Express Connect:Access an ECS instance from an on-premises data center via an express connect circuit

Scenario

In this example, an express connect circuit connects an on-premises data center (CIDR block: 172.17.1.0/24) to a VPC (CIDR block: 172.16.0.0/16) in the China (Shanghai) region. The on-premises server (172.17.1.2) communicates with an ECS instance (172.16.0.1) in the VPC.

Prerequisites

• You have created a VPC in the China (Shanghai) region on Alibaba Cloud, and you have deployed your business by using cloud resources such as Elastic Compute Service (ECS) in the VPC. For more information, see Create a VPC with an IPv4 CIDR block.

  Note

  Before you create a VPC connection for an Enterprise Edition transit router, make sure that the VPC has at least one vSwitch in a zone supported by the transit router, and that the vSwitch has at least one idle IP address. In this example, the transit router is created in the China (Shanghai) region and supports Shanghai Zone F and Shanghai Zone G.

• You understand the security group rules of the ECS instances in the VPC. Make sure that the rules allow the ECS instances to communicate with the data center. For more information, see View security group rules and Add a security group rule.

• You have created a Cloud Enterprise Network (CEN) instance. For more information, see Create a CEN instance.

• You have created an Enterprise Edition transit router in the region where the VPC instance resides. For more information, see Create a transit router.

Step 1: Create an express connect circuit

Create a dedicated express connect circuit or request a shared one from a partner in the Express Connect console. For more information, see Apply for Classic Mode or Shared circuit access process.

The VBR connected to the express connect circuit uses the following configuration:

Step 2: Create a VBR

1. Log on to the Express Connect console.

2. In the top navigation bar, select a region.

3. On the Physical connections page, click the instance ID of the physical connection interface that is in the Enabled state and for which you want to create a VBR.

4. On the details page of the express connect circuit, click Create VBR.

5. In the Create VBR panel, set the following parameters and click OK.

   Parameter	Description
   Account	The account to create the VBR. In this example, Current Account is selected.
   Name	Enter a name for the VBR.
   Physical Connection Interfaces	Select Dedicated physical connection. Then, select the Express Connect circuit interface that is installed and enabled.
   VLAN ID	Enter the VLAN ID of the VBR. In this example, enter 1.
   VBR Bandwidth	Specify the bandwidth of the VBR. In this example, set it to 200Mb.
   Alibaba Cloud-side peer IPv4 address	The IPv4 address of the gateway used to route traffic from the VPC to the on-premises data center. In this example, enter 10.0.0.1.
   On-premises side peer IPv4 address	The IPv4 address of the gateway used to route traffic from the on-premises data center to the VPC. In this example, enter 10.0.0.2.
   IPv4 subnet mask	The subnet mask for the peer IPv4 addresses on both the Alibaba Cloud side and the on-premises data center side. In this example, enter 255.255.255.252.

Step 3: Connect the VPC and the VBR

Create a VBR connection and a VPC connection on the transit router in the China (Shanghai) region to enable private communication between the on-premises data center and the VPC.

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, find the transit router instance in the target region and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, configure the following parameters to create a VPC connection, and then click OK.

   Note

   When you perform this operation for the first time, the system automatically creates a service-linked role named AliyunServiceRoleForCEN. This role allows the transit router to create an ENI in a vSwitch of the VPC. For more information, see AliyunServiceRoleForCEN.

   Parameter	Description
   Instance Type	The type of network instance. In this example, VPC is selected.
   Region	The region in which the VPC is deployed. In this example, China (Shanghai) is selected.
   TR	The system automatically displays the transit router in the selected region.
   Account	The Alibaba Cloud account to which the VPC belongs. In this example, Your Account is selected.
   Billing Method	The billing method of the transit router is Pay-As-You-Go by default. For more information, see Billing overview.
   Network Instance	The ID of the VPC. In this example, the VPC that you created is selected.
   vSwitch	Select at least two vSwitches in a zone supported by the transit router.
   Advanced Settings	The system selects three advanced features for you by default, namely Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Auto-add transit router routes to all VPC route tables. In this example, the default settings are used.

5. On the Connection with Peer Network Instance page, click {value, select, continue {Create More Connections} setTRRouter {Configure Route Table} gotoList {Return to the List} createCross {Create More Cross-region Connections} Other {{value}} }.

6. On the Connection with Peer Network Instance page, configure the following parameters to create the VBR1 connection, and then click OK.

   Parameter	Description
   Instance Type	In this example, VBR is selected.
   Region	The region in which the VBR is deployed. In this example, the China (Shanghai) region is selected.
   TR	The system automatically displays the transit router in the selected region.
   Account	The Alibaba Cloud account to which the VBR belongs. In this example, the default value Your Account is used.
   Network Instance	The ID of the VBR. In this example, VBR1 is selected.
   Advanced Settings	The system selects three advanced features for you by default, namely Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Propagate Routes to VBR. In this example, the default settings are used.

   After the network connection is created, you can view the information about the VPC connection and the VBR connection on the Intra-Region Connections tab. For more information, see View network instance connections.

Step 4: Configure VBR routes

Add a route to the VBR that directs traffic destined for your on-premises data center, with the express connect circuit as the next hop.

