All Products
Search

This Product

    Cloud Enterprise Network:Enable inter-region IPv6 communication between VPCs

    Document Center

    Cloud Enterprise Network:Enable inter-region IPv6 communication between VPCs

    Last Updated:Sep 02, 2026

    Use an Enterprise Edition transit router to enable IPv6 communication between VPCs in different regions.

    Note

    The sample code in this topic supports one-click execution. Run it now

    Scenario

    image

    A company has two IPv4 VPCs: VPC1 in the China (Hangzhou) region and VPC2 in the China (Shanghai) region. Both VPCs contain ECS instances with deployed applications. The company needs to enable IPv6 communication between these VPCs to support business growth.

    Procedure

    Two configuration methods are available: console and Terraform. Choose the one that suits your needs.

    Console

    Prerequisites

    • You have created an IPv4 VPC in the China (Hangzhou) region and another in the China (Shanghai) region. Both VPCs have ECS instances with deployed applications. For more information, see Create a VPC with an IPv4 CIDR block.

    • You have created a Cloud Enterprise Network (CEN) instance. For more information, see Create a CEN instance.

    Step 1: Enable IPv6 for the VPCs

    To enable IPv6 communication, first enable IPv6 for both VPC1 and VPC2.

    Important

    You can enable IPv6 for VPCs and vSwitches when you create them. If you have already enabled IPv6 and assigned IPv6 CIDR blocks to your VPCs and vSwitches, you can skip this step.

    1. Log on to the VPC console.

    2. In the top navigation bar, select the region where the VPC is located.

    3. On the VPC page, find the target VPC, and then click Enable IPv6 in the IPv6 CIDR column.

    4. In the Enable IPv6 dialog box, set IPv6 CIDR Block Type to Assign BGP (Multi-ISP), select Automatically enable IPv6 for all vSwitches in the VPC, and then click OK.

      • If you do not select Automatically enable IPv6 for all vSwitches in the VPC, you must enable IPv6 for each vSwitch individually. For more information, see Enable IPv6 for a vSwitch.

      • After you enable IPv6 for the VPC and its vSwitches, the system assigns an IPv6 CIDR block to each. You can view the assigned IPv6 CIDR blocks in the IPv6 CIDR column on the VPC and vSwitch pages.

    Step 2: Configure IPv6 addresses for the ECS instances

    Resources that communicate over IPv6 must have IPv6 addresses. Configure IPv6 addresses for ECS1 and ECS2 in this scenario. Both instances use the Alibaba Cloud Linux 3.2104 LTS 64-bit operating system.

    1. Assign an IPv6 address to each ECS instance. For more information, see Assign an IPv6 address to an existing instance.

      Note

      If you already assigned an IPv6 address to an ECS instance when you created it, you can skip this step.

    2. Configure the IPv6 address on each ECS instance. For more information, see Enable IPv6 communication.

      After configuration, the IPv6 addresses for ECS1 and ECS2 are shown in the following figures.

      ECS1 IPv6 address

      [root@iZ5txxx ipZ ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.xxx.109  netmask 255.255.255.0  broadcast 10.xxx.255
        inet6 240b:xxx:b0b6:838  prefixlen 128  scopeid 0x0<global>
        inet6 fe80::xxx:44b2  prefixlen 64  scopeid 0x20<link>
        ether 00:xxx:44:b2  txqueuelen 1000  (Ethernet)
        RX packets 2864  bytes 476397 (465.2 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3255  bytes 475131 (463.9 KiB)
        TX errors 0  dropped 0  overruns 0  carrier 0  collisions 0

      In the output, inet6 240b:xxx:b0b6:838 is the global IPv6 address obtained by ECS1.

      ECS2 IPv6 address

      [root@iZxxx byZ ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.xxx.27  netmask 255.255.255.0  broadcast 192.xxx.255
        inet6 fe80::xxx:0:21c  prefixlen 64  scopeid 0x20<link>
        inet6 240b:xxx:xxx:a97c:9875  prefixlen 128  scopeid 0x0<global>
        ether xxx:1c  txqueuelen 1000  (Ethernet)
        RX packets 2063  bytes 387038 (377.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2560  bytes 378127 (369.2 KiB)
        TX errors 0  dropped 0  overruns 0  carrier 0  collisions 0

      In the output, inet6 240b:xxx:xxx:a97c:9875 prefixlen 128 scopeid 0x0<global> is the IPv6 global address assigned to ECS2.

