Secure traffic exchange with an Enterprise transit router - Cloud Enterprise Network

An Enterprise Edition transit router provides flexible routing management, allowing you to build a service chain that directs traffic to a security server for filtering. This enhances network security by ensuring only filtered traffic is allowed to communicate.

Use case

This topic shows how to use an Enterprise Edition transit router to secure traffic within a region. A company has three isolated Virtual Private Clouds (VPCs) in the China (Hangzhou) region, and VPC-secure contains a security service. To accommodate business growth and enhance network security, the company wants to enable communication between VPC-workload-a and VPC-workload-b. However, the security service in VPC-secure must first filter and then forward all traffic between them.

You can connect VPC-workload-a and VPC-workload-b to an Enterprise Edition transit router. You can then create custom routing rules on the transit router to secure the communication between them.

Prerequisites

Ensure the VPC that hosts your security service is in a region that supports Transit Router Enterprise Edition. For more information about the regions and zones supported by Transit Router Enterprise Edition, see Supported regions and zones for Transit Router Enterprise Edition.

You have created three Virtual Private Clouds (VPCs) in the China (Hangzhou) region and deployed an ECS instance in each. For more information, see Create an IPv4-only VPC.

The VPC has sufficient vSwitches in the zone supported by the Enterprise Edition transit router. Each vSwitch has at least one idle IP address. For more information about how to create a vSwitch, see Create a vSwitch.

If the Enterprise Edition transit router is deployed in a region that supports only one zone, for example, China (Nanjing - Local Region), the VPC must have at least one vSwitch in the zone.
If the Enterprise Edition transit router is deployed in a region that supports multiple zones, for example, China (Shanghai), the VPC must have at least two vSwitches in the zones. The vSwitches must be in different zones.

For example, if you create a VPC in the China (Hangzhou) region, it must have at least one vSwitch in Zone I and one in Zone J. Each vSwitch must have at least one available IP address.

Note

Transit Router Enterprise Edition creates an elastic network interface (ENI) on a vSwitch in a zone. The ENI serves as an entry point for traffic from the VPC to the Transit Router Enterprise Edition instance. Each ENI consumes one IP address.

In this example, VPC-secure contains three vSwitches: vSwitch1 is for deploying the security service, while vSwitch2 and vSwitch3 are for connecting to Transit Router Enterprise Edition. The following table shows the network plan for the three VPCs. When planning your network, ensure the CIDR blocks of interconnected networks do not overlap. For all three ECS instances, select the Alibaba Cloud Linux image.

VPC	vSwitch	vSwitch zone	CIDR block	ECS address
VPC-secure CIDR block: 10.0.0.0/16	vSwitch1	Zone I	10.0.0.0/24	ECS-secure: 10.0.0.1
	vSwitch2	Zone J	10.0.1.0/24
	vSwitch3	Zone K	10.0.2.0/24
VPC-workload-a CIDR block: 10.1.0.0/16	vSwitch4	Zone I	10.1.0.0/24	ECS-workload-a: 10.1.0.1
	vSwitch5	Zone J	10.1.1.0/24
	vSwitch6	Zone K	10.1.2.0/24
VPC-workload-b CIDR block: 10.2.0.0/16	vSwitch7	Zone I	10.2.0.0/24	ECS-workload-b: 10.2.0.1
	vSwitch8	Zone J	10.2.1.0/24
	vSwitch9	Zone K	10.2.2.0/24

You have confirmed that the security group rules for the ECS instances in VPC-secure, VPC-workload-a, and VPC-workload-b allow inbound ICMP traffic. For more information, see Query security group rules and Add a security group rule.

Get started

This topic describes how to perform the configuration in the console and by using Terraform. You can select a method as needed.

Console

Step 1: Create a CEN instance

A Cloud Enterprise Network (CEN) instance is a basic resource for creating and managing an integrated network. You must create a CEN instance before connecting network instances using an Enterprise Edition transit router.

