Migrate a TR connection to an ECR connection

Scenario

This topic describes a scenario where a data center connects to cloud resources in VPCs through a Transit Router (TR), as shown in the following figure. After the migration, VPC1 and VPC2 will still communicate with each other through the TR, but will communicate with VBR1 and VBR2 through the ECR.

Migration workflow:

The following table describes the CIDR block allocation in this example. You can plan CIDR blocks based on your business requirements. Make sure that the CIDR blocks do not overlap.

Prerequisites

• You have created two VPCs in the China (Hangzhou) region and deployed services on cloud resources, such as Elastic Compute Service (ECS) instances, in the VPCs. For more information, see Create a VPC with an IPv4 CIDR block.

• You have created an ECR. For more information, see Create an Express Connect Router.

• You have created express connect circuits and VBR instances. You can apply for a dedicated port or use a shared connection from a partner. For more information, see Create a dedicated physical connection or Workflow of using a hosted connection and Create and manage a VBR.

• You have created an Enterprise Edition TR instance in the region where the VPC instances are located. You have also configured the TR to connect resources in the VPCs to your data center. For more information, see Create a transit router instance and Connect a data center to ECS instances by using an express connect circuit.

Step 1: Redirect traffic to the primary VBR (VBR1)

Use a routing policy in Cloud Enterprise Network (CEN) to redirect all traffic to VBR1, making it the primary path for all inbound and outbound traffic.

1. Log on to the Cloud Enterprise Network console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. Go to the Basic Information > Transit Router tab and click the ID of the transit router that you want to manage.

4. On the details page of the transit router, click the Route Table tab.

5. In the navigation pane on the left, click the ID of a route table.

6. On the details page of the route table, click the Routing Policy tab.

7. On the Routing Policy tab, click Add Route Map.

8. On the Add Route Map page, configure a routing policy to set VBR2 as the standby VBR and deny traffic via VBR2.

   This section describes only the key parameters. For more information, see Use routing policies.

   • Deny outbound traffic from VBR2

     Parameter	Description
     Policy Priority	A smaller value indicates a higher priority. The priority of the policy for VBR2 must be lower (a larger number) than the priority of the policy for VBR1. Enter 30.
     Policy Direction	Select RegionIn.
     Match Condition	Select Source Instance IDs, and set the value to the ID of the VBR2 instance. This matches all routes that originate from the VBR2 network instance.
     Policy Action	Set Policy Action to Deny.

   • Deny inbound traffic from VBR2

     Parameter	Description
     Policy Priority	Enter 30.
     Policy Direction	Select RegionOut.
     Match Condition	Select Source Instance IDs, and set the value to the ID of the VBR2 instance. This matches all routes that originate from the VBR2 network instance.
     Policy Action	Set Policy Action to Deny.

Step 2: Add route entries to the VPCs

Repeat this step to add specific route entries for both VPC1 and VPC2 to access the data center. Ensure that the static routes you configure are more specific than the BGP routes advertised by the data center through the ECR. 

1. Log on to the VPC console.

2. In the left-side navigation pane, click Route Tables.

3. In the top navigation bar, select the region to which the route table belongs.

4. On the Route Tables page, find the route table that you want to manage and click its ID.

5. On the route table details page, perform the following operations:

   1. Turn off the Propagate Routes switch. This stops the route table from receiving dynamically propagated routes.

   2. Select Route Entry List > Custom Route, and click Add Route.

      Parameter	Description
      Name	Enter a name for the custom route entry.
      Resource Group	Select the resource group to which the next hop belongs.
      Destination CIDR Block	Select the destination type and enter the destination CIDR block. In this example, select IPv4 CIDR and enter 10.10.10.0/24.
      Next Hop Type	Select the next hop type. In this example, select Transit Router.
      Transit Router	Select the target TR instance.
      Description	Enter a description for the custom route entry.

Step 3: Create and start a failure drill for express connect circuit 2

Create and start a failure drill for express connect circuit 2, which is associated with VBR2. This simulates a link failure for the express connect circuit and VBR2. For more information, see Create a failure drill and Start a failure drill.

Step 4: Delete the route propagation from VBR2 to the TR

Delete the route propagation from VBR2 to the TR.

1. On the Route Table Association tab of the target TR route table, find the target network instance connection, and click Delete in the Actions column.

2. In the Delete dialog box, confirm the information and click OK.

Step 5: Verify the removal of route propagation for VBR2

Verify that the route propagation from VBR2 is successfully deleted.

1. On the Route Table Association tab of the target TR route table, find the target network instance connection, and in the Actions column, click Delete.

2. In the Delete Route Association dialog box, confirm the information, and then click Confirm.

Step 6: Detach VBR2 from the TR

You must detach VBR2 from the TR instance before you can associate it with an ECR.

1. Log on to the Cloud Enterprise Network console.

2. On the CEN Instance page, find the target CEN instance and click its ID.

3. On the Basic Settings > Transit Router tab, find the target transit router instance, and then click the ID of the target instance.

