After you create a Cloud Enterprise Network (CEN) instance, you can connect the CEN instance to virtual private clouds (VPCs), virtual border routers (VBRs), and Cloud Connect Network (CCN) instances to enable network communication. After you attach network instances to a CEN instance, the CEN instance automatically learns routes of the attached network instances. Then, the network instances can communicate with each other.
Background information
- You can use CEN to connect network instances that belong to the same Alibaba Cloud
account or different Alibaba Cloud accounts.
As shown in the following figure, Account B created a CEN instance. You can attach VPC 1 that belongs to Account A and VPC 2 that belongs to Account B to the same CEN instance to enable network communication between VPC 1 and VPC 2.
- You can use one of the following methods to attach a network instance to a CEN instance:
- If the CEN instance and the network instance that you want to attach to the CEN instance
belong to different Alibaba Cloud accounts, you must log on to the network instance
and grant the required permissions to the CEN instance. For more information, see
Grant permissions on a network instance that belongs to another account.
Important After the CEN instance acquires the required permissions, Account B can attach the network instance that belongs to Account A to the CEN instance. Then, the network instance that belongs to Account B and the network instance that belongs to Account A can communicate with each other.
Prerequisites
- A CEN instance is created. For more information, see Create a CEN instance.
- The network instance is not attached to other CEN instances.
Attach a network instance
- Log on to the CEN console.
- On the Instances page, find the CEN instance that you want to manage and click Manage in the Actions column.
- Click the Networks tab and then click Attach Network.
- In the Attach Network panel, click the Your Account or Different Account tab, set the following parameters, and then click OK.
- Attach a network instance that is created by the current account
- Network Type: Select the type of network instance.
- Region: Select the region where the network instance is created.
- Networks: Select the network instance that you want to attach.
- Attach a network instance that is created by a different account
- Owner Account: Enter the ID of the account to which the network instance belongs.
- Network Type: Select the type of network instance.
- Region: Select the region where the network instance is created.
- Networks: Select the network instance that you want to attach.
- Attach a network instance that is created by the current account
Attach a network instance to a CEN instance
- Log on to the VPC console.
- In the top navigation bar, select the region where the VPC is deployed.
- On the VPCs page, find the VPC that you want to attach and click the ID of the VPC.
- On the details page of the VPC, click Attach to CEN.
- In the Attach to CEN panel, select the CEN instance to which you want to attach the VPC and click OK.
- Log on to the Express Connect console.
- In the top navigation bar, select the region where the VBR is created.
- In the left-side navigation pane, click Virtual Border Routers (VBRs).
- On the details page of the VBR, click the Basic Information tab, and then click Join CEN.
- In the Join CEN panel, select the CEN instance to which you want to attach the VBR and click OK.
- Log on to the SAG console.
- In the top navigation bar, select the region where the CCN instance is deployed.
- In the left-side navigation pane, click CCN.
- On the CCN page, find the CCN instance that you want to attach and click Bind CEN Instance in the Actions column.
- In the Bind CEN Instance panel, select the CEN instance you want to attach and click OK.
You can use one of the following methods to specify a CEN instance:
- Existing CEN: If you have created CEN instances, you can select an existing CEN instance from the drop-down list.
- Create CEN: If you have not created a CEN instance, enter an instance name. The system then
creates a CEN instance and automatically associates it with the CCN instance.
The name must be 2 to 128 characters in length, and can contain letters, digits, hyphens (-), and underscores (_). It must start with a letter.
Grant permissions on a network instance that belongs to another account
If the CEN instance and the network instance that you want to attach to the CEN instance belong to different Alibaba Cloud accounts, you must log on to the network instance and grant the required permissions to the CEN instance. Before you grant permissions to the CEN instance, obtain the Alibaba Cloud account ID to which the network instance belongs and the Alibaba Cloud account ID to which the CEN instance belongs.
Grant permissions on a VPC
The following steps show how to attach a VPC that belongs to Account A to a CEN instance that belongs to Account B. The CEN instance must first acquire the required permissions from the VPC.
Grant permissions on a VBR
Grant permissions on a CCN instance
The following steps show how to attach a CCN instance that belongs to Account A to a CEN instance that belongs to Account B. The CEN instance must first acquire the required permissions from the CCN instance.
Detach a network instance
You can detach a network instance from a CEN instance. After the network instance is detached, it cannot communicate with other network instances that are attached to the CEN instance.
- Log on to the CEN console.
- On the Instances page, find the CEN instance that you want to manage and click Manage in the Actions column.
- On the Networks tab, find the network instance that you want to detach and click Detach in the Actions column.
- In the Detach Network message, click OK.
References
- For more information about how to attach a network instance to a CEN instance, see AttachCenChildInstance.
- For more information about how to query network instances that are attached to a CEN instance, see DescribeCenAttachedChildInstances.
- For more information about how to query regions that allow you to attach network instances to CEN instances, see DescribeChildInstanceRegions.
- For more information about how to query network instances of other Alibaba Cloud accounts that have granted permissions to a CEN instance, see DescribeGrantRulesToCen.
- For more information about how to grant a CEN instance permissions on a VPC, see GrantInstanceToCen.
- For more information about how to grant a CEN instance permissions on a VPC that belongs to another Alibaba Cloud account, see GrantInstanceToCbn.
- For more information about how to detaches a network instance from a CEN instance, see DetachCenChildInstance.