Create a routing policy using CreateCenRouteMap - Cloud Enterprise Network - Alibaba Cloud - Cloud Enterprise Network

Creates a routing policy. The routing policy feature allows you to filter route information and customize the management of cloud network connectivity.

Operation description

Routing policies are sorted by priority. A smaller priority value indicates a higher priority. Each routing policy is a collection of conditional statements and execution statements. When a routing policy is executed, routes are matched against conditional statements starting from the routing policy with the highest priority. For routes that match all conditions, the routing policy either permits or denies the routes based on the policy action. Routes that are permitted can have their attributes modified. For routes that do not match all conditions, the system permits the routes by default. For more information, see Routing policy overview.

CreateCenRouteMap is an asynchronous operation. After you call this operation, a routing policy ID is returned, but the routing policy has not been created. The system continues to create the routing policy in the background. You can call DescribeCenRouteMaps to query the status of the routing policy.

If the routing policy is in the Creating state, the routing policy is being created. In this state, you can only perform query operations.
If the routing policy is in the Active state, the routing policy is created.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:CreateCenRouteMap

create

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
CenId	string	Yes	The instance ID of the Cloud Enterprise Network (CEN).	cen-7qthudw0ll6jmc****
CenRegionId	string	Yes	The ID of the region to which the routing policy is applied. You can call DescribeChildInstanceRegions to query region IDs.	cn-hangzhou
TransmitDirection	string	Yes	The direction in which the routing policy is applied. Valid values: RegionIn: the inbound direction of the regional gateway. Routes are transmitted to the CEN regional gateway. For example, a route is advertised from a network instance in the local region to the local regional gateway, or a route is advertised from another region to the local regional gateway. RegionOut: the outbound direction of the regional gateway. Routes are transmitted from the CEN regional gateway. For example, a route is advertised from the local regional gateway to a network instance in the local region, or to a regional gateway in another region. Valid values: RegionOut : outbound direction of the regional gateway. RegionIn : inbound direction of the regional gateway.	RegionIn
Description	string	No	The description of the routing policy. The description can be empty or 1 to 256 characters in length and cannot start with http:// or https://.	desctest
Priority	integer	Yes	Policy priority of the routing policy. Valid values: 1 to 100. A smaller value indicates a higher priority. Note Policy priority of routing policies in the same region and with the same direction must be unique. When a routing policy is executed, the system starts matching conditional statements from the routing policy with the smallest priority value. Specify policy priority based on the expected matching order.	3
MapResult	string	Yes	The action to perform after all conditions are matched. Valid values: Permit: permits the matched routes. Deny: denies the matched routes. Valid values: Permit : permit. Deny : deny.	Permit
NextPriority	integer	No	Policy priority of the next associated routing policy. You can set policy priority of the next associated routing policy only when MapResult is set to Permit. Only routes that are permitted continue to match the next associated routing policy. The next associated routing policy must have the same region and direction as the current routing policy. Policy priority of the next associated routing policy must be lower than policy priority of the current routing policy.	20
CidrMatchMode	string	No	The match mode of the prefix list. Valid values: Include: fuzzy match. A match is successful if the route prefix in the match condition contains the route prefix of the route being matched. For example, a policy that defines 10.10.0.0/16 can fuzzy match the route 10.10.1.0/24. Complete: exact match. A match is successful only if the route prefix in the match condition is the same as the route prefix of the route being matched. For example, a policy that defines 10.10.0.0/16 can only exact match the route 10.10.0.0/16. Valid values: Complete : exact match. Include : fuzzy match.	Include
AsPathMatchMode	string	No	The match mode of the AS path list. Valid values: Include: fuzzy match. A match is successful if the AS path in the match condition overlaps with the AS path of the route being matched. Complete: exact match. A match is successful only if the AS path in the match condition is the same as the AS path of the route being matched. Valid values: Complete : exact match. Include : fuzzy match.	Include
CommunityMatchMode	string	No	The match mode of the Community. Valid values: Include: fuzzy match. A match is successful if the Community in the match condition overlaps with the Community of the route being matched. Complete: exact match. A match is successful only if the Community in the match condition is the same as the Community of the route being matched. Contain: inclusive match. A match is successful only if the Community of the route being matched contains all the Communities specified in the match condition. Valid values: Complete : exact match. Include : fuzzy match. Contain : inclusive match.	Include
CommunityOperateMode	string	No	The action to perform on the Community. Valid values: Additive: adds a Community to the route. Replace: replaces the existing Community of the route. This parameter specifies the action to perform after a route matches the condition. Valid values: Replace : replace. Additive : add.	Additive
Preference	integer	No	The modified priority of the route. Valid values: 1 to 100. The default priority of a route is 50. A smaller value indicates a higher priority. This parameter specifies the action to perform after a route matches the condition.	50
