You can connect virtual private clouds (VPCs) to a transit router. After you connect
the VPCs to the same transit router, the VPCs can communicate with each other. This
topic describes how to connect VPCs to an Enterprise Edition transit router or a Basic
Edition transit router.
Use an Enterprise Edition transit router to create VPC connections
How a VPC connection works
Enterprise Edition transit routers may be supported in one or more zones. Before you
connect an Enterprise Edition transit router to a VPC, make sure that the VPC has
at least one vSwitch in a zone that supports Enterprise Edition transit routers. The
vSwitch must have at least one idle IP address. When you connect the Enterprise Edition
transit router to the VPC, the transit router creates an elastic network interface
(ENI) on the vSwitch of the VPC. The ENI occupies one IP address on the vSwitch and
forwards network traffic between the VPC and the transit router.

For more information about the regions and zones that support Enterprise Edition transit
routers, see Transit router editions.
How routes are selected for a VPC connection
After an Enterprise Edition transit router is connected to a VPC, network traffic
from the VPC is forwarded over the shortest route to reduce network latency. This
section describes how an Enterprise Edition transit router selects routes for a VPC
connection.
Route selection is performed three times to send a request from the initiator to the
acceptor over a VPC connection.

Number |
Description |
① |
The first route.
The system must select a route between the initiator network and the Enterprise Edition
transit router. A route is selected based on the following rules:
- After the initiator sends the request, the system queries the route table that is
associated with the vSwitch of the initiator.
- If the route table contains a custom route whose next hop is the ENI of the Enterprise
Edition transit router, the request is routed to the ENI and then routed to the Enterprise
Edition transit router.
- If the route table does not contain a custom route whose next hop is the ENI of the
Enterprise Edition transit router, the request is routed to the ENI of the Enterprise
Edition transit router that is associated with the initiator network connection.
- If the initiator network connection is associated with the zone where the initiator
resides, the request is routed to the ENI of the Enterprise Edition transit router
in the zone and then routed to the Enterprise Edition transit router.
- If the initiator network connection is not associated with the zone where the initiator
resides, the request is routed to the ENI of the Enterprise Edition transit router
in the first zone associated with the initiator network connection, and then routed
to the Enterprise Edition transit router. The first zone was specified when you created
the initiator network connection.
|
② |
The second route.
The Enterprise Edition transit router must select a route between the Enterprise Edition
transit router and the acceptor network. A route is selected based on the following
rules:
- After the Enterprise Edition transit router receives the request, the Enterprise Edition
transit router queries the route table that is associated with the acceptor network
connection.
- The Enterprise Edition transit router finds the next hop for the request and then
routes the request to the ENI of the Enterprise Edition transit router that is associated
with the acceptor network connection.
- If the acceptor network connection is associated with the zone where the Enterprise
Edition transit router that accepts the request resides, the request is routed to
the ENI of the Enterprise Edition transit router in the zone and then routed to the
acceptor network.
- If the acceptor network connection is not associated with the zone where the Enterprise
Edition transit router that accepts the request resides, the request is routed to
the ENI of the Enterprise Edition transit router in the first zone associated with
the acceptor network connection and then routed to the acceptor network. The first
zone was specified when you created the acceptor network connection.
|
③ |
The third route.
The system must select a route between the acceptor network and the acceptor. The
system routes the request to the acceptor based on the route table that is associated
with the vSwitch that accepts the request.
|
Prerequisites
- Before you connect an Enterprise Edition transit router to a VPC, make sure that the
VPC has at least one vSwitch in a zone that supports Enterprise Edition transit routers.
The vSwitch must have at least one idle IP address. For more information about how
to create a vSwitch, see Create a vSwitch.
- An Enterprise Edition transit router is created in the region where the VPC resides.
For more information about, see Create a transit router.
- You can connect VPCs to Enterprise Edition transit routers that belong to the same
Alibaba Cloud account or different Alibaba Cloud accounts. If the VPC and the transit
router that you want to connect belong to different Alibaba Cloud accounts, the transit
router must acquire the required permissions from the Alibaba Cloud account to which
the VPC belongs. For more information about, see Grant permissions to another Alibaba Cloud account.
Create a VPC connection
- Log on to the CEN console.
- On the Instances page, find the CEN instance that you want to manage and click the instance ID.
- On the tab, find the transit router that you want to manage and click Create Connection in the Actions column.
- On the Connection with Peer Network Instance page, set the following parameters and click OK.
Note When you perform this operation, the system automatically creates the service-linked
role AliyunServiceRoleForCEN. The service-linked role allows the Enterprise Edition
transit router to create an ENI in a vSwitch of the VPC. The ENI is used as the interface
for data transfer between the VPC and the transit router. For more information, see
AliyunServiceRoleForCEN.
Parameter |
Description |
Network Type |
Select VPC.
|
Region |
Select the region where the network instance is deployed. |
Transit Router |
The system automatically displays the transit router in the selected region. |
Resource Owner ID |
Select the Alibaba Cloud account to which the network instance belongs.
You can connect a transit router to a VPC that belongs to the same or another Alibaba
Cloud account:
- If the network instance and the transit router that you want to connect belong to
the same account, select Your Account.
