Express Connect:Connect a data center with redundant active/standby circuits

Scenario

An on-premises data center connects to Alibaba Cloud over redundant active/standby Express Connect circuits.

A certain enterprise has a Local IDC in Shanghai (private network segment: 172.16.0.0/12) and has created a VPC (network segment: 192.168.0.0/16) in the Alibaba Cloud China (Shanghai) Region. To resolve the single point of failure issue, the enterprise needs to apply for one physical connection from each of two ISPs, using one as the Primary line and the other as the Backup line to connect the Local IDC to Alibaba Cloud.

The following table lists the VBR configurations for the two Express Connect circuits.

Prerequisites

You have created two Express Connect circuits (either dedicated or shared).

Step 1: Create VBRs and configure routes

Create a VBR for each Express Connect circuit and add a route pointing to the on-premises data center.

1. Log on to the Express Connect console.

2. Create a VBR for Express Connect circuit 1.

   1. In the top menu bar, select the target region, and then in the left-side navigation pane, click Virtual Border Routers (VBRs).

   2. On the Virtual Border Routers (VBRs) page, click Create VBR.

   3. In the Create VBR panel, set the following parameters and click OK.

      Only required parameters are listed. For all parameters, see Create and manage VBRs.

      Parameter	Description
      Account	VBR owner account type. In this example, Current Account is selected.
      Name	VBR name. In this example, enter VBR1.
      Physical Connection Interfaces	Select circuit 1.
      VLAN ID	VBR VLAN ID. In this example, enter 1.
      VBR Bandwidth	VBR bandwidth. In this example, set the bandwidth to 200Mb.
      IPv4 Address (Alibaba Cloud Gateway)	Gateway IP for VPC-to-data-center traffic. In this example, enter 10.0.0.1.
      IPv4 Address (Data Center Gateway)	Gateway IP for data-center-to-VPC traffic. In this example, enter 10.0.0.2.
      IPv4 Subnet Mask	Subnet mask for both gateway IPs. In this example, enter 255.255.255.252.

3. Add a route entry on VBR1 that points to the on-premises data center.

   1. In the top menu bar, select the target region, and then in the left-side navigation pane, click Virtual Border Routers (VBRs).

   2. On the Virtual Border Routers (VBRs) page, click the ID of VBR1.

   3. On the VBR1 details page, click the Routes tab and then click Add Route.

   4. In the Add Route panel, set the following parameters and click OK.

      Parameter	Description
      Next Hop Type	Select Physical Connection Interface.
      Destination CIDR Block	Data center CIDR block. In this example, enter 172.16.0.0/12.
      Next Hop	The Express Connect circuit. In this example, select Express Connect circuit 1.
      Description	Description of the route entry.

4. Repeat the preceding steps to create VBR2 for Express Connect circuit 2 and add a route entry that points to your on-premises data center.

Step 2: Connect the VPC and VBRs

Create VPC and VBR connections on the transit router in the China (Shanghai) region to enable private communication between the on-premises data center and the VPC.

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, find the transit router instance in the target region and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, configure the following parameters to create a VPC connection, and then click OK.

   Note

   When you perform this operation for the first time, the system automatically creates a service-linked role named AliyunServiceRoleForCEN. This role allows the transit router to create an ENI in a vSwitch of the VPC. For more information, see AliyunServiceRoleForCEN.

   Parameter	Description
   Instance Type	The type of network instance. In this example, VPC is selected.
   Region	The region in which the VPC is deployed. In this example, China (Shanghai) is selected.
   TR	The system automatically displays the transit router in the selected region.
   Account	The Alibaba Cloud account to which the VPC belongs. In this example, Your Account is selected.
   Billing Method	The billing method of the transit router is Pay-As-You-Go by default. For more information, see Billing overview.
   Network Instance	The ID of the VPC. In this example, the VPC that you created is selected.
   vSwitch	Select at least two vSwitches in a zone supported by the transit router.
   Advanced Settings	The system selects three advanced features for you by default, namely Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Auto-add transit router routes to all VPC route tables. In this example, the default settings are used.