SourceInstanceIdsReverseMatch	boolean	No	Specifies whether to use the exclude matching mode for the source instance ID list. Valid values: false (default): no. A match is successful if the source instance ID of the route is in the SourceInstanceIds.N list. true: yes. A match is successful if the source instance ID of the route is not in the SourceInstanceIds.N list.	false
DestinationInstanceIdsReverseMatch	boolean	No	Specifies whether to use the exclude matching mode for the destination instance ID list. Valid values: false (default): no. A match is successful if the destination instance ID of the route is in the DestinationInstanceIds.N list. true: yes. A match is successful if the destination instance ID of the route is not in the DestinationInstanceIds.N list.	false
MatchAddressType	string	No	The IP address type that the route must match. Valid values: IPv4: matches only IPv4 routes. IPv6: matches only IPv6 routes. This parameter can be left empty, which indicates that all types of routes are matched.	IPv4
TransitRouterRouteTableId	string	No	The route table ID of the transit router. If you do not specify a route table ID, the routing policy is automatically associated with the default route table of the transit router.	vtb-gw8nx3515m1mbd1z1****
SourceInstanceIds	array	No	The list of source instance IDs that the route must match. The following types of instance IDs are supported: Virtual Private Cloud (VPC) instance ID Virtual Border Router (VBR) instance ID Cloud Connect Network (CCN) instance ID Smart Access Gateway instance ID IPsec connection ID You can specify up to 64 instance IDs.	vpc-adeg3544fdf34vf****
	string	No	The list of source instance IDs that the route must match. The following types of instance IDs are supported: Virtual Private Cloud (VPC) instance ID Virtual Border Router (VBR) instance ID Cloud Connect Network (CCN) instance ID Smart Access Gateway instance ID IPsec connection ID You can specify up to 64 instance IDs.	vpc-adeg3544fdf34vf****
DestinationInstanceIds	array	No	The list of destination instance IDs that the route must match. The following types of instance IDs are supported: Virtual Private Cloud (VPC) instance ID Virtual Border Router (VBR) instance ID Cloud Connect Network (CCN) instance ID Smart Access Gateway instance ID IPsec connection ID You can specify up to 64 instance IDs. Note The destination instance ID list takes effect only when the routing policy direction is outbound from the regional gateway and the destination instance IDs are instance IDs in the local region.	vpc-afrfs434465fdf****
	string	No	The list of destination instance IDs that the route must match. The following types of instance IDs are supported: Virtual Private Cloud (VPC) instance ID Virtual Border Router (VBR) instance ID Cloud Connect Network (CCN) instance ID Smart Access Gateway instance ID IPsec connection ID You can specify up to 64 instance IDs. Note The destination instance ID list takes effect only when the routing policy direction is outbound from the regional gateway and the destination instance IDs are instance IDs in the local region.	vpc-afrfs434465fdf****
SourceRouteTableIds	array	No	The list of source route table IDs that the route must match. You can specify up to 64 route table IDs.	vtb-adfr233vf34rvd4****
	string	No	The list of source route table IDs that the route must match. You can specify up to 64 route table IDs.	vtb-adfr233vf34rvd4****
DestinationRouteTableIds	array	No	The list of destination route table IDs that the route must match. You can specify up to 64 route table IDs. Note The destination route table ID list takes effect only when the routing policy direction is outbound from the regional gateway and the destination route table IDs are route table IDs of network instances in the local region.	vtb-adefrgtr144vf****
	string	No	The list of destination route table IDs that the route must match. You can specify up to 64 route table IDs. Note The destination route table ID list takes effect only when the routing policy direction is outbound from the regional gateway and the destination route table IDs are route table IDs of network instances in the local region.	vtb-adefrgtr144vf****
SourceRegionIds	array	No	The list of source region IDs that the route must match. You can specify up to 64 region IDs. You can call DescribeChildInstanceRegions to query region IDs.	cn-beijing
	string	No	The list of source region IDs that the route must match. You can specify up to 64 region IDs. You can call DescribeChildInstanceRegions to query region IDs.	cn-beijing
SourceChildInstanceTypes	array	No	The list of source instance types that the route must match. The following instance types are supported: VPC: VPC instance. VBR: virtual border router instance. CCN: CCN instance. VPN: VPN gateway instance or IPsec connection. If an IPsec connection or SSL server is attached to a VPN gateway instance, the VPC associated with the VPN gateway instance must be connected to a transit router instance, and the VPN gateway instance must run the BGP dynamic routing protocol for this parameter to take effect. If an IPsec connection is directly attached to a transit router instance, this parameter takes effect. You can specify multiple instance types.	VPC
	string	No	The list of source instance types that the route must match. The following instance types are supported: VPC: VPC instance. VBR: virtual border router instance. CCN: CCN instance. VPN: VPN gateway instance or IPsec connection. If an IPsec connection or SSL server is attached to a VPN gateway instance, the VPC associated with the VPN gateway instance must be connected to a transit router instance, and the VPN gateway instance must run the BGP dynamic routing protocol for this parameter to take effect. If an IPsec connection is directly attached to a transit router instance, this parameter takes effect. You can specify multiple instance types.	VPC
