Express Connect:FAQ about connections over Express Connect circuits

Can I access VPCs in different regions after connecting my data center through an Express Connect circuit?

Yes. After a physical connection is established, the data center can access VPCs in all Alibaba Cloud regions.

Does Alibaba Cloud provide cross-region direct connections (such as Shanghai to Beijing)?

You need to distinguish between different scenarios:

• Cross-region VPC communication in the cloud: Supported. For cross-region communication, we recommend that you use Cloud Enterprise Network (CEN), which routes traffic over the Alibaba Cloud backbone network. This provides lower latency and higher stability than the Internet.

• Access from a data center to resources in multiple cloud regions: Supported. You can use an Express Connect physical connection to connect to the nearest access point, and then use CEN to enable cross-region communication between resources.

• Point-to-point communication between two data centers: Supported. Each data center connects to its nearest access point over a physical connection, and they are connected through a VBR and CEN. The complete path is IDC-A → physical connection → Alibaba Cloud CEN backbone network → physical connection → IDC-B. In this scenario, traffic is transited over two physical connections. If you only need communication between data centers without involving cloud resources, you can also evaluate a carrier point-to-point leased line, which usually has lower cost and lower latency.

What types of physical connections does Alibaba Cloud support?

Alibaba Cloud devices support optical ports that use the Ethernet protocol. Optical ports provide 1 Gbps, 10 Gbps, 40 Gbps, and 100 Gbps specifications by default, and use single-mode optical modules with a data transmission distance of 10 kilometers.

What is the maximum bandwidth for an Express Connect circuit?

The maximum specification of a physical connection that you can directly apply for in the Alibaba Cloud Management Console is 10 Gbps. To apply for a physical connection with a specification greater than 10 Gbps, contact your business manager.

Do Express Connect circuits support dynamic routing protocols?

Yes. Express Connect circuits support Border Gateway Protocol (BGP).

Can I configure multiple Express Connect circuits for disaster recovery?

Yes. Express Connect Router (ECR) networking supports up to 32 Express Connect circuits, which enables equal-cost multi-path routing (ECMP).

How do I achieve high availability?

You can use redundant physical connections in load balancing mode or active/standby mode to achieve high availability of physical connections. For more information, see:

• Connect a data center to the cloud over active/standby circuits

• Connect a data center to the cloud with an ECR and load-balanced circuits

Can I connect to multiple VPCs over a single physical connection?

Yes. You can use Cloud Enterprise Network to enable private network communication between a data center and multiple VPCs.

Can multiple Alibaba Cloud accounts share one Express Connect circuit?

Yes. VPCs of different accounts can connect to the same transit router (TR) or Express Connect Router (ECR) through cross-account authorization, and then connect to a VBR through the TR or ECR, so that they share the physical connection corresponding to the VBR. By default, each account shares the bandwidth of this physical connection. To allocate bandwidth to different workloads, you can add QoS policies QoS policy to the physical port. Note that QoS is supported only for the outbound traffic of a dedicated physical connection. For inbound traffic, configure it on the data center side.

Can I extend a VLAN from my data center to a VPC?

No. Alibaba Cloud supports only Layer 3 interconnections with external networks.

If one Express Connect circuit connects to multiple VPCs, are the connections isolated?

You can isolate network data from each other by dividing VLANs on a physical connection. For more information, see Create and manage VBRs.

Do Express Connect circuits support network address translation (NAT)?

Physical connections do not support NAT configuration. If you must use NAT for special scenarios, configure NAT in your data center.

What is the relationship between zones and access points?

Both zones and access points are concepts under a region. That is, any access point within a region can use all zones in that region.

If an access point and a VPC are not in the same region, you can connect them through Cloud Enterprise Network.

How much does it cost to connect a data center to Alibaba Cloud through an Express Connect circuit?

The physical connection access service involves charges from Alibaba Cloud and non-Alibaba Cloud third parties. For more information, see Billing overview.

How do I connect a data center to Alibaba Cloud through an Express Connect circuit?

Read the documentation → Select an appropriate access point → Purchase a physical connection interface in the console → Apply for an LOA → Carrier performs the installation → Report completion and wait for Alibaba Cloud installation → Pay the resource occupation fee → Enable the physical connection → Configure a VBR → Join a Cloud Enterprise Network or create a peering connection → Configure routes → Perform a connectivity test between hosts on both ends (a successful ping usually indicates normal operation).

How do I plan the IP address for the physical connection?

The address planning for physical connection access is described as follows:

• The IP addresses on both sides of the physical connection cannot conflict, and they must be private IP addresses. If a public IP address exists on the user side, you need to configure it by using submit a ticket.