Log on to the CEN console.
On the Instances page, click Create CEN Instance.
In the Create CEN Instance dialog box, configure the following parameters and click OK.
- Name: Enter a name for the CEN instance. In this example, enter CEN-intra-region-secure-communication.
- Description: Enter a description for the CEN instance.
- Resource Group: Select the resource group to which the CEN instance belongs. In this example, no resource group is selected, so the CEN instance belongs to the default resource group after it is created.
- Tag: Enter tags for the CEN instance. In this example, leave this parameter empty.

After the CEN instance is created, the CEN instance list contains a CEN instance named CEN-intra-region-secure-communication in the Available state.

Step 2: Create a transit router instance

To connect network instances using an Enterprise Edition transit router, you must first create a transit router instance in the same region as the network instances.

Log on to the CEN console.
On the CEN Instance page, select the CEN instance that you created in Step 1 and click its instance ID.
On the Basic Settings > Transit Router tab, click Create Transit Router.

In the Create Transit Router dialog box, configure the parameters for the transit router and click OK.

Parameter	Description	Setting
Region	Select the region where you want to deploy the transit router instance.	In this example, China (Hangzhou) is selected.
Edition	The edition of the transit router instance.	The system automatically determines and displays the edition of the transit router instance in the current region.
Enable Multicast	Specifies whether to enable the multicast feature for the transit router.	In this example, the multicast feature is left disabled (the default setting).
Name	Enter a name for the transit router instance.	In this example, enter `TR-intra-region-secure-communication`.
Description	Enter a description for the transit router instance.	Enter a description for the transit router.
Tag	Add a tag to the Enterprise Edition transit router.	In this example, this parameter is left empty.
Transit Router CIDR	Enter a CIDR block for the transit router. For more information, see Transit router CIDR block.	This example does not specify a CIDR block for the transit router.

After the transit router is created, the transit router list contains an Enterprise Edition transit router named TR-intra-region-secure-communication in the China (Hangzhou) region and in the Available state.

Step 3: Connect the VPC instances

Connect the network instances that need to communicate to the Enterprise Edition transit router.

Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
On the Basic Settings > Transit Router tab, find the transit router in the destination region. In the Actions column, click Create Connection > Create Intra-Region Connection.

On the Create Intra-Region Connection page, configure the following parameters and click OK.

Connect VPC-secure, VPC-workload-a, and VPC-workload-b to the Enterprise Edition transit router by using the parameters described in the following table.

Parameter	Description	VPC-secure	VPC-workload-a	VPC-workload-b
Network Type	Select the type of network instance to connect.	VPC	VPC	VPC
Region	Select the region of the network instance.	China (Hangzhou)	China (Hangzhou)	China (Hangzhou)
Transit Router	The system automatically displays the transit router instances in the selected region.
Account	Select the account type that owns the network instance.	Your Account	Your Account	Your Account
Billing Method	The default value is Pay-As-You-Go.
Attachment Name	Enter a name for the network instance connection.	`attachment-secure`	`attachment-workload-a`	`attachment-workload-b`
Tag	Add a tag to the network instance connection.	In this example, this parameter is left empty.	In this example, this parameter is left empty.	In this example, this parameter is left empty.
Networks	Select the network instance to connect.	Select VPC-secure.	Select VPC-workload-a.	Select VPC-workload-b.
VSwitch	Select a vSwitch in a zone that is supported by the transit router. To implement zone-level disaster recovery, if you have vSwitches in multiple supported zones, select one vSwitch from each zone.	China (Hangzhou) Zone J: Select vSwitch2. China (Hangzhou) Zone K: Select vSwitch3.	China (Hangzhou) Zone I: Select vSwitch4. China (Hangzhou) Zone J: Select vSwitch5.	China (Hangzhou) Zone I: Select vSwitch7. China (Hangzhou) Zone J: Select vSwitch8.
Advanced Settings	For VPC-secure, VPC-workload-a, and VPC-workload-b, disable the following three advanced settings. Associate with Default Route Table of Transit Router Propagate system routes to transit router route table Auto-add transit router routes to all VPC route tables Note Enabling these settings allows VPC-secure, VPC-workload-a, and VPC-workload-b to automatically learn each other's routes and communicate, which bypasses the required security inspection. Therefore, you will disable these settings and instead manually configure route tables and add route entries to customize connectivity and enable secure traffic inspection.

