Express Connect:Configure ECMP between an on-premises data center and Alibaba Cloud

Scenarios

The following example shows how to configure ECMP between an on-premises data center and Alibaba Cloud:

A company has an on-premises data center in Shanghai and creates a virtual private cloud (VPC) in the China (Shanghai) region. The private CIDR block of the on-premises data center is 172.16.0.0/12, and the CIDR block of the VPC is 192.168.0.0/16. To prevent bandwidth bottlenecks, the company applies for two Express Connect circuits from different connectivity providers to connect the on-premises data center to Alibaba Cloud.

The following table describes the configurations of the virtual border router (VBR) that is associated with the Express Connect circuits.

Background information

Enterprise Edition transit routers of Cloud Enterprise Network (CEN) can automatically learn and advertise routes. After you configure routes, transit routers automatically learn and advertise the routes. The following content describes how routes are learned.

• BGP routing information of the VBRs

  Destination CIDR block	Next hop
  VBR route 1
  172.16.0.0/12	10.4.4.2
  VBR route 2
  172.16.0.0/12	10.4.5.2

  The preceding table describes the routes and next hops that the VBR learns from the BGP peer. After you create a VBR connection on the transit router, the VBR can advertise the routes learned from the on-premises data center to the transit router.

• Global route configurations

  Destination CIDR block	Next hop
  VBR route 1
  172.16.0.0/12	10.4.4.2
  VBR route 2
  172.16.0.0/12	10.4.5.2
  Route table of the transit router
  172.16.0.0/12	VBR
  192.168.0.0/16	VPC

  • After you create a VPC connection and a VBR connection on the transit router, the VBR can advertise the routes learned from the on-premises data center to the transit router. After the routes are advertised to the transit router, network instances connected to the transit router, such as VPCs, can learn the routes.

  • The transit router also advertises its system routes to the BGP route table in the on-premises data center. Routes that point to the IP addresses of the two interfaces on the VBRs are displayed in the BGP route table in the on-premises data center. The interfaces are the ones that you set as the BGP peers of the on-premises data center.

Prerequisites

• By default, ECMP is disabled. To use this feature, contact your account manager.

• Your on-premises data center is connected to Alibaba Cloud through Express Connect circuits. The Express Connect circuits must meet the following requirements. For more information, see Create and manage a dedicated connection over an Express Connect circuit.

  • The Express Connect circuits are deployed on the same core switch.

  • The Express Connect circuits are enabled.

  • The Express Connect circuits use the same bandwidth.

• A VPC is created in the China (Shanghai) region and cloud resources such as Elastic Compute Service (ECS) instances that host your business systems are deployed in the VPC. For more information, see Create a VPC with an IPv4 CIDR block.

  Note

  Before you connect an Enterprise Edition transit router to a VPC, make sure that the VPC has at least one vSwitch in a zone that supports Enterprise Edition transit routers. The vSwitch must have at least one idle IP address. In this example, the transit router is created in the China (Shanghai) region. Shanghai Zone F and Shanghai Zone G support Enterprise Edition transit routers.

• You understand the security group rules of the Elastic Compute Service (ECS) instances in the virtual private cloud (VPC). Make sure that the rules allow the ECS instances to communicate with the data center. For more information, see View security group rules and Add a security group rule.

• A CEN instance is created. For more information, see Create a CEN instance.

• An Enterprise Edition transit router is created in the region where the VPC resides. For more information, see Create a transit router.

Step 1: Create a VBR for an Express Connect circuit

1. Log on to the Express Connect console.

2. In the top navigation bar, select a region.

3. On the Physical Connection page, click the ID of the Express Connect circuit for which you want to create a VBR. Make sure that the Express Connect circuit is enabled. In this example, pconn-1 is selected.

4. On the details page of the Express Connect circuit, click Create VBR.

5. In the Create VBR panel, set the following parameters and click OK.

   Parameter	Description
   Account	Select whether to create a VBR for the current or another Alibaba Cloud account. In this example, Current Account is selected.
   Name	Enter a name for the VBR.
   Physical Connection Interface	Select Dedicated Physical Connection, and then select the Express Connect circuit pconn-1. The Express Connect circuit that is associated with the VBR must be enabled and function as expected.
   VLAN ID	Enter the virtual local area network (VLAN) ID of the VBR. In this example, 0 is entered.
   Set VBR Bandwidth Value	Set the bandwidth value of the VBR. In this example, 200Mb is selected.
   IPv4 Address (Alibaba Cloud Gateway)	Specify an IPv4 address for the VBR to route network traffic between the VPC and the on-premises data center. In this example, 10.4.4.1 is entered.
   IPv4 Address (Data Center Gateway)	Specify an IPv4 address for the gateway device in the on-premises data center to route network traffic between the VPC and the on-premises data center. In this example, 10.4.4.2 is entered.
   Subnet Mask (IPv4)	Enter the subnet mask of the IPv4 addresses that you specified for the VBR and the gateway device in the on-premises data center. In this example, 255.255.255.252 is entered.

Step 2: Associate the VBR with another Express Connect circuit

1. Log on to the Express Connect console.

2. In the top navigation bar, select a region.

3. On the Physical Connection page, click the ID of the Express Connect circuit that is already associated with the VBR. In this example, pconn-1 is selected.

4. On the details page of the Express Connect circuit, click the ID of the VBR.

5. On the Physical Connection Interfaces tab, click Add Physical Connection Interface.

6. In the Add Physical Connection Interface panel, set the following parameters to add another Express Connect circuit and click OK.