    Step 3: Create transit router instances

    Within your CEN instance, create a transit router in the China (Hangzhou) region and another in the China (Shanghai) region. These transit routers enable inter-region communication between your VPCs.

    1. Log on to the CEN console.

    2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

    3. On the Basic Settings > Transit Router tab, click Create Transit Router.

    4. In the Create Transit Router dialog box, configure the transit router, and then click OK.

      When creating a transit router instance, configure only the Region. Leave the other parameters at their default values. For more information, see Create a transit router instance.

    Step 4: Create VPC connections

    To establish inter-region communication, first connect your VPCs to their respective transit routers.

    1. Log on to the CEN console.

    2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

    3. On the Basic Settings > Transit Router tab, find either of the transit routers you created in Step 3. In the Actions column, click Create Connection.

    4. On the Connection with Peer Network Instance page, configure the connection settings, and then click OK.

      Connect VPC1 to the transit router in the China (Hangzhou) region and connect VPC2 to the transit router in the China (Shanghai) region using the following parameters. Leave other parameters at their default values. For more information, see Create a VPC connection.

      Parameter

      Description

      VPC1

      VPC2

      Network Type

      Select VPC.

      Region

      Select the region of the network instance that you want to connect.

      Select China (Hangzhou).

      Select China (Shanghai).

      IPv6

      Enables IPv6 for the VPC connection. Disabled by default.

      Enable this feature to allow IPv6 communication through the Enterprise Edition transit router.

      Note

      You can enable the IPv6 feature for an existing VPC connection. For more information, see Enable IPv6 for an existing VPC connection.

      Enable this feature.

      Enable this feature.

      Transit Router

      The system automatically displays the transit router that is created in the current region.

      Account

      Select the type of account that owns the network instance.

      Select Your Account.

      Select Your Account.

      Networks

      Select the VPC that you want to connect.

      Select VPC1.

      Select VPC2.

      vSwitch

      Select vSwitches from the availability zones that the transit router supports.

      • If the Enterprise Edition transit router supports only one availability zone in the current region, you must select one vSwitch in that availability zone.

      • If the Enterprise Edition transit router supports multiple availability zones in the current region, you must select at least one vSwitch in at least two different availability zones. These vSwitches enable zone-level disaster recovery for traffic between the VPC and the transit router. Selecting one vSwitch in each availability zone reduces traffic detours, lowers transmission latency, and improves performance.

      If you do not have a vSwitch in a required availability zone, you must create one. For more information, see Create a vSwitch.

      Advanced Settings

      Keep the default settings, which enable the three advanced features.

    Step 5: Create an inter-region connection

    After connecting the VPCs to their respective Enterprise Edition transit routers, create an inter-region connection to enable communication between them.

    1. Log on to the CEN console.

    2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

    3. On the Basic Settings > Transit Router tab, find either of the transit routers you created in Step 3. In the Actions column of the transit router, click Create Connection.

    4. On the Connection with Peer Network Instance page, configure the inter-region connection, and then click OK.

      The following table lists only the key parameters. Leave other parameters at their default values. For more information, see Create an inter-region connection by using an Enterprise Edition transit router.

      Parameter

      Description

      Network Type

      Select Inter-region Connection.

      Region

      Select one of the regions that you want to connect.

      In this topic, select China (Hangzhou).

      Peer Region

      Select the other region that you want to connect.

      In this topic, select China (Shanghai).

      Bandwidth Allocation Mode

      Select the bandwidth allocation mode for the inter-region connection.

      In this topic, select Pay-By-Data-Transfer. You are charged for the actual data transfer over the inter-region connection.

      Bandwidth

      Enter the bandwidth value for the inter-region connection. Unit: Mbit/s.

      If you select Pay-By-Data-Transfer as the bandwidth allocation mode, this value is the peak bandwidth for the inter-region connection.

      Default Line Type

      Select the line type for the inter-region connection.

      Keep the default value. For more information about line types, see Line types.

      Advanced Settings

      Keep the default settings, which enable the three advanced features.

    Step 6: Enable route synchronization

    Enable route synchronization for both the VPC1 and VPC2 connections to allow the transit router to advertise IPv6 routes to the VPCs.

