Express Connect:Attach a VBR to a CEN instance that belongs to a different account

Scenarios

An enterprise uses Account A to create a VBR in the China (Hangzhou) region. The enterprise uses Account B to create a CEN instance and a transit router in the China (Hangzhou) region. The enterprise wants to use the CEN authorization feature of the VBR to attach the VBR to the CEN instance.

Limits

VBRs that are created on the China site can connect only to virtual private clouds (VPCs) that are created on the China site. VBRs that are created on the International site can connect only to VPCs that are created on the International site.

Prerequisites

• A VBR is created in the China (Hangzhou) region by using Account A. For more information, see Create and manage a VBR.

• A CEN instance is created by using Account B and a transit router is created in the China (Hangzhou) region. For more information, see Create a transit router.

• The UID of Account B to which the CEN instance belongs and the UID of Account A to which the VBR belongs are obtained.

Procedure

1. Apply for the privilege to attach VBRs to CEN instances or VPCs that belong to a different account

2. Cross-account CEN authorization

3. Create a connection to connect the VBR and CEN instance

4. (Optional) Revoke the CEN authorization

Apply for the privilege to attach VBRs to CEN instances or VPCs that belong to a different account

1. Log on to the Quota Center console.
2. In the left-side navigation pane, choose Products > Privileges.
3. On the Products with Privileges page, click Express Connect in the Networking section.
4. On the Privileges page, find the privilege whose name is Allow VBR to load CEN or VPC across accounts and ID is vbr_cross_account_conn/allow, and click Apply in the Actions column.
5. In the Apply for Privileges dialog box, set the following parameters and click OK.

   Parameter	Description
   Quota ID	The ID of the privilege is automatically displayed.
   Description	The description of the privilege is automatically displayed.
   Quota Value	The value of the privilege. Valid values: Valid Invalid In this example, Valid is selected.
   Time	Specify the validity period of the privilege. Note This parameter is required only when the Quota Value parameter is set to Valid. Set the validity period to one day. The authorization takes effect immediately on the day when the application is approved.
   Reason	Enter the reason why you apply for the privilege. Example: User XX: User YY with Alibaba Cloud account ZZ wants to apply for the privilege to attach a VBR to a CEN instance or VPC that belongs to a different account. Note You need to provide the Proof of Affiliation to prove that both Alibaba Cloud accounts belong to the same enterprise or entity.
   Notify Result	Specify whether to notify the application result. Yes No

Cross-account CEN authorization

1. Use Account A to log on to the Express Connect console .

2. In the top navigation bar, select the region where the VBR is created. In this example, China (Hangzhou) is selected.

3. In the left-side navigation pane, click Virtual Border Routers (VBRs).

4. On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.

5. On the VBR details page, click the CEN Authorization tab.

6. Click Authorize CEN of Another Account to Load Instance. In the Authorize CEN of Another Account to Load Instance dialog box, set the following parameters and click OK.

   Parameter	Description
   Peer CEN Instance ID	Enter the ID of the CEN instance that belongs to Account B.
   Peer Account UID	Enter the UID of Account B.
   Payer	Select the account that pays the bills. Valid values: CEN Instance Owner: The account to which the transit router belongs pays the connection fee and data transfer fee. This is the default value. VBR Owner: The account to which the VBR belongs pays the connection fee and data transfer fee. Important Proceed with caution. Your services may be interrupted if you change the payment account. For more information, see Change the account that pays the bills.

   After the configuration is complete, the permissions are granted to the CEN instance. You can view the information about the authorization on the CEN Authorization tab.

   Note

   You can record the UID of Account B and the ID of the CEN instance, which are required in subsequent steps.

Create a connection to connect the VBR and CEN instance

You can connect the VBR to the transit router in the same region. Then, the transit router can exchange data between the VBR and CEN instance over private connections.

1. Log on to the CEN console with Account B.

2. On the Instances page, find the CEN instance that you want to manage and click its ID.

3. On the instance details page, click the Transit Router tab, find the transit router that you want to manage, and then click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, set the following parameters to create a VBR connection and click OK.

   Parameter	Description
   Network Type	Select the type of network instance that you want to attach to the CEN instance. In this example, Virtual Border Router (VBR) is selected.
   Region	Select the region where the network instance is deployed. In this example, China (Hangzhou) is selected.
   Transit Router	The system automatically displays the transit router in the selected region.
   Resource Owner ID	Select the Alibaba Cloud account to which the network instance belongs. In this example, Different Account is selected. After you select Different Account, enter the UID of Account A.
   Connection Name	Enter a name for the VBR connection.
   Networks	Select the ID of the VBR that you want to connect. In this example, the ID of the VBR that belongs to Account A is entered.
   Advanced Settings	By default, the following advanced features are enabled: Includes automatic route table association and route propagation configurations. In this example, the default settings are used.

   After the connection is created, you can view the information about the transit router and VBR connection on the Intra-region Connections tab. For more information, see View network instance connections.

(Optional) Revoke the CEN authorization

You can revoke the CEN authorization based on your business requirement. Revoking the CEN authorization does not disconnect the VBR that corresponds to the CEN instance.

1. Use Account A to log on to the Express Connect console .

2. In the top navigation bar, select the region where the VBR is created. In this example, China (Hangzhou) is selected.

3. In the left-side navigation pane, click Virtual Border Routers (VBRs).

4. On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.

5. On the VBR details page, click the CEN Authorization tab, find the CEN instance that you want to manage, and then click Delete in the Actions column.

6. In the Revoke Authorization message, confirm the UID and CEN instance ID and click OK.

References