DestinationChildInstanceTypes	array	No	The list of destination instance types that the route must match. The following instance types are supported: VPC: VPC instance. VBR: VBR instance. CCN: CCN instance. VPN: IPsec connection. Note If an IPsec connection or SSL server is bound to a VPN gateway instance and is connected to a transit router instance through the VPC associated with the VPN gateway instance, this parameter does not take effect. This parameter takes effect only when an IPsec connection is directly bound to a transit router instance. You can specify multiple instance types. Note The destination instance type list takes effect only when the routing policy direction is outbound from the regional gateway and the destination instance types are instance types in the local region.	VPC
	string	No	The list of destination instance types that the route must match. The following instance types are supported: VPC: VPC instance. VBR: VBR instance. CCN: CCN instance. VPN: IPsec connection. Note If an IPsec connection or SSL server is bound to a VPN gateway instance and is connected to a transit router instance through the VPC associated with the VPN gateway instance, this parameter does not take effect. This parameter takes effect only when an IPsec connection is directly bound to a transit router instance. You can specify multiple instance types. Note The destination instance type list takes effect only when the routing policy direction is outbound from the regional gateway and the destination instance types are instance types in the local region.	VPC
DestinationCidrBlocks	array	No	The prefix list that the route must match. IP address ranges in the prefix list are in CIDR format. You can specify up to 64 IP address ranges. Both IPv4 and IPv6 formats are supported.	10.10.10.0/24
	string	No	The prefix list that the route must match. IP address ranges in the prefix list are in CIDR format. You can specify up to 64 IP address ranges. Both IPv4 and IPv6 formats are supported.	10.10.10.0/24
RouteTypes	array	No	The list of routing types that the route must match. The following routing types are supported: System: system routes that are automatically generated by the system. Custom: custom routes that are manually added by users. BGP: BGP routes that are propagated through the BGP routing protocol. You can specify multiple routing types.	System
	string	No	The list of routing types that the route must match. The following routing types are supported: System: system routes that are automatically generated by the system. Custom: custom routes that are manually added by users. BGP: BGP routes that are propagated through the BGP routing protocol. You can specify multiple routing types.	System
MatchAsns	array	No	The AS path list that the route must match. You can specify up to 64 AS numbers. Note Only AS SEQUENCE is supported. AS SET, AS CONFED SEQUENCE, and AS CONFED SET are not supported. This means that only AS number lists are supported, not sets or sublists.	65501
	integer	No	The AS path list that the route must match. You can specify up to 64 AS numbers. Note Only AS SEQUENCE is supported. AS SET, AS CONFED SEQUENCE, and AS CONFED SET are not supported. This means that only AS number lists are supported, not sets or sublists.	65501
MatchCommunitySet	array	No	The Community set that the route must match. Each Community is in the n:m format, where the value ranges of n and m are 1 to 65535. Communities must comply with RFC 1997. Large Communities (RFC 8092) are not supported. You can specify up to 64 Communities. Note Incorrect Community configurations may cause routes to fail to be advertised to on-premises data centers.	65501:1
	string	No	The Community set that the route must match. Each Community is in the n:m format, where the value ranges of n and m are 1 to 65535. Communities must comply with RFC 1997. Large Communities (RFC 8092) are not supported. You can specify up to 64 Communities. Note Incorrect Community configurations may cause routes to fail to be advertised to on-premises data centers.	65501:1
OperateCommunitySet	array	No	The Community set to be executed. Each Community is in the n:m format, where the value ranges of n and m are 1 to 65535. Communities must comply with RFC 1997. Large Communities (RFC 8092) are not supported. You can specify up to 32 Communities. Note Incorrect Community configurations may cause routes to fail to be advertised to on-premises data centers.	65501:1
	string	No	The Community set to be executed. Each Community is in the n:m format, where the value ranges of n and m are 1 to 65535. Communities must comply with RFC 1997. Large Communities (RFC 8092) are not supported. You can specify up to 32 Communities. Note Incorrect Community configurations may cause routes to fail to be advertised to on-premises data centers.	65501:1
PrependAsPath	array	No	The AS path that is prepended when the regional gateway receives or publishes route entries. The requirements for configuring the prepended AS path vary based on the routing policy direction: When the direction is inbound to the regional gateway, the match condition must include the source instance ID list and source region, and the source region must be the same as the region to which the routing policy is applied. When the direction is outbound from the regional gateway, the match condition must include the destination instance ID list. This parameter specifies the action to execute after a route matches the condition. You can specify up to 32 AS numbers.	65501
	integer	No	The AS path that is prepended when the regional gateway receives or publishes route entries. The requirements for configuring the prepended AS path vary based on the routing policy direction: When the direction is inbound to the regional gateway, the match condition must include the source instance ID list and source region, and the source region must be the same as the region to which the routing policy is applied. When the direction is outbound from the regional gateway, the match condition must include the destination instance ID list. This parameter specifies the action to execute after a route matches the condition. You can specify up to 32 AS numbers.	65501
DestinationRegionIds	array	No	The list of destination region IDs that the route must match. You can specify up to 64 region IDs.
	string	No	The list of destination region IDs that the route must match. You can specify up to 64 region IDs.	cn-beijing

