All Products
Search

This Product

    Cloud Network Well-architected Design Guidelines:Use a third-party SD-WAN appliance to connect branch networks to the cloud

    Document Center

    Cloud Network Well-architected Design Guidelines:Use a third-party SD-WAN appliance to connect branch networks to the cloud

    Last Updated:Jun 04, 2026

    Overview

    Introduction

    Enterprises increasingly rely on Software-Defined Wide Area Network (SD-WAN) to connect branch offices, and public cloud adoption means those SD-WAN networks must also reach cloud resources. The most common approach is to run SD-WAN virtual customer premises equipment (vCPE) on cloud virtual machines using images provided by SD-WAN vendors.

    This topic explains how to integrate a third-party SD-WAN appliance with Alibaba Cloud networking to connect branch networks to the cloud securely, reliably, and efficiently.

    Terms

    SD-WAN: A wide area network built on software-defined networking (SDN) technology. SD-WAN logically decouples the control plane from the data plane and centrally manages both to optimize distributed network traffic.

    Virtual Private Cloud (VPC): A private, isolated network on Alibaba Cloud. You control the CIDR block, route tables, and gateways, and can deploy resources such as Elastic Compute Service (ECS) instances, ApsaraDB RDS instances, and SLB instances inside a VPC.

    Cloud Enterprise Network (CEN): A high-availability global network built on Alibaba Cloud's private backbone. CEN uses transit routers to connect VPCs across regions and link cloud networks to on-premises data centers.

    Express Connect: A dedicated connection service that links your data center to a VPC over a private circuit, ensuring stable, secure transmission and eliminating public internet jitter.

    Design principles

    image

    This architecture is designed around three principles:

    • Stability: Hybrid cloud and multi-cloud network connections carry internal business traffic. When those connections fail, communication between cloud workloads and on-premises systems is interrupted, and core business services can become unavailable. Designing for connection stability is the foundation of any reliable hybrid-cloud or multi-cloud architecture.

    • Security: Hybrid and multi-cloud networks involve inter-network communication across different trust boundaries. Traffic for business-critical workloads must be designed under the principles of controllability and least privilege to prevent data breaches and unauthorized access.

    • Self-service: Deploying and operating third-party SD-WAN images raises O&M engineer training costs. Efficient deployment, delivery, and maintenance directly determine the long-term viability of an SD-WAN-on-cloud strategy. Alibaba Cloud has partnered with multiple SD-WAN vendors to offer integrated service support for third-party product delivery on Alibaba Cloud.

    Key design

    Stability

    Connection disaster recovery

    Branch-to-cloud connections: The underlay network connecting branch offices to Alibaba Cloud must use lines from different ISPs to ensure high availability. Recommended combinations include: internet and leased lines, 4G and broadband, or circuits from different carriers (for example, China Telecom and China Unicom). Connection failover relies on the SD-WAN appliance's switchover capability — confirm the exact mechanism with your SD-WAN vendor. For leased-line high availability (HA) design, see the high reliability mode of Express Connect.

    Intra-region connections: Alibaba Cloud guarantees high availability for traffic crossing zones and VPCs within the same region. Redundant optical fiber links span availability zones, enabling millisecond-level failovers.

    Inter-region connections: CEN-based cross-region connections are backed by at least three leased circuits between every two nodes for primary/secondary failover. Multi-plane anomaly detection selects the optimal path, completing failovers within seconds.

    Network element disaster recovery

    Cloud networking

    • Cloud-native network elements (NEs): Express Connect Routers (ECRs) support cross-zone disaster recovery and multi-cluster deployment within a single zone, eliminating single points of failure. Transit routers are also cross-zone resilient — they route traffic to elastic network interfaces (ENIs) in the nearest zone and automatically shift to healthy ENIs in other zones when a zone goes down. Each ENI is associated with multiple transit routers to prevent single points of failure. N-active (ECMP) mode: Configure multiple IPsec-VPN connections as Equal-Cost Multi-Path (ECMP) peers on a transit router to distribute traffic across all active paths simultaneously. Active/standby mode: Use BGP route preferences to designate one path as primary and another as standby; BGP automatically withdraws routes from the failed path and reconverges. Choose N-active for higher aggregate throughput; choose active/standby when you need predictable traffic flow and simpler troubleshooting.