    1. Log on to the CEN console.

    2. On the CEN Instance page, find the target CEN instance and click its ID.

    3. On the Basic Settings > Transit Router tab, find the transit router in the China (Hangzhou) region and click its ID.

    4. On the Intra-Region Connections tab, find the connection for VPC1, and enable route synchronization for the network instance in the Route Synchronization column.

    5. Repeat the same steps to enable route synchronization for the VPC2 connection on the transit router in the China (Shanghai) region.

      After route synchronization is enabled, the Enterprise Edition transit router automatically synchronizes routes to the network instances. You can click Details in the Route Synchronization column to go to the Network Instance Route Table tab and view the synchronization status.

      VPC1 route entries

      On the Network Instance Route Information tab of the transit router, filter the network instance for VPC1. VPC1 has learned the following route entries over CEN from the VPC in the China (Shanghai) region:

      • IPv4 routes: 172.16.0.0/24 and 172.16.1.0/24. The route type is CEN, the next hop is China (Shanghai), and the next hop type is VPC.

      • IPv6 routes: two 240x:xxxx:xxxx::/64 routes. The route type is CEN, the next hop is China (Shanghai), and the next hop type is VPC.

      VPC2 route entries

      In the network instance route information of VPC2, the route entries whose route type is CEN, next hop is China (Hangzhou), and next hop type is VPC are the routes learned from VPC1. They include the IPv4 CIDR blocks (such as 10.0.0.0/24 and 10.0.1.0/24) and the IPv6 CIDR blocks (/64 blocks that start with 240). The status of these entries is Available, which indicates that VPC2 has successfully received the routes published by VPC1.

    Step 7: Test the connectivity

    IPv6 communication between VPC1 and VPC2 is now enabled. Verify the connectivity as follows.

    Important

    By default, security group rules do not allow IPv6 traffic. Before you proceed, ensure that the security group rules for ECS1 and ECS2 allow IPv6 communication. For more information, see View security group rules and Add a security group rule.

    For example, add a security group rule to allow inbound ICMP (IPv6) traffic from the ::/0 CIDR block to test IPv6 connectivity.

    1. Log on to the ECS1 instance in VPC1. For more information, see Connection methods.

    2. Run the following command to ping the ECS2 instance in VPC2 from the ECS1 instance to verify connectivity.

      ping6 <IPv6 address of ECS2>

      The replies shown in the figure confirm that IPv6 communication between the VPCs is successful.

      [root@iZ5ts             hipZ ~]# ping6 240b:xxx:xxx:xxx:xxx:a97c:9875
PING 240b:                          a97c:9875(240b:4xxx:xxx:xxx:xxx:a97c:9875) 56 data bytes
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=1 ttl=62 time=192 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=2 ttl=62 time=191 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=3 ttl=62 time=191 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=4 ttl=62 time=191 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=5 ttl=62 time=191 ms
^Z
[2]+  Stopped                 ping6 240b:xxx:xxx:xxx:xxx:a97c:9875

    Terraform

    You can use Terraform to build the environment for this scenario. For information about how to install and configure Terraform, see Install Terraform.

    The following steps describe how to run Terraform v1.9.8 on a Linux host. Before you begin, make sure that you have completed Authentication.

    Note

    Some resources in this tutorial incur charges. Release them when no longer needed to avoid unnecessary costs.

    Step 1: Create resources

    1. Create a directory for this scenario and navigate to it.

      mkdir tf-CenIpv6 && cd tf-CenIpv6

    2. Create a main.tf file to define the resources.

      touch main.tf

    3. Open the main.tf file, and then copy and paste the following code into it. Save the file. This file contains the resources and their configurations for this scenario.

      variable "pname" {
  description = "The prefix name for resources"
  type        = string
  default     = "tf-CenIpv6"
}

variable "default_region_id" {
  description = "The default region id"
  type        = string
  default     = "cn-hangzhou"
}

variable "hangzhou_region_id" {
  description = "The hangzhou region id"
  type        = string
  default     = "cn-hangzhou"
}

variable "shanghai_region_id" {
  description = "The shanghai region id"
  type        = string
  default     = "cn-shanghai"
}

variable "hangzhou_az_list" {
  description = "List of availability zones to use"
  type        = list(string)
  default     = ["cn-hangzhou-j", "cn-hangzhou-k"]
}

variable "shanghai_az_list" {
  description = "List of availability zones to use"
  type        = list(string)
  default     = ["cn-shanghai-m", "cn-shanghai-n"]
}