5. On the Connection with Peer Network Instance page, click {value, select, continue {Create More Connections} setTRRouter {Configure Route Table} gotoList {Return to the List} createCross {Create More Cross-region Connections} Other {{value}} }.

6. On the Connection with Peer Network Instance page, configure the following parameters to create the VBR1 connection, and then click OK.

   Parameter	Description
   Instance Type	In this example, VBR is selected.
   Region	The region in which the VBR is deployed. In this example, the China (Shanghai) region is selected.
   TR	The system automatically displays the transit router in the selected region.
   Account	The Alibaba Cloud account to which the VBR belongs. In this example, the default value Your Account is used.
   Network Instance	The ID of the VBR. In this example, VBR1 is selected.
   Advanced Settings	The system selects three advanced features for you by default, namely Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Propagate Routes to VBR. In this example, the default settings are used.

7. Repeat Step 5 and Step 6 to create a connection for VBR2.

   After the network connection is created, you can view the information about the VPC connection and the VBR connection on the Intra-Region Connections tab. For more information, see View network instance connections.

Step 3: Configure Alibaba Cloud health checks

By default, Alibaba Cloud sends a ping packet from each health check source IP address to the on-premises data center every 2 seconds. If eight consecutive pings on a circuit fail, traffic switches to the other circuit.

1. Log on to the CEN console.

2. In the left-side navigation pane, click Health Check.

3. On the Health Check page, select the region to which the VBR instance belongs, and then click Add Health Check.

   In this example, region China (Shanghai) to which the VBR1 instance belongs is selected.

4. On the Add Health Check panel, configure the following parameters, and then click OK.

   Parameter	Description
   CEN Instance	The CEN instance to which the VBR is attached.
   VBR	The VBR that you want to monitor. In this example, VBR1 is selected.
   Source IP	The source IP address. You can select one of the following methods to specify the source IP address: Automatic IP Address (recommended): The system automatically assigns an IP address within the 100.96.0.0/16 CIDR block to you. Note If you select this option and an ACL policy is configured on the peer , you must modify the ACL policy to allow this CIDR block. Otherwise, the health check fails.   Custom IP Address: The source IP address can be any unused IP address within the 10.0.0.0/8, 192.168.0.0/16, or 172.16.0.0/12 CIDR block. However, it cannot conflict with the addresses that need to communicate within the Cloud Enterprise Network, nor can it conflict with the IPv4 interconnection IP on the Alibaba Cloud side or IPv4 interconnection IP on the customer side address of the Virtual Border Router instance.
   Destination IP	The IP address of the VBR on the user side.
   Send Packet Every (Seconds)	The interval at which probe packets are sent for the health check. Unit: seconds. Default value: 2. Valid values: 2 to 3.
   Packets Detected	The number of probe packets that are sent for health checks. Unit: packet. Default value: 8. Valid values: 3 to 8.
   Route switching	Specifies whether to allow the health check feature to switch to the redundant route. The system selects Yes by default, which enables the route switching feature of the health check. When the health check detects a physical connection failure, if a redundant route exists in the Cloud Enterprise Network (CEN) instance, the health check immediately triggers route switching to use an available link. If you clear Yes, the route switching feature of the health check is not enabled, and the health check only performs the link probing function. If the health check detects a physical connection failure, route switching is not triggered. Warning Before you turn off Change Route, make sure that the system can switch to a redundant route by using other mechanisms. Otherwise, network connections are interrupted if the Express Connect circuit is down.

   Note

   The system sends probe packets at the specified intervals. If the number of consecutively dropped packets reaches the specified value, the health check fails.

