This topic describes how to connect a data center to a virtual private cloud (VPC) by using an Express Connect circuit. This allows the servers in the data center to access the Elastic Compute Service (ECS) instances in the VPC.
Background information
To connect to the cloud services in the VPC from your data center, you must configure routes on both the virtual border router (VBR) and the gateway device in the data center. The destination CIDR blocks of the routes that you configure must fall within the network segment 100.64.0.0/10. Specify the VBR interface that points to the VPC as the next hop of the route on the VBR. In addition, specify the VBR interface that points to the data center as the next hop of the route on the gateway device.
The network segment 100.64.0.0/10 is reserved for VPCs, and is used by cloud services such as Alibaba Cloud Domain Name System (DNS), Object Storage Service (OSS), and Log Service.
Example
The following figure shows an example of the network configurations for connecting a VPC and a data center. The data center is located in the China (Hangzhou) region and the VPC is deployed in the China (Hangzhou) region. The private CIDR block of the VPC is 172.16.0.0/16. The private CIDR block of the data center is 172.17.1.0/24. You want to connect a server in the data center to an ECS instance in the VPC by using an Express Connect circuit. The IP address of the server is 172.17.1.2. The IP address of the ECS instance is 172.16.0.1.

Parameter | IP address/CIDR block |
---|---|
CIDR block of the VPC | 172.16.0.0/16 |
CIDR block of the vSwitch | 172.16.0.0/24 |
CIDR block of the ECS instances | 172.16.0.1/24 |
CIDR block of the data center | 172.17.1.0/24 |
Peer IP addresses |
|
CIDR block of the servers in the data center | 172.17.1.2/24 |
IP addresses used for health checks |
|
Step 1: Create a connection over an Express Connect circuit
You can create a dedicated connection over an Express Connect circuit by applying for a dedicated Express Connect circuit in the Express Connect console. You can also establish a hosted connection over a shared Express Connect circuit provided by an Express Connect partner. For more information, see Create a dedicated connection over an Express Connect circuit or Establish a hosted connection over an Express Connect circuit.
The following table describes the parameters that are set for the VBR associated with the Express Connect circuit in this example.
Parameter | Value |
---|---|
VLAN ID | 0 |
IPv4 Address of Gateway at Alibaba Cloud Side | 10.0.0.1 |
IPv4 Address of Gateway at Customer Side | 10.0.0.2 |
Subnet Mask (IPv4 Address) | 255.255.255.252 |
Step 2: Attach the VPC and the VBR to a CEN instance
After the data center is connected to the VPC, you must attach the VPC and the VBR to the same Cloud Enterprise Network (CEN) instance. The CEN instance automatically learns and distributes the routes of the attached network instances to enable private communication.
Step 3: Configure routes on the VBR
After you attach the VBR and the VPC to the CEN instance, you must create a route that points to the data center and a route that points to the Express Connect circuit on the VBR. The following procedure shows how to create a route that points to the Express Connect circuit on the VBR.
Step 4: Configure health checks
CEN provides the health check feature to monitor the status of connections to the data center.
Step 5: Configure routes on the gateway device of the data center
After you complete the previous steps, you must log on to the gateway device of the data center and configure routes that point to the VPC. You can create a static route or configure Border Gateway Protocol (BGP) routing to forward network traffic from the data center to the VBR.
Step 6: Verify the connectivity of the Express Connect circuit
To verify the connectivity of the Express Connect circuit, you can ping the IP address of the VBR.
- Open the command prompt on a server in the data center.
- Run the ping command to ping the IP address of the VBR: 10.0.0.1. If the ping succeeds, it indicates that the server in the data center is connected to Alibaba Cloud over the Express Connect circuit.
Step 7: Verify the connectivity to an ECS instance
You can ping the IP address of an ECS instance to verify the connectivity between Alibaba Cloud and the data center. IP addresses of ECS instances are dynamically allocated. You must ping the private IP address of an ECS instance. In this example, the private IP address of the ECS instance is 172.16.0.1.