Enterprise Edition transit routers support flexible route management features. You can use Enterprise Edition transit routers to route network traffic to an access control server to scrub the traffic. This ensures that only trusted traffic can be transmitted and improves network security. This topic describes how to use an Enterprise Edition transit router to enable and secure network communication.

Scenarios

Before you begin, make sure that the virtual private cloud (VPC) where the access control server is deployed supports Enterprise Edition transit routers. Otherwise, you cannot enable or secure network communication. For more information about the regions and zones that support Enterprise Edition transit routers, see Regions and zones that support Enterprise Edition transit routers.

The following example shows how to use an Enterprise Edition transit router to enable and secure intra-region network communication. A company has deployed three VPCs in the China (Hong Kong) region. VPC A has security services configured. The three VPCs cannot communicate with each other. Due to business growth and security requirements, the company wants to enable network communication between VPC B and VPC C, and wants to route network traffic through VPC A for scrubbing.

In this case, the company can connect VPC B and VPC C to an Enterprise Edition transit router. Then, the company can add custom route policies to the transit router to enable network communication between VPC B and VPC C.

Diagram

Prerequisites

  • Three VPCs (A, B, and C) are created in the China (Hong Kong) region, and Elastic Compute Service (ECS) instances are deployed in each VPC. For more information, see Create an IPv4 VPC.
    • At least one vSwitch is deployed in each VPC in a zone supported by Enterprise Edition transit routers. Each vSwitch must have at least one idle IP address.
      For example, if you create one VPC in the China (Hong Kong) region, you must create at least one vSwitch in Zone B and one vSwitch in Zone C. Each vSwitch must have at least one idle IP address.
      Note The Enterprise Edition transit router associates an elastic network interfaces (ENI) with each vSwitch in the zones. The ENIs function as ingresses that forward network traffic from VPCs to the transit router. Each ENI occupies one IP address.
    • VPC A must have at least two vSwitches. One vSwitch is used to connect to the Enterprise Edition transit router. The other vSwitch is used to host the security control service and filter traffic.

      In this example, VPC A has three vSwitches. vSwitch 1 and vSwitch 2 are used to connect to the Enterprise Edition transit router. vSwitch 3 is used to host the security control service.

    The following table shows the CIDR blocks allocated to the VPCs. Make sure that the CIDR blocks do not overlap.
    VPC vSwitch Zone CIDR block ECS instance IP address
    VPC_A

    Primary CIDR block: 10.1.0.0/16

    vSwitch 1 Zone B 10.1.0.0/24 10.1.2.13
    vSwitch 2 Zone C 10.1.1.0/24
    vSwitch 3 Zone B 10.1.2.0/24
    VPC_B

    Primary CIDR block: 10.2.0.0/16

    vSwitch 1 Zone B 10.2.0.0/24 10.2.2.48
    vSwitch 2 Zone C 10.2.1.0/24
    vSwitch 3 Zone C 10.2.2.0/24
    VPC_C

    Primary CIDR block: 10.3.0.0/16

    vSwitch 1 Zone B 10.3.0.0/24 10.3.2.27
    vSwitch 2 Zone C 10.3.1.0/24
    vSwitch 3 Zone C 10.3.2.0/24
  • You must be aware of the security group rules of the ECS instances in the three VPCs, and the security group rules must allow the ECS instances to communicate with each other. For more information, see Query security group rules and Add a security group rule.

Procedure

Procedure

Step 1: Create a CEN instance

CEN is used to create and manage network resources. Before you can use Enterprise Edition transit routers to connect networks, you must create a CEN instance.

  1. Log on to the CEN console.
  2. On the Instances page, click Create CEN Instance.
  3. In the Create CEN Instance panel, set the following parameters and click OK.
    • Name: Enter a name for the CEN instance.

      The name must be 2 to 128 characters in length and can contain digits, hyphens (-), and underscores (_). It must start with a letter.

    • Description: Enter a description for the CEN instance.

      The description must be 2 to 256 characters in length, and cannot start with http:// or https://. You can leave this parameter empty.

