When multiple transit routers (TRs) in a Cloud Enterprise Network (CEN) connect to an Express Connect Router (ECR), multiple traffic paths exist between on-premises data centers and cloud Virtual Private Clouds (VPCs). This topic explains how the system selects traffic paths in this scenario and how to override the default selection when needed.
When to override the default path
The default path selection is automatic. Override it when you need to:
Reduce latency — replace a geographically circuitous path with a shorter one.
Reduce costs — route traffic through lower-cost inter-region links when bandwidth pricing varies.
Rebalance load — redirect traffic away from a congested transit router to improve throughput.
See Override the default path for the procedure.
Scenario examples
Two examples illustrate the routing rules at increasing levels of complexity. Identify your topology before reading:
Topology | Example |
All transit routers are directly connected to the ECR | Example 1 |
Some transit routers are not directly connected to the ECR | Example 2 |
Example 1: All transit routers are connected to the ECR
An enterprise has a data center in the China (Hangzhou) region and services deployed in VPCs in the China (Hangzhou) and China (Shanghai) regions. The ECR is attached to TR1 (Hangzhou), TR2 (Shanghai), and the VBR (Hangzhou). An inter-region connection links TR1 and TR2.
Outbound traffic paths
Because both TR1 and TR2 are directly connected to the ECR, each transit router routes outbound traffic to the ECR directly:
Traffic from VPC1 reaches TR1, then exits to the ECR through TR1.
Traffic from VPC2 reaches TR2, then exits to the ECR through TR2.
Inbound traffic paths
Inbound traffic follows the symmetrical path:
Traffic destined for VPC1 enters the cloud through TR1.
Traffic destined for VPC2 enters the cloud through TR2.
Example 2: Some TRs are not connected to the ECR
An enterprise has three data centers (data center 1, data center 2, data center 3) connected to VBR1 (China (Beijing)), VBR2 (China (Shanghai)), and VBR3 (China (Hangzhou)). Services are deployed in VPCs across the same three regions. TR1 (Beijing) and TR2 (Shanghai) are connected to the ECR; TR3 (Hangzhou) is not. All three TRs are interconnected.
Outbound traffic paths
Outbound traffic path from VPC1 | Outbound traffic path from VPC2 | Outbound traffic path from VPC3 |
|
|
|
VPC1 and VPC2 each have a transit router directly connected to the ECR, so their outbound traffic exits directly:
Traffic from VPC1 exits through TR1 to the ECR.
Traffic from VPC2 exits through TR2 to the ECR.
TR3 is not directly connected to the ECR, so the system selects an intermediate transit router for VPC3:
Destination | Selected transit router | Reason |
Data center 1 (VBR1 in Beijing) | TR1 | TR1 is in the same region as VBR1 |
Data center 2 (VBR2 in Shanghai) | TR2 | TR2 is in the same region as VBR2 |
Data center 3 (VBR3 in Hangzhou) | TR1 | Neither TR1 nor TR2 is in the same region as VBR3; |
Inbound traffic paths
Inbound traffic path to VPC1 | Inbound traffic path to VPC2 | Inbound traffic path to VPC3 |
|
|
|
Inbound traffic follows the symmetrical path determined by the outbound selection.
Override the default path
When the system falls back to lexicographical order (no transit router is co-located with the destination VBR), manually designate a different transit router as the default path.
Default traffic path between VPC3 and IDC3 | Traffic path between VPC3 and IDC3 after modification |
|
|
In Example 2, traffic between VPC3 and IDC3 defaults to TR1 because cn-beijing sorts before cn-shanghai. Setting TR2 as the default redirects this traffic through TR2 instead.
Procedure
On the Basic Information page of the ECR, find the target transit router and click Set as Default in the Actions column.
Note: Setting a transit router as default changes the MED value the ECR assigns to routes sent to that transit router from 3000 to 2000. This makes the designated transit router preferred over other inter-region transit routers. Both the outbound and inbound paths are updated simultaneously.
How it works
The routing rules are implemented through Multi-Exit Discriminator (MED) values assigned to Border Gateway Protocol (BGP) routes in the transit router and ECR route tables.
MED values
MED is a BGP path attribute. On Alibaba Cloud, MED uses three discrete values:
MED value | Meaning | When assigned |
1000 | Same-region route | Source VBR (or VPC) and receiving transit router are in the same region |
2000 | Default (manually designated) | A transit router is set as default on the ECR via Set As Default |
3000 | Inter-region route | Source VBR (or VPC) and receiving transit router are in different regions |
A lower MED value takes priority. The MED column in the ECR route entry list shows the value for each route.
