Cloud Enterprise Network:Transit router CIDR blocks

How it works

When you create a VPN connection, the system allocates one or more IP addresses from the transit router CIDR block to that connection. The exact allocation depends on the connection type:

Private VPN connection

The system assigns a gateway IP address from the transit router CIDR block to the IPsec-VPN connection. This gateway IP establishes the IPsec-VPN tunnel with your on-premises network.

After you enable route learning between the private VPN connection and a transit router route table:

• The transit router automatically learns a route entry pointing to the IPsec-VPN connection. The destination is the gateway IP address; the next hop is the VPN connection.

• The system adds a blackhole route to the route table. The destination CIDR block of this blackhole route is the transit router CIDR block from which the gateway IP was allocated. The blackhole route is advertised only to the route tables of virtual border router (VBR) instances connected to the transit router.

Use the PublishCidrRoute parameter of the CreateTransitRouterCidr operation to control whether the system adds this blackhole route. For details, see CreateTransitRouterCidr.

Public VPN connection

The system allocates public IP addresses from an Alibaba Cloud address pool for the IPsec tunnel itself, and separately allocates IP addresses from the transit router CIDR block for internal health checks. These health-check IPs are internal-only and do not affect your traffic.

For details about dual-tunnel mode, see Use an IPsec-VPN connection that is associated with a transit router.

Limits

• Only Enterprise Edition transit routers support custom CIDR blocks.

• Each transit router supports a maximum of 5 CIDR blocks.

• The subnet mask of each CIDR block must be between /16 and /24.

• The following address ranges cannot be used as transit router CIDR blocks:

  • 100.64.0.0/10

  • 224.0.0.0/4

  • 127.0.0.0/8

  • 169.254.0.0/16

  • Any subnet of the above ranges

• Transit router CIDR blocks cannot overlap with the CIDR blocks of network instances that communicate within the same Cloud Enterprise Network (CEN) instance.

• Each transit router CIDR block must be unique within the same CEN instance.

IP address allocation rules

Understanding how the system carves up your CIDR block helps you size it correctly for the number of VPN connections you need.

Add a transit router CIDR block

Add a CIDR block when creating a new transit router, or add one to an existing transit router at any time.

Add a CIDR block during transit router creation

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. Go to Basic Information > Transit Router and click Create Transit Router.

4. In the Create Transit Router dialog box, configure the following parameters and click OK.

Parameter	Description
Region	The region where the transit router is created.
Edition	Determined automatically by the system based on the region.
Enable Multicast	Disabled by default. Enterprise Edition transit routers support multicast in select regions. See Multicast overview.
Name	A name for the transit router instance.
Description	A description for the transit router instance.
Tag	Tags for the transit router instance. Tag Key: up to 64 characters, cannot start with acs: or aliyun, and cannot contain http:// or https://. Tag Value: up to 128 characters, can be blank, cannot start with acs: or aliyun, and cannot contain http:// or https://. See Tags.
Transit Router CIDR	The transit router CIDR block. To add multiple CIDR blocks, click Add.

View allocation details

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. Go to Basic Information > Transit Router and click the ID of the transit router.

4. On the Basic Information tab, find the Transit Router CIDR section and click Address Details.

5. In the Address Details panel, review the allocation details for each CIDR block.

Modify a transit router CIDR block

You cannot modify a CIDR block that has already been used to allocate IP addresses. Delete the VPN connections using those IPs first. See Delete a network instance connection.

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. Go to Basic Information > Transit Router and click the ID of the transit router.

4. On the Basic Information tab, find the Transit Router CIDR section and click Modify.

5. In the Modify Transit router CIDR dialog box, make your changes:

   • Add a CIDR block: Click Add and enter the new CIDR block.

   • Modify a CIDR block: Edit the existing entry.

   • Delete a CIDR block: Click the icon next to the CIDR block.

6. Click OK, then review the changes in the Result dialog box and click OK.

Delete a transit router CIDR block

You cannot delete a CIDR block that has already been used to allocate IP addresses. Delete the VPN connections using those IPs first. See Delete a network instance connection.

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. Go to Basic Information > Transit Router and click the ID of the transit router.

4. On the Basic Information tab, find the TR CIDR Block section and click Modify.

5. In the Modify Transit router CIDR dialog box, click the icon next to the target CIDR block. If the icon is not visible, click Add first to reveal all entries.

6. Click OK, then review the changes in the Results dialog box and click OK.

API reference