router_name = "${var.pname}-tr1"
     cen_id              = alicloud_cen_instance.cen1.id
   }
   resource "alicloud_cen_transit_router" "tr2" {
     provider            = alicloud.shanghai
     transit_router_name = "${var.pname}-tr2"
     cen_id              = alicloud_cen_instance.cen1.id
   }
   # get tr sys table id
   data "alicloud_cen_transit_router_route_tables" "tr1" { # get tr sys table
     transit_router_id               = alicloud_cen_transit_router.tr1.transit_router_id
     transit_router_route_table_type = "System"
   }
   data "alicloud_cen_transit_router_route_tables" "tr2" {
     transit_router_id               = alicloud_cen_transit_router.tr2.transit_router_id
     transit_router_route_table_type = "System"
   }
   
   # tr-peer
   resource "alicloud_cen_transit_router_peer_attachment" "peer" {
     provider                      = alicloud.hangzhou
     cen_id                        = alicloud_cen_instance.cen1.id
     transit_router_id             = alicloud_cen_transit_router.tr1.transit_router_id
     peer_transit_router_region_id = var.shanghai_region_id
     peer_transit_router_id        = alicloud_cen_transit_router.tr2.transit_router_id
     bandwidth_type                = "DataTransfer"
     bandwidth                     = 1
     auto_publish_route_enabled    = true # default is false
   }
   resource "alicloud_cen_transit_router_route_table_association" "ass_peer1" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
   }
   resource "alicloud_cen_transit_router_route_table_propagation" "propa_peer1" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
   }
   resource "alicloud_cen_transit_router_route_table_association" "ass_peer2" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
   }
   resource "alicloud_cen_transit_router_route_table_propagation" "propa_peer2" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
   }
   
   # cidr_list
   variable "cidr_list" {
     description = "The list of Private CIDR block"
     type        = list(string)
     default     = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
   }
   
   # attach1
   resource "alicloud_cen_transit_router_vpc_attachment" "attach1" {
     provider          = alicloud.hangzhou
     cen_id            = alicloud_cen_instance.cen1.id
     transit_router_id = alicloud_cen_transit_router.tr1.transit_router_id
     vpc_id            = alicloud_vpc.vpc1.id
     zone_mappings {
       zone_id    = var.hangzhou_az_list[0]
       vswitch_id = alicloud_vswitch.vsw1-1.id
     }
     zone_mappings {
       zone_id    = var.hangzhou_az_list[1]
       vswitch_id = alicloud_vswitch.vsw1-2.id
     }
     transit_router_vpc_attachment_name    = "attach1"
     transit_router_vpc_attachment_options = { ipv6Support : "enable" }
     auto_publish_route_enabled            = true # default is false
   }
   resource "alicloud_cen_transit_router_route_table_association" "ass1" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
   }
   resource "alicloud_cen_transit_router_route_table_propagation" "propa1" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
   }
   resource "alicloud_route_entry" "vpc1_to_tr1" {
     provider              = alicloud.hangzhou
     count                 = 3
     route_table_id        = alicloud_vpc.vpc1.route_table_id
     destination_cidrblock = var.cidr_list[count.index]
     nexthop_type          = "Attachment"
     nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
   }
   
   # attach2
   resource "alicloud_cen_transit_router_vpc_attachment" "attach2" {
     provider          = alicloud.shanghai
     cen_id            = alicloud_cen_instance.cen1.id
     transit_router_id = alicloud_cen_transit_router.tr2.transit_router_id
     vpc_id            = alicloud_vpc.vpc2.id
     zone_mappings {
       zone_id    = var.shanghai_az_list[0]
       vswitch_id = alicloud_vswitch.vsw2-1.id
     }
     zone_mappings {
       zone_id    = var.shanghai_az_list[1]
       vswitch_id = alicloud_vswitch.vsw2-2.id
     }
     transit_router_vpc_attachment_name    = "attach2"
     transit_router_vpc_attachment_options = { ipv6Support : "enable" }
     auto_publish_route_enabled            = true # default is false
   }
   resource "alicloud_cen_transit_router_route_table_association" "ass2" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
   }
   resource "alicloud_cen_transit_router_route_table_propagation" "propa2" {
     transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
     transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
   }
   resource "alicloud_route_entry" "vpc2_to_tr2" {
     provider              = alicloud.shanghai
     count                 = 3
     route_table_id        = alicloud_vpc.vpc2.route_table_id
     destination_cidrblock = var.cidr_list[count.index]
     nexthop_type          = "Attachment"
     nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
   }
   
   output "ecs1_login_address" {
     value = "https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=${var.hangzhou_region_id}&instanceId=${alicloud_instance.ecs1.id}"
   }
   
   output "ecs2_login_address" {
     value = "https://ecs-workbench.aliyun.com/?from=EcsConsole&instanceType=ecs&regionId=${var.shanghai_region_id}&instanceId=${alicloud_instance.ecs2.id}"
   }

4. Initialize the working directory.

   terraform init

5. Apply the configuration. Terraform displays a preview of resources to be created. Enter yes to confirm.

   terraform apply

   After terraform apply completes, the Outputs section displays the login addresses for ECS1 and ECS2.

Step 2: Test network connectivity

1. Log on to ECS2 (instance name: tf-CenIpv6-ecs2). Copy the ecs2_login_address from the Terraform Outputs and open it in a browser. When prompted, select Temporary SSH Key-based authentication.

   

2. Run the following command to get the IPv6 address of ECS2:

   ifconfig

   

3. Log on to ECS1 (instance name: tf-CenIpv6-ecs1). Copy the ecs1_login_address from the Terraform Outputs and open it in a browser. When prompted, select Temporary SSH Key-based authentication.

   

4. Run the following command to ping ECS2 using the IPv6 address you obtained in step 2:

   ping6 <IPv6 address of ECS2>

   If ECS1 receives ICMP echo reply packets as shown above, IPv6 communication between VPC1 and VPC2 is working correctly.

   

Step 3: Release resources

When you no longer need the resources, run the following command to delete them and stop incurring charges.

terraform destroy --auto-approve