Note: MED is propagated only between ECRs and transit routers, and between transit routers. It is not propagated to VBRs or VPCs.
MED assignment — outbound direction (ECR to transit router)
When the ECR propagates a route to a transit router, it sets the MED based on whether the source VBR and the destination transit router are in the same region:
Same region → MED = 1000
Different regions → MED = 3000
MED assignment — inbound direction (transit router to ECR)
When a transit router propagates a route to the ECR, it sets the MED based on whether the source VPC and the propagating transit router are in the same region:
Same region → MED = 1000
Different regions (route received from another transit router) → MED = 3000
Route priority
Outbound traffic: transit router route selection
Outbound traffic is routed based on the routes of an Enterprise Edition transit router. When a transit router learns routes to the same destination CIDR block from multiple next hops, it selects the route using the following attributes in priority order:
Note: P1 has the highest priority; P4 is the tiebreaker. If two routes share the same value for an attribute, the next attribute is compared.
Priority | Attribute | Selection rule |
P1 | AS_Path | Shorter AS_Path preferred |
P2 | Local preference | Intra-region connections preferred over inter-region connections; ECR preferred over inter-region transit router as next hop |
P3 | MED | Lower value preferred; set a transit router as default on the ECR to change its MED from 3000 to 2000, making it preferred over other inter-region transit routers |
P4 | Lexicographical order | Region IDs sorted alphabetically; the route from the lexicographically first region ID wins (for example, |
For the full transit router route priority reference, see How transit routers work.
Inbound traffic: ECR route selection
Inbound traffic is routed based on the routes of the ECR. When the ECR learns routes to the same destination CIDR block from multiple transit routers, it selects the route using the following attributes in priority order:
Note: P1 has the highest priority; P4 is the tiebreaker. If two routes share the same value for an attribute, the next attribute is compared.
Priority | Attribute | Selection rule |
P1 | MED | Lower value preferred; same-region transit routers send routes with MED 1000, inter-region TRs send routes with MED 3000 |
P2 | Local preference | If the VBR's region has a direct ECR+TR connection, traffic enters through that connection |
P3 | Default egress | If no direct ECR+TR connection exists in the VBR's region, routes tagged as default egress are preferred |
P4 | Lexicographical order | Region IDs sorted alphabetically; the route from the lexicographically first region ID wins |
Principle examples
The following three scenarios explain the route selection principles in increasing order of complexity. All scenarios assume equal AS_Path lengths.
Scenario 1: Multiple transit routers, only one connected to the ECR
A company's on-premises data center connects to a VBR in China (Hangzhou). The company has services in VPCs in China (Hangzhou) and China (Shanghai). The ECR is attached to TR1 (Hangzhou) and the VBR. TR1 and TR2 (Shanghai) are linked by an inter-region connection.
Route propagation from the on-premises data center to the VPCs
Routes flow as follows: data center → VBR → ECR → TR1 → TR2 (via inter-region propagation).
Route propagation from the VPCs to the data center
Routes flow as follows: VPCs → TRs → TR1 (aggregates TR2 routes) → ECR → VBR → data center. Route learning must be enabled on the transit routers. For more information, see Enable route learning.
Traffic paths
Only one path exists between the VBR and each VPC, so no route selection is required.
Scenario 2: Multiple transit routers, all connected to the ECR
A company has an on-premises data center in China (Hangzhou) and services in VPCs in China (Hangzhou) and China (Shanghai). The ECR is attached to TR1 (Hangzhou), TR2 (Shanghai), and the VBR (Hangzhou). All components are fully interconnected.
Route propagation from the data center to the VPCs
A: The data center propagates routes to the VBR.
B: The VBR propagates routes to the ECR.
C: The ECR propagates routes to TR1 and TR2 with MED values assigned based on region proximity:
VBR and TR1 are in the same region → MED = 1000 for routes sent to TR1.
VBR and TR2 are in different regions → MED = 3000 for routes sent to TR2.
D: Routes are propagated between transit routers. Both TR1 and TR2 are directly connected to the ECR, so the local preference rule applies — each transit router selects the ECR as the next hop for outbound traffic.
Route propagation from the VPCs to the data center
A: Routes are propagated between transit routers.