4. On the Intra-Region Connections tab, find the connection for VBR2, and then click Disassociate in the Actions column.

5. In the dialog box that appears, click OK.

Step 7: Associate the VPCs with the ECR

Associate VPC1 and VPC2 with the ECR.

1. Log on to the Express Connect console.

2. In the top navigation bar, select the target region.

3. In the left-side navigation pane, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, click the ID of the target ECR instance.

1. On the VPC tab, click Associate VPC.

2. In the Associate VPC dialog box, configure the following parameters and click OK.

   Parameter	Description
   Region	The region where the target VPC is located.
   Resource Owner	Select the type of account that owns the VPC. Valid values: Your Account. Different Account.
   VpcId	Select the ID of the target VPC instance.
   Allowed Route Prefixes	Enter the prefixes of the routes that you want to advertise from the ECR to your data center.

Step 8: Associate VBR2 with the ECR

1. Log on to the Express Connect console.

2. In the top navigation bar, select the target region.

3. In the left-side navigation pane, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, click the ID of the target ECR instance.

4. On the VBR tab, click Add VBR.

5. In the Add VBR dialog box, configure the following parameters and click OK.

   Parameter	Description
   Resource Owner	Select the type of account that owns the VBR. Valid values: Your Account. Different Account.
   Region	Select the region where the VBR is located.
   Networks	Select the target VBR instance. In this example, select the VBR2 instance.

Step 9: End the failure drill for express connect circuit 2

You must end the failure drill for express connect circuit 2 to restore its status and the status of the VBR2 instance. For more information, see End a failure drill.

Step 10: Redirect traffic to VBR2

Refer to Step 1 and change the Action from Deny to Allow for the routing policies in both the RegionOut and RegionIn directions for VBR2.

Step 11: Delete static routes to the TR

If the CIDR blocks configured for your VPCs are more specific than the received BGP routes, delete the static routes in VPC1 and VPC2 that point to the TR. This ensures that all inbound and outbound traffic is forwarded through VBR2.

1. Log on to the VPC console.

2. In the left-side navigation pane, click Route Tables.

3. In the top navigation bar, select the region to which the route table belongs.

4. On the Route Tables page, find the route table that you want to manage and click its ID.

5. On the route table details page, select Route Entry List > Custom Route, find the route entry that you added in Step 7, click Delete in the Actions column, and in the dialog box that appears, click OK.

Step 12: Create and start a failure drill for express connect circuit 1

Create and start a failure drill for express connect circuit 1, which is associated with VBR1. This simulates a link failure for the express connect circuit and VBR1. For more information, see Create a failure drill and Start a failure drill.

Step 13: Delete the route propagation from VBR1 to the TR

Delete the route propagation from VBR1 to the TR.

1. On the Route Table Association tab of the target TR route table, find the target network instance connection, and click Delete in the Actions column.

2. In the Delete dialog box, confirm the information and click OK.

Step 14: Verify the removal of route propagation for VBR1

Verify that the route propagation from VBR1 is successfully deleted.

1. On the Route Table Association tab of the target TR route table, find the target network instance connection and click Delete in the Actions column.

2. In the Delete Route Association dialog box, confirm the information and click Confirm.

Step 15: Detach VBR1 from the TR

You must detach VBR1 from the TR instance before you can associate it with an ECR.

1. Log on to the Cloud Enterprise Network console.

2. On the CEN Instance page, find the target CEN instance and click its ID.

3. On the Basic Settings > Transit Router tab, find the target transit router instance, and then click the instance ID.

4. On the Intra-Region Connections tab, find the connection for VBR1, and then click Disassociate in the Actions column.

5. In the dialog box that appears, click OK.

Step 16: Associate VBR1 with the ECR

1. Log on to the Express Connect console.

2. In the top navigation bar, select the target region.

3. In the left-side navigation pane, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, click the ID of the target ECR instance.

4. On the VBR tab, click Add VBR.

5. In the Add VBR dialog box, configure the following parameters and click OK.

   Parameter	Description
   Resource Owner	Select the type of account that owns the VBR. Valid values: Your Account. Different Account.
   Region	Select the region where the VBR is located.
   Networks	Select the target VBR instance. In this example, select the VBR1 instance.

Step 17: End the failure drill for express connect circuit 1

You must end the failure drill for express connect circuit 1 to restore its status and the status of the VBR1 instance. For more information, see End a failure drill.

Step 18: Verify traffic monitoring

Verify that the migrated circuit is forwarding traffic by checking the monitoring data for VBR2. Once confirmed, the migration is complete. Inbound and outbound traffic is now load-balanced across both express connect circuits through the ECR.

1. Log on to the Express Connect console.

2. In the top navigation bar, select the target region. In the left-side navigation pane, click Virtual Border Routers (VBRs).

3. On the Virtual Border Routers (VBRs) page, find the target VBR and click the icon in the Monitor column to view traffic monitoring information.