After the connections are created, the Intra-region Connection tab contains three VPC attachments:

Name	Network instance	Attachment details - vSwitch
attachment-secure	VPC-secure	vSwitch2, vSwitch3
attachment-workload-a	VPC-workload-a	vSwitch4, vSwitch5
attachment-workload-b	VPC-workload-a	vSwitch7, vSwitch8

Step 4: Add routes to VPCs

Add route entries to VPC-secure, VPC-workload-a, and VPC-workload-b to direct their traffic to the Enterprise Edition transit router. This allows you to manage the traffic within the transit router to perform secure traffic inspection.

Configure the route tables in VPC-secure:
1. In VPC-secure, create two custom route tables. Set Associated Resource Type to vSwitch, and name the route tables routetable_secure-to-workload and routetable_workload-to-secure.
2. Associate routetable_secure-to-workload with vSwitch1 and add a route entry:
  - Destination CIDR Block: Enter 0.0.0.0/0.
  - Next Hop Type: Select Transit Router.
  - Transit Router: Select attachment-secure.
3. Associate routetable_workload-to-secure with vSwitch2 and vSwitch3, and add a route entry:
  - Destination CIDR Block: Enter 0.0.0.0/0.
  - Next Hop Type: Select ECS Instance.
  - ECS Instance: Select ECS-secure (the security ECS instance).
In the system route tables of VPC-workload-a and VPC-workload-b, add the following route entry to direct traffic between VPC-workload-a and VPC-workload-b to the transit router:
- Destination CIDR Block: Enter 0.0.0.0/0.
- Next Hop Type: Select Transit Router.
- Transit Router: When you configure the system route table for VPC-workload-a, select attachment-workload-a. When you configure the system route table for VPC-workload-b, select attachment-workload-b.

After the route entries are added, the new routing configuration for each VPC is as follows:

Network instance	vSwitch	Associated route table	Route entry	Next hop
VPC-secure	vSwitch1	routetable_secure-to-workload	0.0.0.0/0	`attachment-secure` (transit router)
	vSwitch2	routetable_workload-to-secure	0.0.0.0/0	ECS-secure
	vSwitch3	routetable_workload-to-secure	0.0.0.0/0	ECS-secure
VPC-workload-a	vSwitch4 vSwitch5 vSwitch6	System route table	0.0.0.0/0	`attachment-workload-a` (transit router)
VPC-workload-b	vSwitch7 vSwitch8 vSwitch9	System route table	0.0.0.0/0	`attachment-workload-b` (transit router)

Step 5: Configure transit router routes

After traffic from the VPCs enters the Enterprise Edition transit router, you can customize connectivity by creating route tables and adding route entries. This configuration will first guide traffic from VPC-workload-a and VPC-workload-b to VPC-secure for inspection, and then forward the filtered traffic from VPC-secure to its final destination.