    • Third-party SD-WAN NEs: Deploy third-party SD-WAN images across zones in a dedicated VPC. Connect the SD-WAN networks to transit routers through IPsec-VPN connections and use BGP to synchronize routes. BGP dynamic routing automatically fails over when an appliance goes down. Consult your SD-WAN vendor for the recommended deployment topology. For more information, see Connect a third-party SD-WAN to a transit router.

    Security

    Configure a transit VPC

    • The transit VPC acts as a security buffer between on-cloud and on-premises networks. Deploy firewalls or intrusion detection systems inside the transit VPC to monitor and filter all crossing traffic.

    • Use the transit VPC to enforce fine-grained access control, restricting which users and devices can reach specific network resources.

    • The transit VPC is the natural inspection point for logging and auditing all traffic between on-cloud and on-premises environments.

    Configure a security service chain

    • Use transit routers to steer east-west SD-WAN traffic through VPC firewalls or third-party firewalls for deep-packet inspection and auditing.

    • When configuring a security service chain with transit routers, always use the most specific routes to make sure traffic hits the intended inspection path.

    Configure security groups and network ACLs: Create security groups and network access control lists (ACLs) to control inbound and outbound VPC traffic. Define per-instance or per-service rules that allow access only on required ports and protocols.

    Performance

    • Encryption algorithms: Traffic traverses many NEs end to end, and IPsec-VPN encrypts it at each hop. The encryption algorithm directly affects latency and maximum per-connection bandwidth — pay close attention if your workloads are latency-sensitive. For VPN Gateway bandwidth of 200 Mbit/s or higher, use AES, AES-192, or AES-256. Avoid 3DES: it uses a triple-pass symmetric cipher that is computationally expensive and degrades forwarding performance. AES is a symmetric-key algorithm that delivers strong encryption with minimal impact on latency, throughput, and forwarding performance.

    • Latency: For latency-sensitive workloads, deploy all network resources in the same availability zone. Consult your Alibaba Cloud architect for zone placement guidance.

    • Bandwidth: Total cloud migration bandwidth is constrained by the slowest link in the chain: the on-premises data egress, the leased-line capacity, the third-party SD-WAN performance, and the IPsec-VPN connection bandwidth. A single IPsec-VPN connection supports up to 1,000 Mbit/s. To exceed this limit, add more connections for ECMP routing — confirm BGP ECMP support with your SD-WAN vendor before designing for it. For details on multi-connection load balancing, see Load balancing with multiple public IPsec-VPN connections.

    Resilience

    This solution does not provide built-in elasticity. End-to-end throughput is bounded by the on-premises data egress, leased-line bandwidth, and the SD-WAN appliance's capacity. To increase total bandwidth, benchmark your connections, CPEs, and SD-WAN appliances to identify the bottleneck before scaling.

    Observability

    Use Network Intelligence Service (NIS) and flow logs to monitor cloud traffic:

    • Intra-region traffic: Analyze VPC-to-VPC traffic through transit routers using VPC and transit router flow logs. Data is available as 1-tuple (instance), 2-tuple (cloud IP and peer IP), and 5-tuple (cloud IP, cloud port, protocol, peer IP, and peer port).

    • Hybrid cloud traffic: Analyze VPC-to-data-center traffic through transit routers and virtual border routers (VBRs) using transit router flow logs. The same tuple formats apply.

    Self-service

    Alibaba Cloud offers two ways to deploy third-party SD-WAN images in the cloud.