B: TR1 and TR2 propagate routes to the ECR with MED values based on region proximity:
For routes from VPC1: TR1 sets MED = 1000 (same region); TR2 sets MED = 3000 (different region). The ECR selects TR1 as the next hop for inbound traffic to VPC1.
For routes from VPC2: the logic is mirrored. The ECR selects TR2 as the next hop for inbound traffic to VPC2.
C: The ECR propagates routes to the VBR.
D: The VBR propagates routes to the data center.
Traffic paths
Outbound: Both transit routers prefer the ECR as the next hop (local preference rule), so traffic exits directly from the local transit router to the ECR.
Inbound: The ECR selects the transit router in the same region as the source VPC, so traffic enters through the nearest transit router.
Scenario 3: Multiple transit routers interconnected, one transit router not connected to the ECR
A company has three on-premises data centers connected to VBR1 (China (Beijing)), VBR2 (China (Shanghai)), and VBR3 (China (Hangzhou)). Services are deployed in VPCs across the same three regions. TR1 (Beijing) and TR2 (Shanghai) are connected to the ECR; TR3 (Hangzhou) is not. All three transit routers are interconnected.
Route propagation from the on-premises data centers to the VPCs
A: The data centers propagate routes to the VBRs.
B: The VBRs propagate routes to the ECR.
C: The ECR propagates routes to TR1 and TR2. Using VBR1 as an example:
VBR1 and TR1 are in the same region → MED = 1000 for routes sent to TR1.
VBR1 and TR2 are in different regions → MED = 3000 for routes sent to TR2.
D: Routes are propagated between TRs. TR1 and TR2 behave the same as in Scenario 2 — both prefer the ECR. For TR3 (not connected to the ECR), the system compares the MED of routes received from TR1 and TR2:
Route origin
MED at TR3
Route selected for VPC3 outbound
VBR1 via TR1
1000
TR1 (lower MED)
VBR2 via TR2
1000
TR2 (lower MED)
VBR3 via TR1
3000
TR1 (lexicographically first:
cn-beijingbeforecn-shanghai)VBR3 via TR2
3000
—
Outbound traffic paths based on the routing rules above
Outbound traffic path from VPC1 | Outbound traffic path from VPC2 | Outbound traffic path from VPC3 |
|
|
|
Route propagation from the VPCs to the data centers
A: The VPCs propagate routes to the transit routers.
B: TR1 and TR2 propagate routes to the ECR with MED values. The ECR selects next hops as follows: For inbound traffic to VPC3, both routes have MED = 3000. The ECR applies the local preference rule:
Inbound from VBR1 (Beijing): TR1 is in the same region as VBR1 → ECR selects TR1.
Inbound from VBR2 (Shanghai): TR2 is in the same region as VBR2 → ECR selects TR2.
Inbound from VBR3 (Hangzhou): TR3 is in the same region but not connected to the ECR. Lexicographical comparison applies:
cn-beijingsorts beforecn-shanghai, so the ECR selects TR1.
Route origin
MED at ECR
Next hop for inbound traffic
VPC1 via TR1
1000 (same region)
TR1
VPC2 via TR2
1000 (same region)
TR2
VPC3 via TR1
3000 (different region)
—
VPC3 via TR2
3000 (different region)
—
C: The ECR propagates routes to the VBRs.
D: The VBRs propagate routes to the data centers.
Inbound traffic paths based on the routing rules above
Inbound traffic path to VPC1 | Inbound traffic path to VPC2 | Inbound traffic path to VPC3 |
|
|
|
Changing the traffic path for VPC3 to IDC3
Setting TR2 as the default on the ECR changes both directions:
Outbound: The ECR sets MED = 2000 on all routes sent to TR2. After TR2 propagates these routes to TR3, TR3 prefers TR2 (MED 2000 < MED 3000 from TR1). Traffic from VPC3 to IDC3 now exits through TR2.
Inbound: The ECR tags the TR2 route as default egress. Inbound traffic from VBR3 to VPC3 now enters through TR2.
Traffic path between VPC3 and IDC3 before changing the MED | Traffic path between VPC3 and IDC3 after changing the MED |
|
|
The following table summarizes all traffic paths before and after the MED change:
Status | VPC1 to IDC | VPC2 to IDC | VPC3 to IDC |
Before changing the MED |
|
|
|
After changing the MED | Unchanged | Unchanged |
|