Log on to the CEN console.
On the CEN Instance page, click the ID of your CEN instance.
Go to the Basic Information > Transit Router tab and click the ID of the transit router that you want to manage.
On the Route Table tab, create two custom route tables for the Enterprise Edition transit router. Name them TR_routetable_workload-to-secure and TR_routetable_secure-to-workload. For more information, see Custom route tables.
Associate the attachment-workload-a and attachment-workload-b connections with a custom route table of the Enterprise Edition transit router and configure a route entry for the route table.
1. On the Route Table tab, select the custom route table TR_routetable_workload-to-secure, click the Route Table Association tab, and then click Create Association.
2. In the Add Association dialog box, select the network instance connections to associate with this custom route table and click OK.
  In this example, associate the attachment-workload-a and attachment-workload-b connections with this custom route table.
3. On the details page of the route table, click the Route Entry tab and click Add Route Entry.
4. In the Add Route Entry dialog box, set the following parameters and click OK.
  - Destination CIDR: In this example, enter 0.0.0.0/0.
  - Blackhole Route: If you select this option, all traffic destined for this route is dropped. In this example, select No.
  - Next Hop: In this example, select attachment-secure.
  For more information, see Add a custom route entry.
After you complete these steps, the transit router forwards all traffic from VPC-workload-a and VPC-workload-b to VPC-secure.

Associate a custom route table with VPC-secure and configure route entries.

On the Route Table tab, select the custom route table TR_routetable_secure-to-workload, click the Route Table Association tab, and then click Create Association.
In the Add Association dialog box, select the network instance connection to associate with the custom route table and click OK.
In this example, associate attachment-secure with this custom route table.
On the details page of the route table, click the Route Propagation tab and click Enable Route Propagation.
In the Enable Route Propagation dialog box, select the network instance connections whose routes you want to propagate to this route table, and then click OK.
In this example, the Attachment is set to attachment-workload-a and attachment-workload-b. Once associated, the route table learns the routes to VPC-workload-a and VPC-workload-b. VPC-secure can then communicate with VPC-workload-a and VPC-workload-b by looking up this route table.

After the route entries are created, the route entries for the Enterprise Edition transit router are as follows:

Route table name	Destination CIDR block	Next hop
TR_routetable_workload-to-secure	0.0.0.0/0	`attachment-secure`
TR_routetable_secure-to-workload	10.1.0.0/24	`attachment-workload-a`
	10.1.1.0/24	`attachment-workload-a`
	10.1.2.0/24	`attachment-workload-a`
	10.2.0.0/24	`attachment-workload-b`
	10.2.1.0/24	`attachment-workload-b`
	10.2.2.0/24	`attachment-workload-b`

Step 6: Test and verify

After you complete the preceding steps, VPC-secure, VPC-workload-a, and VPC-workload-b can securely communicate with each other along the expected path. The following steps describe how to test the traffic path between the VPCs.

Log on to ECS-secure and run the following command to enable IP forwarding. To learn how to log on to an ECS instance, see Connection methods.
Note
If IP forwarding is not enabled, VPC-workload-a can communicate with VPC-secure and VPC-workload-b can communicate with VPC-secure. However, VPC-workload-a and VPC-workload-b cannot communicate with each other.
```
echo 1 > /proc/sys/net/ipv4/ip_forward   # Enable IP forwarding. This command takes effect temporarily and the setting is lost after a restart.
```
Log on to ECS-workload-a and install mtr. mtr is a network diagnostic tool that combines the features of ping and traceroute to analyze network path latency and packet loss in real time. In this topic, you will use mtr to identify the traffic path.
```
yum install -y mtr
```

On ECS-workload-a, run the mtr command to test the traffic path from ECS-workload-a to ECS-workload-b:

Use mtr

mtr 10.2.0.1 -i 5

Parameter description: -i 5 specifies that a ping request is sent every 5 seconds.

My traceroute  [v0.92]
iZxxxvZ (10.1.0.1)                              2024-12-04T20:40:46+0800
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                       Packets               Pings
 Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 10.0.0.1                          0.0%     9    3.8   3.8   3.8   4.1   0.1
 2. 10.0.0.1                          0.0%     9    5.0   4.0   3.8   5.0   0.4
 3. 10.2.0.1                          0.0%     9    8.2   8.3   8.2   8.6   0.1

The command output shows that the network forwards packets from ECS-workload-a to ECS-workload-b through 10.0.0.1 (ECS-secure). This confirms that traffic between VPC-workload-a and VPC-workload-b routes through the security ECS instance (ECS-secure).