    • Console: Purchase third-party SD-WAN images directly from Alibaba Cloud Marketplace inside the CEN console.

      image

      For more information, see Connect a third-party SD-WAN to a transit router.

    • Compute Nest: Browse and deploy third-party networking solutions from the service marketplace in the Compute Nest console.

      image.png

    Best practices

    image

    Transit VPC design

    • Install third-party SD-WAN images on ECS instances in the transit VPC and manage them through a third-party SD-WAN controller. Attach elastic IP addresses (EIPs) to VPN gateways in branch networks and connect them over public IPsec-VPN tunnels. Use private IP addresses with IPsec for private IPsec-VPN tunnels.

    • Region selection:

      • To reach VPCs in multiple regions from a branch network, or to connect branch networks to each other, place the transit VPC in the region nearest to the branches.

      • To reach VPCs in a single region from a branch network, place the transit VPC in that region.

    IPsec-VPN connection design (connect branch networks)

    • Create IPsec-VPN connections in the same region as the transit VPC.

    • Two IPsec-VPN connections for ECMP routing:

      • Alibaba Cloud side: Configure two IPsec-VPN connections and attach both to a transit router. Add routes in the transit router route table to distribute traffic across both connections for ECMP routing. This guarantees cross-zone IPsec-VPN redundancy and doubles aggregate tunnel bandwidth (1 Gbit/s per tunnel x number of tunnels).

      • Third-party SD-WAN images: Install an SD-WAN image on two ECS instances. On each appliance, create one public and one private IPsec-VPN tunnel to the branch VPN gateway, and one public and one private IPsec-VPN tunnel to each IPsec-VPN connection. Enable BGP on both sides. When an appliance fails, BGP automatically reconverges routes and shifts traffic to the surviving path.

      • Branch networks: Deploy two gateway devices at each branch and create one tunnel per device. Set both devices as ECMP next hops. This delivers multi-gateway disaster recovery and increases aggregate tunnel bandwidth (1 Gbit/s per tunnel x number of tunnels).

    • For more information, see Quotas and limits.

    Transit router design

    • Transit VPC attachment: Build the underlay network by creating private IPsec-VPN tunnels between the third-party SD-WAN appliance and private IPsec-VPN connections.

    • Private IPsec-VPN connection attachments: Connect the third-party SD-WAN appliance to transit routers.

    • Intra-region production VPC and VBR attachments: Connect branch networks to production VPCs and virtual border routers (VBRs).

    • Create cross-region connections to transit routers in other regions as needed.

    • Configure transit router route tables and routing policies to control route learning and advertisement between IPsec-VPN connections and production VPCs.

    • For more information, see Limitations.

    Integratable third-party SD-WAN

    Scenarios

    Connect data centers to the cloud

    Use this approach if you are migrating workloads to the cloud and need to bridge data centers with cloud VPCs. Traditional leased-line setups take weeks or months to provision and carry high recurring costs. Pure VPN solutions struggle with global O&M overhead and high-bandwidth scenarios. SD-WAN cuts provisioning time, lowers networking costs, and makes full use of existing leased lines or internet connections for a cost-efficient hybrid setup.

    Connect branch networks

    Use this approach if you are scaling branch office connectivity and need to manage thousands or tens of thousands of sites centrally. Branch staff typically have little IT expertise, so headquarters engineers must handle all network configuration. The third-party SD-WAN solution on Alibaba Cloud lets you configure and centrally manage large numbers of branch networks without on-site IT resources at every location.

    Accelerate office networks

    Use this approach if you are expanding globally and your overseas offices rely on long-distance data transmission. Network quality directly affects employee productivity and business outcomes in this scenario. SD-WAN on Alibaba Cloud CEN routes traffic over Alibaba Cloud's global private backbone, significantly improving cross-region transmission quality. CEN activates immediately, charges on a pay-as-you-go basis, and scales on demand — so you can enter new markets without long infrastructure lead times.