1. Log on to the Express Connect console.

2. In the top navigation bar, select a region and then click Virtual Border Routers (VBRs) in the left-side navigation pane.

3. On the Virtual border routers (VBRs) page, click the ID of the target VBR instance.

4. On the details page of the VBR instance, click the Routes tab and then click Add Route.

5. In the Add Route panel, set the following parameters and click OK.

   Parameter	Description
   Next Hop Type	In this example, select Physical Connection Interfaces.
   Destination CIDR block	Enter the CIDR block of the on-premises data center. In this example, enter 172.17.1.0/24.
   Next hop	Select the Express Connect circuit interface. In this example, select the created express connect circuit.
   Description	Enter a description for the route entry.

   Note

   By default, ECS instances on Alibaba Cloud cannot ping the VBR IP address. To enable this, add a route where the next hop is the express connect circuit interface and the destination CIDR block is the VBR peer IP address range (10.0.0.0/30 in this example).

Step 5: Configure a health check

Use the CEN health check feature to monitor the network status of the express connect circuit.

1. Log on to the CEN console.

2. In the left-side navigation pane, click Health Check.

3. On the Health Check page, select the region where the VBR is deployed. In this example, China (Shanghai) is selected. Then, click Add Health Check.

4. In the Add Health Check dialog box, set the following parameters and click OK.

   Parameter	Description
   CEN Instance	The CEN instance to which the VBR is attached.
   VBR	The VBR that you want to monitor. In this example, VBR1 is selected.
   Source IP	The source IP address. You can select one of the following methods to specify the source IP address: Automatic IP Address (recommended): The system automatically assigns an IP address within the 100.96.0.0/16 CIDR block to you. Note If you select this option and an ACL policy is configured on the peer , you must modify the ACL policy to allow this CIDR block. Otherwise, the health check fails.   Custom IP Address: The source IP address can be any unused IP address within the 10.0.0.0/8, 192.168.0.0/16, or 172.16.0.0/12 CIDR block. However, it cannot conflict with the addresses that need to communicate within the Cloud Enterprise Network, nor can it conflict with the IPv4 interconnection IP on the Alibaba Cloud side or IPv4 interconnection IP on the customer side address of the Virtual Border Router instance.
   Destination IP	The IP address of the VBR on the user side.
   Send Packet Every (Seconds)	The interval at which probe packets are sent for the health check. Unit: seconds. Default value: 2. Valid values: 2 to 3.
   Packets Detected	The number of probe packets that are sent for health checks. Unit: packet. Default value: 8. Valid values: 3 to 8.
   Route switching	Specifies whether to allow the health check feature to switch to the redundant route. The system selects Yes by default, which enables the route switching feature of the health check. When the health check detects a physical connection failure, if a redundant route exists in the Cloud Enterprise Network (CEN) instance, the health check immediately triggers route switching to use an available link. If you clear Yes, the route switching feature of the health check is not enabled, and the health check only performs the link probing function. If the health check detects a physical connection failure, route switching is not triggered. Warning Before you turn off Change Route, make sure that the system can switch to a redundant route by using other mechanisms. Otherwise, network connections are interrupted if the Express Connect circuit is down.

   Note

   The health check feature sends probe packets at the specified interval. If all probe packets in a health check cycle are lost, the connection is considered unhealthy.

Step 6: Configure routes in the on-premises IDC

After you configure routes on Alibaba Cloud, configure a route on your on-premises gateway device that points to the VPC. You can use a static route or Border Gateway Protocol (BGP) to forward traffic from the data center to the VBR.

1. Configure a route on your on-premises gateway device that directs traffic to the VPC. You can configure a static route or a dynamic BGP route.

   • The following command is an example of how to configure a static route.

     Note

     This command is an example. Commands vary by device vendor and model.

     ip route 172.16.0.0 255.255.0.0 10.0.0.1

   • Configure BGP. For more information, see Configure and manage BGP.

     Advertise the CIDR block of the VPC that needs to communicate with the on-premises data center. In this example, the CIDR block is 172.16.0.0/16.

2. From your local gateway device, ping the VBR in the cloud

   Run the ping command: ping 10.0.0.1. If you receive a reply, the connection from the on-premises gateway to the VBR is established.

3. Run the following command on the server in your on-premises data center to add a default route that points to the on-premises gateway.

   route add default gw 172.17.1.1

Step 7: Test express connect circuit connectivity

Ping the VBR IP address from your on-premises server to verify express connect circuit connectivity.

1. Open a command-line window on your on-premises server.

2. Run the ping command to ping the VBR on the cloud at 10.0.0.1.

   If you receive a reply, the connection from your on-premises server to the VBR is established.

Step 8: Test ECS connectivity

Ping the private IP address of the ECS instance to verify end-to-end connectivity. Use the actual IP address of your instance because it can be dynamically assigned. In this example, the address is 172.16.0.1.

1. Open a command-line window on a server in your on-premises data center, run the ping command, and ping the private IP address of the Alibaba Cloud ECS instance.

   ping 172.16.0.1

2. Log on to the ECS instance and open a command-line window.

3. Run the ping command and ping the IP address of the on-premises server. If the ping is successful, it indicates that the on-premises server is successfully connected to the ECS instance over Express Connect.

   ping 172.17.1.2