• The CIDR block of the data center cannot use 100.64.0.0/10 to avoid conflicts with cloud service addresses.

What does the VLAN ID on a VBR control?

• A VLAN ID of 0 indicates that the physical switch port corresponding to this VBR does not use VLAN mode but uses Layer 3 routing interface mode. In Layer 3 routing interface mode, each physical connection corresponds to one VBR. That is, the physical connection can connect only to VPCs under the current account.

• A VLAN ID from 1 to 2999 indicates that the physical switch port corresponding to this VBR uses a VLAN-based Layer 3 subinterface. In Layer 3 subinterface mode, each VLAN ID corresponds to one VBR. That is, the physical connection can connect to VPCs under multiple accounts.

For example, multiple departments or subsidiaries of a company each have an independent Alibaba Cloud account, and each account has a VPC. When the head office applies for a physical connection, it needs to plan a VLAN ID for each department or subsidiary. When creating a VBR, you use the VLAN ID to specify the subsidiary or department that needs to use the physical connection.

What are the Alibaba Cloud-side and data center-side IP addresses on a VBR?

The Alibaba Cloud-side IP is the routing gateway from the VPC to the data center, and the customer-side IP is the routing gateway from the data center to the VPC. You need to plan one IP address in the same CIDR block for each end of the physical connection, which is used for communication between the data center and the VPC.

How do I test whether the connection is properly established?

After the carrier completes the access installation in the Alibaba Cloud-side data center, you need to complete the following operations:

1. Log on to the Express Connect console.

2. In the top navigation bar, select a region and then click Physical Connection in the left-side navigation pane.

3. On the Physical Connections page, click Confirm Delivery.

   At this point, the physical connection status changes to Waiting for Pigtail Installation. After the Alibaba Cloud engineer completes the fiber jumper installation, the physical connection status changes to Pending For Payment.

   Note

   Fiber pigtail laying and Express Connect circuit port connection are completed within two business days for data centers in the Chinese mainland and within three business days for access points outside the Chinese mainland.

4. After you pay the resource occupation fee, the physical connection status changes to Enabled.

5. Create a VBR and configure routes to complete the physical connection access.

6. Run the ping command to test whether communication from the data center to the VPC in the cloud is normal.

How do I connect a data center to an internal OSS endpoint in a VPC?

The OSS internal domain name belongs to the 100.64.0.0/10 CIDR block, which is an internal reserved address range of Alibaba Cloud. Therefore, you cannot directly add a route pointing to 100.64.0.0/10 on the VBR. If you have such a requirement, split 100.64.0.0/10 into smaller subnets, for example 100.64.0.0/11 and 100.96.0.0/11, and then add them to the route table of the VBR and point them to the VPC.

After the physical connection is installed, the data center cannot access ECS instances in the cloud. How do I resolve this issue?

Troubleshoot the physical connection fault. For more information, see Troubleshooting.

What do I do if my Express Connect circuit goes down?

On the gateway device of the data center, test whether the customer-side IP of the physical connection can reach the Alibaba Cloud-side IP, that is, whether the directly connected IP of the physical connection can be pinged. If it is unreachable, you need to report the fault to the carrier. At the same time, you can submit a ticket report the fault to Alibaba Cloud, and Alibaba Cloud will check the physical connection access status.

The demarcation point between Alibaba Cloud and the user is the port of the Alibaba Cloud-side switch. If the access device works normally but the port is unreachable, it indicates a carrier line interruption, and you need to report the fault to the carrier.

What do I do if the bandwidth is not reaching the configured limit?

When the router interface specification is below 1 Gbps, you can use tools such as iPerf3 to test the bandwidth. If the bandwidth cannot exceed 10 Mbps, the port on one side of the physical connection may be running in half-duplex mode after negotiation. You can ask the carrier to change the port mode to auto-negotiation.

When the router interface specification exceeds 1 Gbps, because the load balancing method for each data flow differs, each data flow has a certain rate limit (130 Mbps or 250 Mbps).

What do I do if I get an error when adding or deleting routes for a VBR?

Because the hardware processing performance of the VBR is relatively slow, wait until the previous operation is complete before adding or deleting routes.

An error token error is reported when I add a route entry. How do I resolve this issue?

The error is caused by browser cookie timeout. Log out and log on again.

How do I check if Alibaba Cloud has completed the installation of an Express Connect circuit?

You can perform the following operations to check whether Alibaba Cloud has completed the fiber jumper installation:

1. Log on to Express Connect console and select the target region from the top menu bar.

2. Find the target physical port instance and view the physical connection status in the LOA Status column.

3. When LOA Status changes to Pending For Payment, it indicates that Alibaba Cloud has completed the fiber jumper installation.

The status of each physical connection process is described as follows: