Express Connect:Connect a data center with load-balanced Express Connect circuits

Scenario

The following example uses a load-balanced architecture.

An enterprise has a data center in Shanghai (CIDR block: 172.16.0.0/12) and a VPC in China (Shanghai) (CIDR block: 192.168.0.0/16). To avoid single points of failure, the enterprise leases two Express Connect circuits from different carriers. Both circuits forward traffic simultaneously.

VBR configuration for each circuit:

Prerequisites

• You have created a VPC in the China (Shanghai) region and deployed related services in the VPC by using cloud resources such as ECS (Elastic Compute Service). For more information, see Create a VPC with an IPv4 CIDR block.

  Note

  Before creating a VPC connection on an Enterprise Edition transit router, the VPC must have at least one vSwitch with an idle IP address in a transit-router-supported zone. In this example, the transit router supports Shanghai Availability Zone F and Shanghai Availability Zone G.

• You understand the security group rules of the ECS instances in the VPC. Make sure that the rules allow the ECS instances to communicate with the data center. For more information, see View security group rules and Add a security group rule.

• You have Create a CEN instance.

• You have created an Enterprise Edition transit router instance in the region where the VPC instance resides. For more information, see Create a transit router.

• This scenario requires two Express Connect circuits (two ports). Review billing before purchasing:

  • Billing overview

  • Port resource usage fee

  • Outbound data transfer fees

• You have created two Express Connect circuits. You can use dedicated or shared circuits.

Step 1: Create VBRs and configure routes

Create a VBR for each Express Connect circuit and add a route entry pointing to your data center.

1. Log on to the Express Connect console.

2. Create a VBR for Express Connect circuit 1.

   1. In the top navigation bar, select a region and then click Virtual Border Routers (VBRs) in the left-side navigation pane.

   2. On the Virtual Border Routers (VBRs) page, click Create VBR.

   3. In the Create VBR panel, set the following parameters and click OK.

      Only required parameters are listed. For all parameters, see Create and manage VBRs.

      Parameter	Description
      Account	VBR owner account type. In this example, Current Account is selected.
      Name	VBR name. In this example, enter VBR1.
      Physical Connection Interfaces	Select circuit 1.
      VLAN ID	VBR VLAN ID. In this example, enter 1.
      VBR Bandwidth	VBR bandwidth. In this example, set the bandwidth to 200Mb.
      IPv4 Address (Alibaba Cloud Gateway)	Gateway IP for VPC-to-data-center traffic. In this example, enter 10.0.0.1.
      IPv4 Address (Data Center Gateway)	Gateway IP for data-center-to-VPC traffic. In this example, enter 10.0.0.2.
      IPv4 Subnet Mask	Subnet mask for both gateway IPs. In this example, enter 255.255.255.252.

3. Add a route entry to VBR1 that points to the on-premises data center.

   1. In the top navigation bar, select a region and then click Virtual Border Routers (VBRs) in the left-side navigation pane.

   2. On the Virtual Border Routers (VBRs) page, click the ID of VBR1.

   3. On the VBR1 details page, click the Routes tab and then click Add Route.

   4. In the Add Route panel, set the following parameters and click OK.

      Parameter	Description
      Next Hop Type	Select Physical Connection Interface.
      Destination CIDR Block	Data center CIDR block. In this example, enter 172.16.0.0/12.
      Next Hop	The Express Connect circuit. In this example, select Express Connect circuit 1.
      Description	Description of the route entry.

4. Repeat the preceding steps to create VBR2 for Express Connect circuit 2 and add a route entry that points to your on-premises data center.

Step 2: Connect the transit router

Create VPC and VBR connections on the China (Shanghai) transit router to enable private communication between your data center and VPC.

Only required parameters are listed. For all parameters, see Network instance connections.

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, find the transit router instance in the target region and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, configure the following parameters to create a VPC connection, and then click OK.

   Note

   When you perform this operation for the first time, the system automatically creates a service-linked role named AliyunServiceRoleForCEN. This role allows the transit router to create an ENI in a vSwitch of the VPC. For more information, see AliyunServiceRoleForCEN.

   Parameter	Description
   Instance Type	The type of network instance. In this example, VPC is selected.
   Region	The region in which the VPC is deployed. In this example, China (Shanghai) is selected.
   TR	The system automatically displays the transit router in the selected region.
   Account	The Alibaba Cloud account to which the VPC belongs. In this example, Your Account is selected.
   Billing Method	The billing method of the transit router is Pay-As-You-Go by default. For more information, see Billing overview.
   Network Instance	The ID of the VPC. In this example, the VPC that you created is selected.
   vSwitch	Select at least two vSwitches in a zone supported by the transit router.
   Advanced Settings	The system selects three advanced features for you by default, namely Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Auto-add transit router routes to all VPC route tables. In this example, the default settings are used.

5. On the Connection with Peer Network Instance page, click Create More Connections.

6. On the Connection with Peer Network Instance page, set the following parameters to create a connection for VBR1, and then click OK.

   Parameter	Configuration
   Network Type	In this example, select Virtual Border Router (VBR).
   Region	Region of the network instance. In this example, China (Shanghai) is selected.
   Transit Router	Auto-populated based on the selected region.
   Account	Network instance owner account type. In this example, use the default value Your Account.
   Networks	VBR to connect. In this example, select the VBR1 instance.
   Advanced Settings	Three features enabled by default: Associate with Default Route Table of Transit Router, Propagate System Routes to Default Route Table of Transit Router, and Advertise routes to the VBR. In this example, the default settings are used.

7. Repeat Step 5 and Step 6 to create a connection for VBR2.

   After creating the connections, view details on the Intra-Region Connections tab. View network instance connections.

Step 3: Configure health checks

Alibaba Cloud pings a destination IP in your data center every 2 seconds by default. If eight consecutive pings on one circuit go unanswered, traffic reroutes to the other circuit.

1. Log on to the CEN console.

2. In the left-side navigation pane, click Health Check.

3. On the Health Check page, select the region where the VBR is deployed and click Add Health Check.

   In this example, China (Shanghai), the region of VBR1, is selected.

4. In the Add Health Check panel, set the following parameters and click OK.

   Parameter	Description
   CEN Instance	The CEN instance to which the VBR is attached.
   VBR	The VBR that you want to monitor. In this example, VBR1 is selected.
   Source IP	The source IP address. You can select one of the following methods to specify the source IP address: Automatic IP Address (recommended): The system automatically assigns an IP address within the 100.96.0.0/16 CIDR block to you. Note If you select this option and an ACL policy is configured on the peer , you must modify the ACL policy to allow this CIDR block. Otherwise, the health check fails.   Custom IP Address: The source IP address can be any unused IP address within the 10.0.0.0/8, 192.168.0.0/16, or 172.16.0.0/12 CIDR block. However, it cannot conflict with the addresses that need to communicate within the Cloud Enterprise Network, nor can it conflict with the IPv4 interconnection IP on the Alibaba Cloud side or IPv4 interconnection IP on the customer side address of the Virtual Border Router instance.
   Destination IP	The IP address of the VBR on the user side.
   Send Packet Every (Seconds)	The interval at which probe packets are sent for the health check. Unit: seconds. Default value: 2. Valid values: 2 to 3.
   Packets Detected	The number of probe packets that are sent for health checks. Unit: packet. Default value: 8. Valid values: 3 to 8.
   Route switching	Specifies whether to allow the health check feature to switch to the redundant route. The system selects Yes by default, which enables the route switching feature of the health check. When the health check detects a physical connection failure, if a redundant route exists in the Cloud Enterprise Network (CEN) instance, the health check immediately triggers route switching to use an available link. If you clear Yes, the route switching feature of the health check is not enabled, and the health check only performs the link probing function. If the health check detects a physical connection failure, route switching is not triggered. Warning Before you turn off Change Route, make sure that the system can switch to a redundant route by using other mechanisms. Otherwise, network connections are interrupted if the Express Connect circuit is down.

   Note

   The system sends probe packets at the specified interval. If consecutively dropped packets reach the configured threshold, the health check fails.

5. Repeat Step 3 and Step 4 to configure a health check for VBR2.

Step 4: Configure on-premises routes and health checks

Configure routes, health checks, and route failover in your data center.

1. Configure routes in the data center.

   Commands vary by vendor. The following example is for reference only.

   # Configure routes from the data center to the VPC on Alibaba Cloud.
   ip route 192.168.0.0 255.255.0.0 10.0.0.1
   ip route 192.168.0.0 255.255.0.0 10.0.0.5
   # Configure return routes for the health check probe packets.
   ip route <health_check_source_ip> 255.255.255.255 10.0.0.1
   ip route <health_check_source_ip> 255.255.255.255 10.0.0.5

2. Configure health checks in the data center.

   Use Bidirectional Forwarding Detection (BFD) or Network Quality Analyzer (NQA) to monitor connectivity from your data center to the VBRs. Consult your vendor for commands.

3. Configure route failover.

   Configure route failover based on your network environment. Consult your vendor for commands.

Step 5: Test the connectivity

Test connectivity over the Express Connect circuits.

1. From a client in your on-premises data center, open a command-line window.

2. Run the ping command to check connectivity between the on-premises data center and an ECS instance in the VPC (CIDR block: 192.168.0.0/16).

   Reply packets confirm successful connectivity.

3. Run a route tracing command to verify that both Express Connect circuits are used for load balancing.

   Note

   Before you begin, make sure that you have the required command installed. If you use a different operating system, consult your operating system's documentation.

   • On Windows, run the tracert command.

   • On Linux, run the traceroute command.

References

• Troubleshooting connectivity issues between an on-premises data center and an ECS instance.

• FAQ about installing an Express Connect circuit.

• Express Connect FAQ.