# --- provider ---
provider "alicloud" { # default hangzhou
  region = var.default_region_id
}

provider "alicloud" {
  alias  = "hangzhou"
  region = var.hangzhou_region_id
}

provider "alicloud" {
  alias  = "shanghai"
  region = var.shanghai_region_id
}

# --- 2 vpc and 4 vsw ---
resource "alicloud_vpc" "vpc1" {
  provider    = alicloud.hangzhou
  vpc_name    = "${var.pname}-vpc1"
  cidr_block  = "10.0.0.0/16"
  enable_ipv6 = true
}
resource "alicloud_vpc" "vpc2" {
  provider    = alicloud.shanghai
  vpc_name    = "${var.pname}-vpc2"
  cidr_block  = "172.16.0.0/16"
  enable_ipv6 = true
}
resource "alicloud_vswitch" "vsw1-1" {
  provider             = alicloud.hangzhou
  vpc_id               = alicloud_vpc.vpc1.id
  cidr_block           = "10.0.0.0/24"
  zone_id              = var.hangzhou_az_list[0]
  vswitch_name         = "${var.pname}-vsw1-1"
  enable_ipv6          = true
  ipv6_cidr_block_mask = 1 # The mask for the IPv6 CIDR block of the vSwitch.
}
resource "alicloud_vswitch" "vsw1-2" {
  provider             = alicloud.hangzhou
  vpc_id               = alicloud_vpc.vpc1.id
  cidr_block           = "10.0.1.0/24"
  zone_id              = var.hangzhou_az_list[1]
  vswitch_name         = "${var.pname}-vsw1-2"
  enable_ipv6          = true
  ipv6_cidr_block_mask = 2
}
resource "alicloud_vswitch" "vsw2-1" {
  provider             = alicloud.shanghai
  vpc_id               = alicloud_vpc.vpc2.id
  cidr_block           = "172.16.0.0/24"
  zone_id              = var.shanghai_az_list[0]
  vswitch_name         = "${var.pname}-vsw2-1"
  enable_ipv6          = true
  ipv6_cidr_block_mask = 3
}
resource "alicloud_vswitch" "vsw2-2" {
  provider             = alicloud.shanghai
  vpc_id               = alicloud_vpc.vpc2.id
  cidr_block           = "172.16.1.0/24"
  zone_id              = var.shanghai_az_list[1]
  vswitch_name         = "${var.pname}-vsw2-2"
  enable_ipv6          = true
  ipv6_cidr_block_mask = 4
}

# --- ecs1 ---
resource "alicloud_instance" "ecs1" {
  provider             = alicloud.hangzhou
  instance_name        = "${var.pname}-ecs1"
  instance_type        = "ecs.e-c1m1.large"
  security_groups      = [alicloud_security_group.sg1.id]
  vswitch_id           = alicloud_vswitch.vsw1-1.id
  image_id             = "aliyun_3_x64_20G_qboot_alibase_20230727.vhd"
  system_disk_category = "cloud_essd"
  private_ip           = "10.0.0.1"
  ipv6_address_count   = 1
  instance_charge_type = "PostPaid"
  user_data = base64encode(<<-EOT
    #!/bin/bash
    echo ecs_ok > /root/ok.txt
    sudo acs-plugin-manager --exec --plugin=ecs-utils-ipv6
  EOT
  )
}

# --- ecs2 ---
resource "alicloud_instance" "ecs2" {
  provider             = alicloud.shanghai
  instance_name        = "${var.pname}-ecs2"
  instance_type        = "ecs.e-c1m1.large"
  security_groups      = [alicloud_security_group.sg2.id]
  vswitch_id           = alicloud_vswitch.vsw2-1.id
  image_id             = "aliyun_3_x64_20G_qboot_alibase_20230727.vhd"
  system_disk_category = "cloud_essd"
  private_ip           = "172.16.0.1"
  ipv6_address_count   = 1
  instance_charge_type = "PostPaid"
  user_data = base64encode(<<-EOT
    #!/bin/bash
    echo ecs_ok > /root/ok.txt
    sudo acs-plugin-manager --exec --plugin=ecs-utils-ipv6
  EOT
  )
}