5. Repeat Step 3 to Step 4 to configure health checks for VBR2.

Step 4: Specify the active and standby circuits

Configure a Cloud Enterprise Network (CEN) routing policy to designate the VBR1 circuit as active and the VBR2 circuit as standby.

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. Go to the Basic Information > Transit Router tab and click the ID of the transit router that you want to manage.

4. On the details page of the transit router, click the Route Table tab.

5. In the left-side navigation pane, click the ID of the route table.

6. On the route table details page, click the Route Maps tab.

7. On the Route Maps tab, click Add Route Map.

8. On the Add Route Map page, configure the routing policy and click OK.

   Parameter	Description
   Policy Priority	Routing policy priority. Valid values: 1 to 100. A smaller value indicates a higher priority. In this example, enter 20.
   Description	Enter a description for the routing policy.
   Associate with Route Table	Select the route table to associate with the routing policy. In this example, the default route table is selected.
   Direction	Select the routing policy direction. Ingress to Regional Gateway: Routes advertised to the transit router in the current region from local network instances or remote transit routers. Egress from Regional Gateway: Routes advertised from the transit router in the current region to local network instances or remote transit routers. In this example, Import to Regional Gateway is selected.
   Match Condition	Match conditions for the routing policy. In this example, select Source Instance IDs and set it to the ID of VBR1. This matches all routes that originate from the VBR1 network instance. Click Add Match Condition to add more conditions. Match conditions.
   Routing Policy Action	Set Routing Policy Action to Allow and set the route priority. To set the route priority, click Add Action Object, select Route Priority, and then set the priority for the permitted routes. A smaller value indicates a higher priority. In this example, set Route Priority to 10. Note In this article, VBR1 does not need to be configured with Associated policy priority.

9. Repeat the preceding steps to configure the circuit associated with VBR2 as the standby circuit.

   The following table lists the key parameters. For other parameters, use the same settings as VBR1.

   Parameter	Description
   Policy Priority	A smaller value indicates a higher priority. The value for VBR2 must be greater than VBR1. In this example, enter 30.
   Match Condition	In this example, select Source Instance IDs and set it to the ID of VBR2. This matches all routes that originate from the VBR2 network instance.
   Routing Policy Action	Set Routing Policy Action to Allow and set the route priority. A smaller value indicates a higher priority. The route priority value for VBR2 must be greater than that for VBR1. In this example, set the permitted Route Priority to 20. In this article, VBR2 does not need to be configured with Associated policy priority.

   After you add the routing policies, two routes to the on-premises data center (172.16.0.0/12) appear on the Routes tab, one marked as standby.

Step 5: Configure on-premises routes and health checks

Configure routes and health checks on-premises, and link them to enable automatic failover.

1. Configure routes in the on-premises data center.

   These are example commands. Actual commands vary by device vendor.

   ip route 192.168.0.0 255.255.0.0 10.0.0.1 preference 10
   ip route 192.168.0.0 255.255.0.0 10.0.0.5 preference 20

2. Configure health checks in the on-premises data center.

   Use Bidirectional Forwarding Detection (BFD) or Network Quality Analyzer (NQA) to check route reachability from the on-premises data center to the VBRs. BFD is recommended for millisecond-level detection. Consult your device vendor for configuration commands.

3. Configure health check and route linkage.

   This configuration is vendor-specific. Consult your device vendor's documentation.

Step 6: Test the connectivity

Test the connectivity of the redundant circuits and verify automatic failover.

1. Open the command-line interface on a PC in the on-premises data center.

2. Run the ping command to verify connectivity between the on-premises data center and an ECS instance in the VPC (192.168.0.0/16).

   If you receive reply packets, the connection is successful.

3. Disconnect the active circuit and run the ping command again to verify failover to the standby circuit.

   If you receive replies, failover to the standby circuit succeeded.

References

• Troubleshooting connectivity issues between an on-premises data center and an ECS instance.

• FAQ about installing an Express Connect circuit.

• Express connect.