Terraform

You can use Terraform to build the environment for the scenario in this topic. For information about how to install and configure Terraform, see Install Terraform.

The following steps use a Linux host that runs Terraform v1.9.8 as an example. Before you begin, make sure that you have completed Authentication.

Note

This tutorial creates billable resources. To avoid unnecessary charges, promptly release these resources when you no longer need them.

Step 1: Create resources

The following Terraform code is used in this scenario:

variable "pname" {
  description = "The prefix name for the resources"
  type        = string
  default     = "tf-CenSec"
}
variable "default_region" {
  description = "Default region"
  type        = string
  default     = "cn-hangzhou"
}
variable "az" {
  description = "List of availability zones to use"
  type        = list(string)
  default     = ["cn-hangzhou-i", "cn-hangzhou-j", "cn-hangzhou-k"]
}
variable "vpc_count" {
  description = "Number of VPCs to create"
  type        = number
  default     = 3
}
provider "alicloud" {
  region = var.default_region
}
# VPC
resource "alicloud_vpc" "main" {
  count      = var.vpc_count
  vpc_name   = "${var.pname}-vpc${count.index + 1}"
  cidr_block = "10.${count.index}.0.0/16"
}
# vSwitch
resource "alicloud_vswitch" "main" {
  count        = var.vpc_count * length(var.az)
  vpc_id       = alicloud_vpc.main[floor(count.index / length(var.az))].id
  cidr_block   = "10.${floor(count.index / length(var.az))}.${count.index % length(var.az)}.0/24"
  zone_id      = var.az[count.index % length(var.az)]
  vswitch_name = "${var.pname}-vsw${count.index + 1}"
}
# ECS
resource "alicloud_instance" "main" {
  count                = var.vpc_count
  instance_name        = "${var.pname}-ecs${count.index + 1}"
  instance_type        = "ecs.e-c1m1.large"
  security_groups      = [alicloud_security_group.main[count.index].id]
  vswitch_id           = alicloud_vswitch.main[count.index * length(var.az)].id
  image_id             = "aliyun_3_x64_20G_qboot_alibase_20230727.vhd"
  system_disk_category = "cloud_essd"
  private_ip           = "10.${count.index}.0.1"
  instance_charge_type = "PostPaid"
  user_data = base64encode(<<-EOT
    #!/bin/bash
    ${count.index == 0 ? "echo 1 > /proc/sys/net/ipv4/ip_forward" : ""} 
    yum install -y traceroute
    yum install -y mtr
  EOT
  ) # Enable IP forwarding for ECS1.
}
# Security group
resource "alicloud_security_group" "main" {
  count               = var.vpc_count
  security_group_name = "${var.pname}-${count.index + 1}"
  vpc_id              = alicloud_vpc.main[count.index].id
}
resource "alicloud_security_group_rule" "allow_inbound_ssh" {
  count             = var.vpc_count
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "22/22"
  priority          = 1
  security_group_id = alicloud_security_group.main[count.index].id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_inbound_icmp" {
  count             = var.vpc_count
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.main[count.index].id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_all_outbound" {
  count             = var.vpc_count
  type              = "egress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "1/65535"
  priority          = 1
  security_group_id = alicloud_security_group.main[count.index].id
  cidr_ip           = "0.0.0.0/0"
}
# CEN
resource "alicloud_cen_instance" "cen1" {
  cen_instance_name = var.pname
}
# Transit router
resource "alicloud_cen_transit_router" "tr1" {
  transit_router_name = var.pname
  cen_id              = alicloud_cen_instance.cen1.id
}
# Attach attach1 to vSwitch2 and vSwitch3 in VPC1.
resource "alicloud_cen_transit_router_vpc_attachment" "attach1" {
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr1.transit_router_id
  vpc_id            = alicloud_vpc.main[0].id
  zone_mappings {
    zone_id    = var.az[1]
    vswitch_id = alicloud_vswitch.main[1].id # vSwitch2, vpc1-2
  }
  zone_mappings {
    zone_id    = var.az[2]
    vswitch_id = alicloud_vswitch.main[2].id # vSwitch3, vpc1-3
  }
  transit_router_vpc_attachment_name = "attach1"
}
# Attach attach2 to vSwitch4 and vSwitch5 in VPC2.
resource "alicloud_cen_transit_router_vpc_attachment" "attach2" {
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr1.transit_router_id
  vpc_id            = alicloud_vpc.main[1].id
  zone_mappings {
    zone_id    = var.az[0]
    vswitch_id = alicloud_vswitch.main[3].id # vSwitch4, vpc2-1
  }
  zone_mappings {
    zone_id    = var.az[1]
    vswitch_id = alicloud_vswitch.main[4].id # vSwitch5, vpc2-2
  }
  transit_router_vpc_attachment_name = "attach2"
}
# Attach attach3 to vSwitch7 and vSwitch8 in VPC3.
resource "alicloud_cen_transit_router_vpc_attachment" "attach3" {
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr1.transit_router_id
  vpc_id            = alicloud_vpc.main[2].id
  zone_mappings {
    zone_id    = var.az[0]
