Associate a route table of an Enterprise Edition transit router with a prefix list to automatically populate the route table with all CIDR blocks in the list — no need to add routes one by one.
For example, if the same destination CIDR blocks appear across multiple transit router route tables, manage those CIDRs in a single prefix list. When you need to add or remove a CIDR block, update the prefix list once — the change propagates to all associated route tables automatically. Without a prefix list, you would have to update every route table individually.
To create prefix lists and add CIDR blocks to them, see Create and manage a prefix list in the VPC documentation.
How it works
After you associate a transit router route table with a prefix list, each CIDR block in the prefix list generates one route entry in the route table. All CIDR blocks in a prefix list share the same next hop.
Routes generated from a prefix list have higher priority than dynamically generated routes if the prefix list already meets the requirements. In addition, the route table of the Enterprise Edition transit router automatically rejects routes that are advertised from virtual border router (VBR) connections, Express Connect Router (ECR) connections, VPN attachments, or Cloud Connect Network (CCN) instances.
Prerequisites
Before you begin, ensure that you have:
-
A prefix list created in the VPC console. See Create and manage a prefix list
-
(Cross-account) If the prefix list and the Enterprise Edition transit router belong to different Alibaba Cloud accounts, the prefix list must be shared with the account that owns the transit router. See What is Resource Sharing?
Limitations
-
Only route tables of Enterprise Edition transit routers can be associated with prefix lists.
-
All CIDR blocks in a prefix list share the same next hop. The next hop can be a VPC connection, a VBR connection, an ECR connection, an inter-region connection, or a blackhole route.
-
A transit router route table can contain at most 2,000 route entries. If adding the prefix list would cause the total to exceed this limit, the association fails or the modification does not take effect. For example, if the route table already has 1,960 routes, the prefix list can contain at most 40 CIDR blocks.
-
When you modify a prefix list that is associated with a transit router route table, any CIDR block that conflicts with an existing route entry is not synchronized until the conflict is resolved. See Resolve route conflicts.
Conflicting routes
Association fails, or modifications do not take effect, when a CIDR block in the prefix list conflicts with an existing route entry in the transit router route table. The conflict rules vary by next hop type.
Static routes
| Next hop type | Requirement | Example |
|---|---|---|
| VPC connection / Blackhole route | CIDR blocks in the prefix list cannot match destination CIDR blocks of existing routes. | If the route table has a static route to 10.10.10.0/24, the prefix list cannot include 10.10.10.0/24. |
| VBR connection / ECR connection / Inter-region connection | If a CIDR block matches an existing route, the next hop for that CIDR block in the prefix list must be a VBR connection, an ECR connection, or an inter-region connection. | If the route table has a static route to 10.10.10.0/24 and the prefix list includes 10.10.10.0/24, set the next hop to a VBR connection, an ECR connection, or an inter-region connection. |
Dynamically generated routes
| Original next hop type | Requirement |
|---|---|
| VBR connection / ECR connection / VPN attachment | If a CIDR block matches, the next hop for that CIDR block in the prefix list must be a VBR connection, an ECR connection, or an inter-region connection. |
| CCN connection (non-aggregated route) | If a CIDR block matches, the next hop must be a VBR connection or an inter-region connection. |
| CCN connection (aggregated route) | CIDR blocks in the prefix list cannot match destination CIDR blocks of aggregated routes. |
| Other connection types | CIDR blocks in the prefix list cannot match destination CIDR blocks of existing routes. |
Example (CCN): If the transit router dynamically learned a route to 10.10.10.0/24 from a CCN connection:
-
Non-aggregated: the prefix list can include 10.10.10.0/24 if the next hop is a VBR connection or inter-region connection.
-
Aggregated: the prefix list cannot include 10.10.10.0/24.
Resolve route conflicts
When a conflict prevents a CIDR block from being synchronized, fix it using one of the following methods:
-
In the prefix list, remove the CIDR blocks that conflict with routes in the transit router route table.
-
In the transit router route table, remove the routes that conflict with CIDR blocks in the prefix list.
After removing the conflicting routes, go to the VPC console, open the Association tab of the prefix list, and click Retry in the Actions column. The system re-applies all pending CIDR blocks. For how to open the Association tab, see View a prefix list.
Route advertisement scope
After a prefix list is associated with a transit router route table, routes generated from the prefix list are advertised based on the next hop type:
| Next hop | Advertisement scope |
|---|---|
| Inter-region connection | Current region only |
| ECR connection | Current region only |
| VPC connection | Entire CEN instance |
| VBR connection | Entire CEN instance |
If the next hop is a VBR connection, the generated routes are advertised to other VBRs in the current region, which may cause routing loops. Proceed with caution.
Associate a prefix list with a transit router route table
-
Log on to the CEN console.
-
On the Instances page, click the ID of the CEN instance.
-
Go to the Basic Information > Transit Router tab and click the ID of the transit router.
-
On the transit router details page, click the Route Table tab.
-
In the left-side section, click the ID of the route table. On the route table details page, click the Route Prefix tab and then click Associate With Route Prefix.
-
In the Associate With Route Prefix dialog box, configure the following parameters and click OK.
Parameter Description Route Prefix ID Select a prefix list. Blackhole Route? Select the next hop behavior for the CIDR blocks in the prefix list. Yes: All CIDR blocks are blackhole routes — packets to those destinations are dropped. No: CIDR blocks are not blackhole routes. Select a next hop from the Next Hop field. All CIDR blocks share the same next hop. Next Hop Select a next hop. Applicable when Blackhole Route? is set to No.
After the association is created, the system automatically adds one route entry for each CIDR block in the prefix list to the route table. View the generated routes on the Route Entry tab of the route table details page.
To change the next hop of the CIDR blocks in a prefix list, disassociate the prefix list from the route table and re-associate it with a different next hop.
Disassociate a prefix list from a transit router route table
After disassociation, the system withdraws all route entries generated from the prefix list. Migrate any workloads that depend on those routes before disassociating to prevent service interruptions.
-
Log on to the CEN console.
-
On the Instances page, click the ID of the CEN instance.
-
Go to the Basic Information > Transit Router tab and click the ID of the transit router.
-
On the transit router details page, click the Route Table tab.
-
In the left-side section, click the ID of the route table.
-
On the route table details page, click the Route Prefix tab, find the prefix list, and click Delete in the Actions column.
-
In the Delete dialog box, review the information and click OK.
API reference
-
CreateTransitRouterPrefixListAssociation: associates a route table of an Enterprise Edition transit router with a prefix list.
-
DeleteTransitRouterPrefixListAssociation: disassociates a route table of an Enterprise Edition transit router from a prefix list.
-
ListTransitRouterPrefixListAssociation: queries the prefix lists associated with an Enterprise Edition transit router.