Response elements

Element	Type	Description	Example
	object	The response parameters.
RouteMapId	string	The ID of the routing policy.	cenrmap-w4yf7toozfol3q****
RequestId	string	The request ID.	62172DD5-6BAC-45DF-8D44-56SDF467BAC

Examples

Success response

JSON format

{
  "RouteMapId": "cenrmap-w4yf7toozfol3q****",
  "RequestId": "62172DD5-6BAC-45DF-8D44-56SDF467BAC"
}

Error codes

HTTP status code	Error code	Error message	Description
400	Forbidden.CenRouteMapExist	The specified CEN route map ID already exists.	The specified CEN route map ID already exists.
400	Invid.Parameter	When using PrependAsPath in the RegionIn, SourceRegionId must be local region Id.
400	InvalidOperation.NoEffictiveAction	No effective action be configured.	The error message returned because the specified action is invalid.
400	IncorrectStatus.TransitRouterInstance	The status of TransitRouter is incorrect.	The error message returned because the transit router is in an invalid state.
400	InvalidDescription	Description is invalid.	The error message returned because the description is invalid.
400	IllegalParam.ZoneId	The specified ZoneId is illegal.	The error message returned because the specified zone is invalid.
400	Forbidden.NoMedAuthorized	Med operation is unauthorized.	Unable to operate on the specified Med routing policy.
400	InvalidOperation.MedRouteMapExist	Operation is invalid because the default med route map already exist.	The operation is invalid because there is already a med routeMap with the next hop destination for this Ecr instance.
400	InvalidOperation.MedRouteMapNotAllowedOtherAction	Operation is invalid because the default med not allowed other action.	the med policy does not allow to configure other policies.
400	InvalidOperation.MedRouteMapActionMustPermit	Operation is invalid because the default med map result must be permit.	Operation is invalid because the default med map result must be permit.
400	InvalidParameter.MedRouteMapDestInstanceIds	Param DestInstanceIds must be ecr instance id.	The destination instance list of med routeMap must be ECR instance.
400	InvalidParameter.MedRouteMapDestInstanceType	Param DestChildInstanceTypes must be ecr.	The destination instance type of the med routeMap must be ECR.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.
400	InvalidParameter.CenId	The specified parameter CenId is invalid.
400	InvalidParameter.TransitRouterRouteTableId	The specified parameter TransitRouterRouteTableId is invalid.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.