    vswitch_id = alicloud_vswitch.main[6].id # vSwitch7, vpc3-1
  }
  zone_mappings {
    zone_id    = var.az[1]
    vswitch_id = alicloud_vswitch.main[7].id # vSwitch8, vpc3-2
  }
  transit_router_vpc_attachment_name = "attach3"
}
# Create two route tables for VPC1.
resource "alicloud_route_table" "rt" {
  count            = 2
  vpc_id           = alicloud_vpc.main[0].id
  route_table_name = "${var.pname}-rt${count.index}"
  associate_type   = "VSwitch"
}
# Associate rt1 with vSwitch1, and rt2 with vSwitch2 and vSwitch3.
locals {
  # Map of route tables and vSwitches.
  rt_attachments = {
    "rt1_vsw1" = {
      route_table_index = 0
      vswitch_index     = 0
    }
    "rt2_vsw2" = {
      route_table_index = 1
      vswitch_index     = 1
    }
    "rt2_vsw3" = {
      route_table_index = 1
      vswitch_index     = 2
    }
  }
}
resource "alicloud_route_table_attachment" "rt_attach" {
  for_each = local.rt_attachments
  vswitch_id     = alicloud_vswitch.main[each.value.vswitch_index].id
  route_table_id = alicloud_route_table.rt[each.value.route_table_index].id
}
# Route entries for VPC1.
resource "alicloud_route_entry" "rt-entry1" { # The next hop is the transit router.
  route_table_id        = alicloud_route_table.rt[0].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
resource "alicloud_route_entry" "rt-entry2" { # The next hop is ECS1.
  route_table_id        = alicloud_route_table.rt[1].id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Instance"
  nexthop_id            = alicloud_instance.main[0].id # ecs1
}
# Route entries for VPC2 and VPC3.
resource "alicloud_route_entry" "rt-entry4" {
  route_table_id        = alicloud_vpc.main[1].route_table_id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_route_entry" "rt-entry5" {
  route_table_id        = alicloud_vpc.main[2].route_table_id
  destination_cidrblock = "0.0.0.0/0"
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach3.transit_router_attachment_id
}
# Create two new transit router route tables.
resource "alicloud_cen_transit_router_route_table" "tr_rt1" {
  transit_router_id               = alicloud_cen_transit_router.tr1.transit_router_id
  transit_router_route_table_name = "tr_rt1"
}
resource "alicloud_cen_transit_router_route_table" "tr_rt2" {
  transit_router_id               = alicloud_cen_transit_router.tr1.transit_router_id
  transit_router_route_table_name = "tr_rt2"
}
# Associate tr_rt1 with attach2 and attach3.
resource "alicloud_cen_transit_router_route_table_association" "ass1" {
  transit_router_route_table_id = alicloud_cen_transit_router_route_table.tr_rt1.transit_router_route_table_id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_association" "ass2" {
  transit_router_route_table_id = alicloud_cen_transit_router_route_table.tr_rt1.transit_router_route_table_id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach3.transit_router_attachment_id
}
# Associate tr_rt2 with attach1.
resource "alicloud_cen_transit_router_route_table_association" "ass3" {
  transit_router_route_table_id = alicloud_cen_transit_router_route_table.tr_rt2.transit_router_route_table_id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
# Transit router route entries.
resource "alicloud_cen_transit_router_route_entry" "tr_rt1_entry1" {
  transit_router_route_table_id                     = alicloud_cen_transit_router_route_table.tr_rt1.transit_router_route_table_id
  transit_router_route_entry_destination_cidr_block = "0.0.0.0/0"
  transit_router_route_entry_next_hop_type          = "Attachment"
  transit_router_route_entry_next_hop_id            = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_entry" "tr_rt2_entry1" {
  transit_router_route_table_id                     = alicloud_cen_transit_router_route_table.tr_rt2.transit_router_route_table_id
  transit_router_route_entry_destination_cidr_block = "10.1.0.0/16"
  transit_router_route_entry_next_hop_type          = "Attachment"
  transit_router_route_entry_next_hop_id            = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_entry" "tr_rt2_entry2" {
  transit_router_route_table_id                     = alicloud_cen_transit_router_route_table.tr_rt2.transit_router_route_table_id
  transit_router_route_entry_destination_cidr_block = "10.2.0.0/16"
  transit_router_route_entry_next_hop_type          = "Attachment"
  transit_router_route_entry_next_hop_id            = alicloud_cen_transit_router_vpc_attachment.attach3.transit_router_attachment_id
}
output "ecs1_login_address" {
  value = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=${var.default_region}&instanceId=${alicloud_instance.main[0].id}"
}
output "ecs2_login_address" {
  value = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=${var.default_region}&instanceId=${alicloud_instance.main[1].id}"
}
output "ecs3_login_address" {
  value = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=${var.default_region}&instanceId=${alicloud_instance.main[2].id}"
}