# sg
resource "alicloud_security_group" "sg1" {
  provider = alicloud.hangzhou
  name     = "${var.pname}-sg1"
  vpc_id   = alicloud_vpc.vpc1.id
}
resource "alicloud_security_group_rule" "allow_inbound_ssh1" {
  provider          = alicloud.hangzhou
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "22/22"
  priority          = 1
  security_group_id = alicloud_security_group.sg1.id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_inbound_icmp1" {
  provider          = alicloud.hangzhou
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.sg1.id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_inbound_ipv6_icmp1" {
  provider          = alicloud.hangzhou
  type              = "ingress"
  ip_protocol       = "all"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.sg1.id
  ipv6_cidr_ip      = "::/0"
}

resource "alicloud_security_group" "sg2" {
  provider = alicloud.shanghai
  name     = "${var.pname}-sg2"
  vpc_id   = alicloud_vpc.vpc2.id
}
resource "alicloud_security_group_rule" "allow_inbound_ssh2" {
  provider          = alicloud.shanghai
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "22/22"
  priority          = 1
  security_group_id = alicloud_security_group.sg2.id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_inbound_icmp2" {
  provider          = alicloud.shanghai
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.sg2.id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_inbound_ipv6_icmp2" {
  provider = alicloud.shanghai

  type              = "ingress"
  ip_protocol       = "all"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.sg2.id
  ipv6_cidr_ip      = "::/0"
}


# --- cen and tr ---
resource "alicloud_cen_instance" "cen1" {
  cen_instance_name = "${var.pname}-cen1"
}
resource "alicloud_cen_transit_router" "tr1" {
  provider            = alicloud.hangzhou
  transit_router_name = "${var.pname}-tr1"
  cen_id              = alicloud_cen_instance.cen1.id
}
resource "alicloud_cen_transit_router" "tr2" {
  provider            = alicloud.shanghai
  transit_router_name = "${var.pname}-tr2"
  cen_id              = alicloud_cen_instance.cen1.id
}
# Get the system route table ID of the transit router.
data "alicloud_cen_transit_router_route_tables" "tr1" { # Get the system route table of the transit router.
  transit_router_id               = alicloud_cen_transit_router.tr1.transit_router_id
  transit_router_route_table_type = "System"
}
data "alicloud_cen_transit_router_route_tables" "tr2" {
  transit_router_id               = alicloud_cen_transit_router.tr2.transit_router_id
  transit_router_route_table_type = "System"
}

# tr-peer
resource "alicloud_cen_transit_router_peer_attachment" "peer" {
  provider                      = alicloud.hangzhou
  cen_id                        = alicloud_cen_instance.cen1.id
  transit_router_id             = alicloud_cen_transit_router.tr1.transit_router_id
  peer_transit_router_region_id = var.shanghai_region_id
  peer_transit_router_id        = alicloud_cen_transit_router.tr2.transit_router_id
  bandwidth_type                = "DataTransfer"
  bandwidth                     = 1
  auto_publish_route_enabled    = true # default is false
}
resource "alicloud_cen_transit_router_route_table_association" "ass_peer1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa_peer1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_association" "ass_peer2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa_peer2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}

# cidr_list
variable "cidr_list" {
  description = "The list of Private CIDR block"
  type        = list(string)
  default     = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
}

# attach1
resource "alicloud_cen_transit_router_vpc_attachment" "attach1" {
  provider          = alicloud.hangzhou
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr1.transit_router_id
  vpc_id            = alicloud_vpc.vpc1.id
  zone_mappings {
    zone_id    = var.hangzhou_az_list[0]
    vswitch_id = alicloud_vswitch.vsw1-1.id
  }
  zone_mappings {
    zone_id    = var.hangzhou_az_list[1]
    vswitch_id = alicloud_vswitch.vsw1-2.id
  }
  transit_router_vpc_attachment_name    = "attach1"
  transit_router_vpc_attachment_options = { ipv6Support : "enable" }
  auto_publish_route_enabled            = true # default is false
}
resource "alicloud_cen_transit_router_route_table_association" "ass1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
resource "alicloud_route_entry" "vpc1_to_tr1" {
  provider              = alicloud.hangzhou
  count                 = 3
  route_table_id        = alicloud_vpc.vpc1.route_table_id
  destination_cidrblock = var.cidr_list[count.index]
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}