Step 2: Connect the VPCs to the transit router

Attach the network instances that you want to connect to the Enterprise Edition transit router in the region where each network instance is deployed.
  1. Log on to the CEN console.
  2. On the Instances page, find the CEN instance that you want to manage and click the instance ID.
  3. On the Basic Information tab, click Add in the VPC section.
    Connect to the VPC
  4. On the Connection with Peer Network Instance page, set the following parameters and click OK.
    The following table describes the settings of each VPC. Connect VPC A, VPC B, and VPC C to an Enterprise Edition transit router.
    Parameter Description VPC_A VPC_B VPC_C
    Network Type Select the type of network instance that you want to connect. VPC VPC VPC
    Region Select the region where the network instance is deployed. China (Hong Kong) China (Hong Kong) China (Hong Kong)
    Transit Router The system automatically creates a transit router in the selected region.
    Resource Owner ID Select the Alibaba Cloud account to which the network instance belongs. Your Account Your Account Your Account
    Billing Method Default value: Pay-As-You-Go.
    Attachment Name Enter a name for the network connection. VPC_A_Connection VPC_B_Connection VPC_C_Connection
    Networks Select the ID of the network instance. VPC A is selected in this example. VPC B is selected in this example. VPC C is selected in this example.
    VSwitch Select a vSwitch in a zone that supports transit routers.

    If vSwitches are deployed in multiple zones that support transit routers, you can select multiple zones and select a vSwitch in each zone.

    • Hong Kong Zone B: vSwitch 1
    • Hong Kong Zone C: vSwitch 2
    • Hong Kong Zone B: vSwitch 1
    • Hong Kong Zone C: vSwitch 2
    • Hong Kong Zone B: vSwitch 1
    • Hong Kong Zone C: vSwitch 2
    Advanced Settings The following advanced features are disabled for VPC A, VPC B, and VPC C:
    • Associate with Default Route Table of Transit Router
    • Propagate System Routes to Default Route Table of Transit Router
    • Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC
    Note If the advanced features are enabled, VPC A, VPC B, and VPC C can automatically learn routes from each other. However, the network traffic cannot be scrubbed. Therefore, the advanced features are disabled in this example. In the following steps, custom route tables and route entries are used to define how network traffic is routed so that the network traffic can be scrubbed.

Step 3: Add route entries to the VPCs

Add route entries to VPC A, VPC B, and VPC C to route network traffic to the Enterprise Edition transit routers. Then, the network traffic is distributed by the Enterprise Edition transit routers for scrubbing.

  1. Log on to the VPC console.
  2. In the top navigation bar, select the region to which the route table that you want to manage belongs.
  3. Add route entries to VPC B and VPC C.
    Add the destination CIDR block 0.0.0.0/0 to the system route tables of VPC B and VPC C. Set the next hop to the transit routers to route network traffic that is destined for VPC B or VPC C to the transit routers.
    1. In the left-side navigation pane, click Route tables.
    2. On the Route Tables page, find the route table and click its ID.
      The system route table of VPC B is used as an example.
    3. On the Route Entry List tab, click Custom Route and then click Add Route Entry.
    4. In the Add Route Entry panel, set the following parameters and click OK:
      • Name: Enter a name for the custom route entry.
      • Destination CIDR Block: 0.0.0.0/0 is used in this example.
      • Next Hop Type: Transit Router is selected in this example.
      • Transit Router: The transit router that is associated with VPC B is selected in this example.
    5. Repeat the preceding step and set the following parameters to add a route entry to the system route table of VPC C:
      • Destination CIDR Block: 0.0.0.0/0 is used in this example.
      • Next Hop Type: Transit Router is selected in this example.
      • Transit Router: The transit router that is associated with VPC C is selected in this example.
  4. Create three custom route tables for VPC A. Name the route tables routetable1, routetable2, and routetable3. For more information, see Create a custom route table.
  5. Associate vSwitches with custom route tables. For more information, see Associate a route table with a vSwitch.
    In this example, vSwitch 1 of VPC A is associated with routetable1, vSwitch 2 is associated with routetable2, and vSwitch 3 is associated with routetable3.
  6. Add route entries to the custom route table of VPC A.
    1. On the Route Tables page, select a created route table and click its ID.
      routetable1 that is associated with vSwitch 1 is used as an example.
    2. On the Route Entry List tab, click Custom Route and then click Add Route Entry.
    3. In the Add Route Entry panel, set the following parameters and click OK:
      • Name: Enter a name for the route entry.
      • Destination CIDR Block: 0.0.0.0/0 is used in this example.
      • Next Hop Type: ECS Instance is selected in this example.
      • Resource Group: All is selected in this example.
      • ECS Instance: The ECS instance that provides security services is selected in this example. The ECS instance is deployed in vSwitch 3 of VPC A.
    4. Repeat the preceding steps to add the same route entry to routetable2 that is associated with vSwitch 2.
    5. Repeat the preceding steps to add a route entry to routetable3 that is associated with vSwitch 3. Set the following parameters for the route entry:
      • Destination CIDR Block: 0.0.0.0/0 is used in this example.
      • Next Hop Type: Transit Router is selected in this example.
      • Transit Router: The transit router that is associated with VPC A is selected in this example.
    The following table lists the information about the route entries added in the preceding steps.
    Network instance Route table vSwitch Route entry Next hop
    VPC_A routetable1 vSwitch 1 0.0.0.0/0 An ECS instance in vSwitch 3
    routetable2 vSwitch 2 0.0.0.0/0 An ECS instance in vSwitch 3
    routetable3 vSwitch 3 0.0.0.0/0 The transit router associated with VPC A
    VPC_B The system route table
    • vSwitch 1
    • vSwitch 2
    • vSwitch 3
    0.0.0.0/0 The transit router associated with VPC B
    VPC_C The system route table
    • vSwitch 1
    • vSwitch 2
    • vSwitch 3
    0.0.0.0/0 The transit router associated with VPC C