- If the network instance and the transit router that you want to connect belong to
different Alibaba Cloud accounts, select Different Account, and enter the ID of the Alibaba Cloud account to which the network instance belongs.
|
Billing Method |
By default, transit routers use the Pay-As-You-Go billing method.
For more information about the billing rules, see Billing.
|
Attachment Name |
Enter a name for the network connection. |
Networks |
Select the VPC. |
VSwitch |
Select a vSwitch in a zone that supports transit routers.
If vSwitches are deployed in multiple zones that support transit routers, you can
select multiple zones and select a vSwitch in each zone.
|
Advanced Settings |
When you create a VPC connection, the system enables the following features in the
advanced settings by default:
- Associate with Default Route Table of Transit Router
After this feature is enabled, the VPC connection is automatically associated with
the default route table of the transit router. The transit router forwards the traffic
of the VPC based on the default route table.
- Propagate System Routes to Default Route Table of Transit Router
After this feature is enabled, the system routes of the VPC are advertised to the
default route table of the transit router. This way, the VPC can communicate with
other network instances that are connected to the transit router.
- Automatically Creates Route That Points to Transit Router and Adds to All Route Tables
of Current VPC
After this feature is enabled, the system automatically adds the following three routes
to all route tables of the VPC: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The
routes point to the VPC connection.
You can disable the preceding feature based on business requirements. You can also
configure associated forwarding and route learning to customize network connections.
For more information, see Associated forwarding and Route learning.
|
After the VPC connection is created, you can view the details about the connection
on the
Intra-region Connections tab. For more information, see
View network instance connections.
Change the zone and vSwitch for a VPC connection
After you create a VPC connection, you can change the zone and vSwitch for the VPC
connection. Before you begin, make sure that no routes of the VPC point to the ENI
of an Enterprise Edition transit router. For more information about, see Add and delete route entries.
Warning If you change the vSwitch for a VPC connection, the connection may be interrupted
for up to 15 seconds. Proceed with caution.
- Log on to the CEN console.
- On the Instances page, find the CEN instance that you want to manage and click the instance ID.
- Choose , find the transit router that you want to manage, and then click the ID of the transit
router.
- On the Intra-region Connections tab, find the VPC connection that you want to manage and click the ID.
- In the Attachment Details panel, click Change Zone/Subnet in the Associated Instances section.
- In the Change Zone/Subnet dialog box, select another zone and a vSwitch in the Select Zone/Subnet section and click OK.
When you change the zone and vSwitch, the zone and vSwitch that you select are associated
with the VPC connection.
For example, the VPC connection is associated with Zone A and vSwitch A1, which is
deployed in Zone A. The following rules apply when you change the zone and vSwitch
in the Change Zone/Subnet dialog box:
- If you select Zone A and vSwitch A2, which is deployed in Zone A, the VPC connection
is associated with Zone A and vSwitch A2 after you click OK.
The VPC connection is automatically disassociated from vSwitch A1.
- If you select Zone B, vSwitch B1 (deployed in Zone B), Zone C, and vSwitch C1 (deployed
in Zone C), the VPC connection is associated with Zone B, vSwitch B1, Zone C, and
vSwitch C1 after you click OK.
The VPC connection is automatically disassociated from Zone A and vSwitch A1.
- If you select Zone A, vSwitch A1 (deployed in Zone A), Zone C, and vSwitch C1 (deployed
in Zone C), the VPC connection is associated with Zone A, vSwitch A1, Zone C, and
vSwitch C1 after you click OK.
The VPC is automatically associated with Zone C and vSwitch C1.
Note After a VPC connection is associated with another vSwitch, the ENI of the previous
vSwitch is automatically deleted.
Use a Basic Edition transit router to create VPC connections
You can connect a Basic Edition transit router to a VPC that belongs to the same or
a different Alibaba Cloud account. If the VPC and the transit router that you want
to connect belong to different Alibaba Cloud accounts, the transit router must acquire
the required permissions from the Alibaba Cloud account to which the VPC belongs.
For more information about, see Grant permissions to another Alibaba Cloud account.
- Log on to the CEN console.
- On the Instances page, find the CEN instance that you want to manage and click the instance ID.
- On the tab, find the transit router that you want to manage and click Create Connection in the Actions column.
- On the Connection with Peer Network Instance page, set the following parameters and click OK.
Parameter |
Description |
Network Type |
Select VPC.
|
Region |
Select the region where the network instance is deployed. |
Transit Router |
The system automatically displays the transit router in the selected region. |
Resource Owner ID |
Select the Alibaba Cloud account to which the network instance belongs.
You can connect a transit router to a VPC that belongs to the same or another Alibaba
Cloud account:
- If the network instance and the transit router that you want to connect belong to
the same account, select Your Account.
- If the network instance and the transit router that you want to connect belong to
different Alibaba Cloud accounts, select Different Account, and enter the ID of the Alibaba Cloud account to which the network instance belongs.
|
Networks |
Select the ID of the network instance. |
After you create the VPC connection, you can view it on the
Intra-region Connections tab on the details page of the transit router. For more information, see
View network instance connections.