Step 2: Test and verify

Log on to the ECS2 instance (named tf-CenSec-ecs2):

In the Terraform outputs, find the logon address for ECS2. Copy the address into your browser. When you log on, select Temporary SSH Key for the authentication method.

After Terraform runs, it produces output similar to the following. In this example, ecs2_login_address is the logon address for ECS2.

Outputs:
ecs1_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-hangzhou&instanceId=i-bp1xxx"
ecs2_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-hangzhou&instanceId=i-bp1xxx"
ecs3_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-hangzhou&instanceId=i-bp1xxx"

On ECS2, run the mtr command to test the traffic path from ECS2 to ECS3:

Use mtr

mtr 10.2.0.1 -i 5

Parameter description: -i 5 specifies that a ping request is sent every 5 seconds.

My traceroute  [v0.92]
iZbp1xxx (10.1.0.1)                          2024-12-04T20:40:46+0800
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
                                         Packets               Pings
 Host                                  Loss%   Snt   Last   Avg  Best  Wrst StDev
 1. 10.0.0.1                            0.0%     9    3.8   3.8   3.8   4.1   0.1
 2. 10.0.0.1                            0.0%     9    5.0   4.0   3.8   5.0   0.4
 3. 10.2.0.1                            0.0%     9    8.2   8.3   8.2   8.6   0.1

The result shows that the network forwards packets from ECS2 to ECS3 through 10.0.0.1 (ECS1). This confirms that traffic between VPC2 and VPC3 routes through the security ECS instance (ECS1).

Step 3: Release the resources

After you complete the verification, if you no longer need the resources, run the following command to release them and prevent additional charges.

terraform destroy --auto-approve