   Parameter	Description
   Physical Connection Interface	Select an Express Connect circuit that is enabled and functions as expected. In this example, pconn-2 is selected.
   VLAN ID	Enter the VLAN ID of the VBR. In this example, 0 is entered.
   IPv4 Address (Alibaba Cloud Gateway)	Specify an IPv4 address for the VBR to route network traffic between the VPC and the on-premises data center. In this example, 10.4.5.1 is entered.
   IPv4 Address (Data Center Gateway)	Specify an IPv4 address for the gateway device in the on-premises data center to route network traffic between the VPC and the on-premises data center. In this example, 10.4.5.2 is entered.
   Subnet Mask (IPv4)	Enter the subnet mask of the IPv4 addresses that you specified for the VBR and the gateway device in the on-premises data center. In this example, 255.255.255.252 is entered.

Step 3: Configure BGP routing on the VBR

To configure BGP routing between the on-premises data center and the VBR, you must add the BGP peer that communicates with the VBR to a BGP group, and then advertise the BGP CIDR block to the VBR.

1. Log on to the Express Connect console.

2. In the top navigation bar, select a region and then click Virtual Border Routers (VBRs) in the left-side navigation pane.

3. On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click its ID.

4. Create a BGP group.

   1. Click the BGP Groups tab and click Create BGP Group.

   2. Set the following parameters of the BGP group and click OK.

      Parameter	Description
      Name	Enter a name for the BGP group.
      Peer ASN	Enter the autonomous system number (ASN) of the on-premises data center.
      BGP Key	Enter the key of the BGP group.
      Description	Enter a description for the BGP group.

5. Create a BGP peer.

   1. Click the BGP Peers tab and click Create BGP Peer.

   2. Set the following parameters of the BGP peer and click OK.

      Parameter	Description
      BGP Group	Select the BGP group that you created.
      BGP Peer IP Address	Enter the IP address of the BGP peer. In this example, 10.4.4.2 is entered. This is the IP address of the data center-side gateway.
      Enable BFD	In this example, Bidirectional Forwarding Detection (BFD) is disabled.

6. Repeat Step5 to create a BGP peer for pconn-2.

   In this example, the IP address of the BGP peer for pconn-2 is set to 10.4.5.2 and BFD is disabled.

Step 4: Connect the VBR and VPC to a transit router

Connect the transit router in the China (Shanghai) region to the VBR that is associated with the Express Connect circuits. Then, connect the transit router to the VPC that you want to connect to the on-premises data center. This way, the VPC and the on-premises data center can communicate with each other.

1. Log on to the CEN console.
2. On the Instances page, click the ID of the CEN instance that you want to manage.
3. On the Basic Settings > Transit Router tab, find the transit router that you want to manage and click Create Connection in the Actions column.
4. On the Connection with Peer Network Instance page, set the following parameters and click OK to create a VPC connection.
   Note When you perform this operation for the first time, the system automatically creates a service-linked role named AliyunServiceRoleForCEN. This role allows the transit router to create an ENI in a vSwitch of the VPC. For more information, see AliyunServiceRoleForCEN.

   Parameter	Description
   Network Type	Select the type of network instance that you want to attach to the CEN instance. In this example, VPC is selected.
   Region	Select the region where the network instance is deployed. In this example, China (Shanghai) is selected.
   Transit Router	The system automatically displays the transit router in the selected region.
   Resource Owner ID	Select the Alibaba Cloud account to which the network instance belongs. In this example, Your Account is selected.
   Billing Method	By default, transit routers use the Pay-As-You-Go billing method. For more information about the billing rules, see Billing rules.
   Attachment Name	Enter a name for the VPC connection. In this example, VPC-test is used.
   Networks	Select the VPC to be connected. In this example, the VPC that you created is selected.
   vSwitch	Select a vSwitch in a zone that supports transit routers. In this example, the vSwitch in the corresponding zone is selected.
   Advanced Settings	By default, the following advanced features are enabled: Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC. In this example, the default settings are used.

5. On the Connection with Peer Network Instance page, click Create More Connections.
6. On the Connection with Peer Network Instance page, set the following parameters and click OK to create a connection for VBR1.

   Parameter	Description
   Network Type	In this example, Virtual Border Router (VBR) is selected.
   Region	Select the region where the network instance is deployed. In this example, China (Shanghai) is selected.
   Transit Router	The system automatically displays the transit router in the current region.
   Resource Owner ID	Select the Alibaba Cloud account to which the network instance belongs. In this example, Your Account is selected.
   Attachment Name	Enter a name for the VBR connection. In this example, VBR-test is used.
   Networks	Select the ID of the VBR that you want to connect. In this example, VBR1 is selected.
   Advanced Settings	By default, the following advanced features are enabled: Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC. In this example, the default settings are used.

   After the connections are created, you can view the details about the connections on the Intra-region Connections tab. For more information, see View network instance connections.

Step 5: Configure routing in the on-premises data center

You must configure BGP routing in the on-premises data center. This way, BGP routes can be advertised to Alibaba Cloud. The CIDR block of the on-premises data center is 172.16.0.0/12. The following table describes the configurations of BGP routing on the two pieces of customer-premises equipment (CPE) in the on-premises data center. For more information about the configurations, contact the CPE vendor.

Step 6: Test the network connectivity

After you create connections, you must test the network connectivity.

1. Open the command-line interface (CLI) on a computer in the on-premises data center.

2. Run the ping command to verify the connectivity between the on-premises data center and an ECS instance in the VPC whose CIDR block is 192.168.0.0/16.

   If echo reply packets are returned, the connection is established.

3. To check whether active/active connections are established between the on-premises data center and Alibaba Cloud, run the tracert command to query the routes through which packets are sent.

   The tracert command may vary based on the vendor. For more information about the command, contact the CPE vendor.