# attach2
resource "alicloud_cen_transit_router_vpc_attachment" "attach2" {
  provider          = alicloud.shanghai
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr2.transit_router_id
  vpc_id            = alicloud_vpc.vpc2.id
  zone_mappings {
    zone_id    = var.shanghai_az_list[0]
    vswitch_id = alicloud_vswitch.vsw2-1.id
  }
  zone_mappings {
    zone_id    = var.shanghai_az_list[1]
    vswitch_id = alicloud_vswitch.vsw2-2.id
  }
  transit_router_vpc_attachment_name    = "attach2"
  transit_router_vpc_attachment_options = { ipv6Support : "enable" }
  auto_publish_route_enabled            = true # default is false
}
resource "alicloud_cen_transit_router_route_table_association" "ass2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_route_entry" "vpc2_to_tr2" {
  provider              = alicloud.shanghai
  count                 = 3
  route_table_id        = alicloud_vpc.vpc2.route_table_id
  destination_cidrblock = var.cidr_list[count.index]
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}

output "ecs1_login_address" {
  value = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=${var.hangzhou_region_id}&instanceId=${alicloud_instance.ecs1.id}"
}

output "ecs2_login_address" {
  value = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=${var.shanghai_region_id}&instanceId=${alicloud_instance.ecs2.id}"
}

    4. Initialize Terraform in the directory.

      terraform init

    5. Create the resources. Terraform first previews the plan. After you confirm, enter yes to start creating the resources.

      terraform apply

    Step 2: Verify connectivity

    IPv6 communication between VPC1 and VPC2 is now enabled. Verify the connectivity as follows.

    1. Log on to the ECS2 instance (instance name: tf-CenIpv6-ecs2).

      In the Terraform outputs, find the logon URL for ECS2, copy it to your browser, and open it. When you log on, select Temporary SSH key-based as the authentication method.

      Outputs:

ecs1_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-hangzhou&instanceId=i-bp1g"
ecs2_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-shanghai&instanceId=i-uf6j"

    2. On the ECS2 instance, run the following command to view its IPv6 address:

      ifconfig
      [root@iZxxx byZ ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.xxx.27  netmask 255.255.255.0  broadcast 192.xxx.255
        inet6 fe80::xxx:0:21c  prefixlen 64  scopeid 0x20<link>
        inet6 240b:xxx:xxx:a97c:9875  prefixlen 128  scopeid 0x0<global>
        ether xxx:1c  txqueuelen 1000  (Ethernet)
        RX packets 2063  bytes 387038 (377.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2560  bytes 378127 (369.2 KiB)
        TX errors 0  dropped 0  overruns 0  carrier 0  collisions 0

      In the output, inet6 240b:xxx:xxx:a97c:9875 prefixlen 128 scopeid 0x0<global> is the IPv6 global address assigned to ECS2.

    3. Log on to the ECS1 instance (instance name: tf-CenIpv6-ecs1).

      In the Terraform outputs, find the logon URL for ECS1, copy it to your browser, and open it. When you log on, select Temporary SSH key-based as the authentication method.

      Outputs:

ecs1_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-hangzhou&instanceId=i-bp1g4zxxx"
ecs2_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-shanghai&instanceId=i-uf6ja1xxx"

    4. Run the following command to ping the ECS2 instance in VPC2 from the ECS1 instance to verify connectivity.

      ping6 <IPv6 address of ECS2>
      [root@iZ5ts             hipZ ~]# ping6 240b:xxx:xxx:xxx:xxx:a97c:9875
PING 240b:                          a97c:9875(240b:4xxx:xxx:xxx:xxx:a97c:9875) 56 data bytes
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=1 ttl=62 time=192 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=2 ttl=62 time=191 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=3 ttl=62 time=191 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=4 ttl=62 time=191 ms
64 bytes from 240b:xxx:xxx:xxx:xxx:a97c:9875: icmp_seq=5 ttl=62 time=191 ms
^Z
[2]+  Stopped                 ping6 240b:xxx:xxx:xxx:xxx:a97c:9875

      The replies shown in the figure confirm that IPv6 communication between the VPCs is successful.

    Step 3: Release resources

    Run the following command to release the resources when they are no longer needed.

    terraform destroy --auto-approve