Step 4: Configure routes on the transit router

The Enterprise Edition transit router can route the network traffic from VPC B and VPC C to VPC A based on the route tables and route entries configured on the transit router. After the network traffic is scrubbed in VPC A, the network traffic is routed to its destination.

  1. Log on to the CEN console.
  2. On the Instances page, find the CEN instance and click its ID.
  3. Choose Basic Settings > Transit Router, find the transit router that you want to manage, and then click its ID.
  4. On the Route Table tab, create two custom route tables named TR_routetable1 and TR_routetable2. For more information, see Custom route tables.
  5. Associate VPC B and VPC C with the custom route table of the Enterprise Edition transit router and add route entries to the route table.
    1. On the Route Table tab, select TR_routetable1, click the Route Table Association tab, and then click Create Association.
    2. In the Add Association dialog box, select the network instance with which you want to associate the custom route table and click OK.
      VPC B and VPC C are associated with TR_routetable1 in this example.
    3. On the details page of the custom route table, click the Route Entry tab, and then click Add Route Entry.
    4. In the Add Route Entry dialog box, set the following parameters and click OK.
      • Destination CIDR: 0.0.0.0/0 is used in this example.
      • Blackhole Route: If you select Yes, traffic that is forwarded by this route is dropped. No is selected in this example.
      • Next Hop: VPC A is selected in this example.

      For more information, see Manage custom routes of a transit router.

    Then, network traffic destined for VPC B or VPC C is first routed to VPC A.
  6. Associate the other custom route table with VPC A and add route entries to the route table.
    1. On the Route Table tab, select TR_routetable2, click the Route Table Association table, and then click Create Association.
    2. In the Add Association dialog box, select the network instance with which you want to associate the custom route table and click OK.
      VPC A is associated with TR_routetable2 in this example.
    3. On the details page of the custom route table, click the Route Propagation tab, and then click Enable Route Propagation.
    4. In the Enable Route Propagation dialog box, select the network instance for which you want to enable route propagation and click OK.

      TR_routetable2 is propagated to VPC B and VPC C in this example. After route propagation is enabled, the routes of VPC B and VPC C can be propagated to the route table TR_routetable2. Then, network communication between VPC A and VPC B and between VPC A and VPC C can be enabled by using this route table.

    The following table lists the information about the route entries added to the route tables of the Enterprise Edition transit router.
    Route table Destination CIDR block Next hop
    TR_routetable1 0.0.0.0/0 VPC A
    TR_routetable2 10.2.0.0/24 VPC B
    10.2.1.0/24 VPC B
    10.2.2.0/24 VPC B
    10.3.0.0/24 VPC C
    10.3.1.0/24 VPC C
    10.3.2.0/24 VPC C

Step 5: Test the network connectivity

After you complete the preceding steps, you can test the network connectivity among VPC A, VPC B, and VPC C. The following steps show how to test the network connectivity.

  1. Log on to an ECS instance deployed in VPC A. Run the following command to enable data forwarding. For more information about how to log on to an ECS instance, see Connection methods.
    Note If data forwarding is disabled, VPC A and VPC B can communicate with each other, and VPC A and VPC C can communicate with each other. However, VPC B and VPC C cannot communicate with each other.
    echo 1 > /proc/sys/net/ipv4/ip_forward   #Enable data forwarding. This command temporarily enables data forwarding. Data forwarding is disabled if the ECS instance is restarted. 
  2. Log on to an ECS instance deployed in VPC B. Run the ping command to test the connectivity between VPC B and VPC A, and between VPC B and VPC C.
    If you receive an echo reply packet, it indicates that network communication is enabled between VPC B and VPC A, and between VPC B and VPC C.
    ping <The IP address of the ECS instance in the destination network>
  3. Log on to an ECS instance deployed in VPC C. Run the ping command to test the connectivity between VPC C and VPC A, and between VPC C and VPC B.
    If you receive an echo reply packet, it indicates that network communication is enabled between VPC C and VPC A, and between VPC C and VPC B.
    ping <The IP address of the ECS instance in the destination network>