Cloud Network Well-architected Design Guidelines:Multi-VPC network design in the same region

Overview

Background

As enterprises move to the cloud, network design shifts from broad provisioning to fine-grained management focused on security, disaster recovery, and scalability. Interconnecting VPCs within the same region is critical for efficiency, security, and availability. This topic covers how to use VPC peering connections and transit routers to build Well-Architected multi-VPC networks on Alibaba Cloud.

Terms

• Virtual Private Cloud (VPC): A logically isolated private network on Alibaba Cloud. You define IP address ranges, create subnets, and configure route tables within a VPC.

• VPC peering connection: A network connection between two VPCs that supports IPv4 and IPv6 interconnection. VPC peering connections work in the same or different regions and across accounts.

• Cloud Enterprise Network (CEN): CEN enables flexible interconnection, isolation, and traffic diversion policies within a region to build a reliable, large-scale enterprise global network.

• Transit router (TR): A CEN component that acts as a central router, connecting VPCs, VPNs, Virtual Border Routers (VBRs), and other Alibaba Cloud services. TRs support multiple route tables and advanced routing policies, enabling centralized traffic management across complex, cross-account multi-VPC architectures.

Design principles

Sustainable architecture: The network must support additional VPC connections, route entries, and security policies as the business grows, without requiring architectural changes.

Secure and limited access: Use network routing for on-demand communication between VPC CIDR blocks, preventing unauthorized access and enabling fine-grained access control.

Meet business performance needs: Optimize network topology and performance based on specific application requirements and traffic patterns.

Key design points

VPC peering connections and transit routers each have distinct advantages. Choose between them based on your requirements:

VPC peering connections suit simple, low-traffic environments that do not require scaling. They provide direct, low-latency connections with minimal cost and operational overhead.

Transit routers suit large-scale interconnection scenarios requiring high reliability, scalability, and flexible route management. Although TRs incur costs, they offer more powerful features for complex multi-VPC structures, aligning with the Well-Architected Framework pillars: security, reliability, performance efficiency, cost optimization, and deployment optimization.

Security

• VPC interconnection: Beyond security groups and network ACLs, TR routing policies enable centralized traffic management with unified security policies. Integrate a TR with Cloud Firewall for data isolation between business units.

• TR multi-route-table design: Create multiple route tables to isolate public, production, and test/development environments. Associate each VPC with a specific route table and use routing policies to control inter-environment access, defining which vSwitches can reach the Internet, private networks, or each other.

• Service chain design: Route traffic through a sequence of network services — firewalls, intrusion detection systems, and load balancers — to enforce security checkpoints. For example, direct all ingress and egress traffic through a TR to Cloud Firewall for policy compliance.

• Multi-TR plane isolation design: Use multiple TR planes to isolate network environments (production, development, management) or subsidiary networks. Each TR maintains its own route tables and security policies for fine-grained isolation. This design suits complex organizations that require separate network segmentation for governance and compliance.

Performance

• VPC peering connections provide direct, stable connections. Static routes reduce link redundancy and improve reliability, making peering easy to manage in simple topologies.

• Transit routers provide dynamic routing and failover for enhanced redundancy and self-healing. Unlike VPC peering, TRs support route propagation for greater reliability. Zone-level management lets you select TR vSwitches by zone to reduce forwarding latency.

Elasticity

• VPC peering connections provide the most direct, low-latency path for same-region multi-VPC communication.

• Transit routers handle large-scale data throughput and dynamically optimize routes based on real-time conditions. Maximum bandwidth per network instance connection: 50 Gbps in China (Hangzhou), China (Shanghai), China (Beijing), China (Shenzhen), China (Hong Kong), and Singapore; 10 Gbps in other regions.

Observability

• Enable flow logs and use Simple Log Service (SLS) to analyze traffic between peered VPCs.

• Network Intelligence Service (NIS) provides topology discovery, performance monitoring, and traffic analysis for TR architectures. NIS integrates AIOps methods — machine learning and knowledge graphs — to simplify network management with self-service O&M capabilities.

Best practices

VPC peering connections suit simple one-to-one connections. Transit routers are better for complex environments with multi-VPC, cross-account, and advanced routing needs. A properly configured TR lets you optimize traffic paths while maintaining scalability and security.

Simple network interconnection scenario

Two business units in separate VPCs use a peering connection for private network connectivity while maintaining isolation. This architecture is stable when no expansion is planned. VPC A and VPC B can share resources and access each other. If both VPCs are associated with IPv6 CIDR blocks, each route table can include both IPv4 and IPv6 routes for flexible dual-stack communication.

Complex network interconnection scenario

• DMZ: A security buffer between internal networks and the Internet. Contains external-facing components such as DDoS protection, WAF, NAT Gateway, Server Load Balancer (SLB), and frontend servers.

• Shared services area: Hosts services shared across environments — identity authentication, centralized logging, and internal DNS — to reduce redundant deployments.

• Production environment: Hosts business applications with the highest security and monitoring requirements. Different businesses can be split into separate VPCs.

• Development environment: Isolated from production for coding and initial testing. Different businesses can be split into separate VPCs.

• Staging environment: Simulates the production environment for integration testing, performance testing, and user acceptance testing before deployment.

• Security VPC: Hosts security tools — east-west firewalls, IDS, and vulnerability scanners — to monitor and protect the multi-VPC architecture.

• O&M & VPN access area: Provides remote access for O&M personnel through VPN and tools such as Wuying to securely manage cloud resources.

Scenario 1: Single-plane networking

Multiple business VPCs connect through a TR for on-demand interconnection. A DMZ VPC manages all public ingress and egress traffic. Route entries and routing policies in the TR route table control access between production, development, and testing environments.

Scenario 2: Multi-plane networking

Large enterprise networks often mirror the organizational structure: group, subsidiary, and business unit. Two strategies implement multi-plane architecture: multiple TR instances or TR route table segmentation. Horizontal segmentation divides by environment (production, development/testing, shared services) for centralized O&M. Vertical segmentation divides by subsidiary for independent O&M teams.

Multi-plane networking using multiple TR instances

Multiple TR planes isolate different environments. Only the shared services VPC connects across all planes. In the figure, TR-1 handles plane 1 and TR-2 handles plane 2, with the shared services VPC accessing both.

Multi-plane networking using TR multi-route-tables

Each subsidiary's VPC binds to an independent TR route table, with route configurations and policies determining inter-subsidiary connectivity. A dedicated public network route table can manage DMZ VPC forwarding as a unified ingress and egress point for north-south traffic.

Application scenarios

Simple business interconnection scenario: Suits simple cloud networks requiring only direct communication between two businesses, with low security and scalability requirements.

Standard enterprise cloud networking scenario: Suits medium-to-large enterprises with many business units and diverse interaction patterns (full, limited, or no interconnection). The network must be reliable, secure, scalable, and centrally managed.

Terraform reference

Visual architecture CADT reference

Simple network interconnection (using a peering connection)

Visual deployment architecture diagram

Procedure

Complex network interconnection (multi-plane networking using TR multi-route-tables)

Visual deployment architecture diagram

Procedure