Express Connect:Connect a local IDC to the cloud with active/standby circuits using ECR

Step 1: Apply for physical ports

Apply for ports in high-reliability mode, which provides strong disaster recovery capabilities. After your application is approved, the system creates two physical port instances.

Step 2: Create VBRs

1. Log on to the Express Connect console and select the China (Beijing) region.

2. On the Physical Port page, click a physical port instance ID. On the details page, click Create VBR to create VBR1.

3. In the Create VBR panel, set Account Type to Current Account, configure the key parameters, then click OK.

   Key parameters: For Physical Connection Interface, select Leased Line and choose the corresponding physical connection interface instance. Set VLAN ID to 1308, VBR Bandwidth to 200 Mbps, Alibaba Cloud-side IPv4 to 10.10.1.3, On-premises-side IPv4 to 10.10.1.2, and IPv4 Subnet Mask to 255.255.255.0.

4. Repeat the preceding steps to create VBR2, and then click OK.

   Key parameters for VBR2: For Physical Connection Interface, select Leased Line. Set VLAN ID to 1309, VBR Bandwidth to 200 Mbps, Alibaba Cloud-side IPv4 to 10.10.2.3, On-premises-side IPv4 to 10.10.2.2, IPv4 Subnet Mask to 255.255.255.0, and set Enable IPv6 to Disabled.

Step 3: Create and associate an ECR

1. Create an Express Connect Router (ECR)

   1. In the left-side navigation pane, click Express Connect Router (ECR), and then click Create ECR.

   2. In the dialog box that appears, enter 64512 for ASN, keep the default values for the other parameters, select the checkbox to agree to the billing rules, then click OK.

2. Associate the ECR with the VBRs

   1. Click the ID of the ECR instance that you created. On the VBR tab, click Add VBR.

   2. In the dialog box that appears, configure the following parameters and click OK.

      • Resource Ownership: Select Same Account.

      • Region: China (Beijing).

      • Networks: Select the VBR1 instance.

   3. Repeat the preceding steps to associate the ECR with VBR2.

3. Associate the ECR with the TR

   1. Click the ID of the ECR instance, and then click the TR tab.

   2. Click Associate TR. In the dialog box that appears, configure the following parameters, keep the default values for the other parameters, then click OK.

      • CEN ID: Select the Cloud Enterprise Network (CEN) instance that you created.

      • Region: China (Beijing).

      • Transit Router: Select the Transit Router (TR) instance that you created.

Step 4: Configure BGP and enable BFD

Configure BGP peers between your on-premises gateway devices and the VBRs. When the BGP peer status shows Established, the session can exchange routing information.

After the BGP peers are established, your data center automatically learns routes from the cloud. To allow the VBRs to learn the route to your data center, advertise its CIDR block from your on-premises gateway device.

Step 5: Verification

1. Test network connectivity.

   Log on to the ECS instance in the VPC instance, and run the ping <the IP address of the client in the on-premises IDC> command to access the client in the on-premises IDC.

   A response confirms that the data center and the VPC are connected.

   [root@China xxx 2564ek5zZ ~]$ ping 192.168.3.20
   PING 192.168.3.20 (192.168.3.20) 56(84) bytes of data.
   64 bytes from 192.168.3.20: icmp_seq=1 ttl=60 time=1.38 ms
   64 bytes from 192.168.3.20: icmp_seq=2 ttl=60 time=1.17 ms
   64 bytes from 192.168.3.20: icmp_seq=3 ttl=60 time=1.16 ms
   64 bytes from 192.168.3.20: icmp_seq=4 ttl=60 time=1.15 ms
   64 bytes from 192.168.3.20: icmp_seq=5 ttl=60 time=1.16 ms
   64 bytes from 192.168.3.20: icmp_seq=6 ttl=60 time=1.16 ms
   64 bytes from 192.168.3.20: icmp_seq=7 ttl=60 time=1.11 ms
   ^C
   --- 192.168.3.20 ping statistics ---
   7 packets transmitted, 7 received, 0% packet loss, time 6006ms
   rtt min/avg/max/mdev = 1.113/1.179/1.379/0.086 ms

2. Run the traceroute command to check if the two Express Connect circuits provide primary/standby circuit redundancy. If traceroute is not installed, for example, on a CentOS system, you can run sudo yum install traceroute to install it.

   • VPC-to-IDC direction

     Log on to an ECS instance in the VPC and run the traceroute <IP address of the on-premises IDC client> command. The following response message indicates that traffic from the VPC to the IDC is forwarded through the active circuit VBR1.

     $ traceroute 192.168.3.20
     traceroute to 192.168.3.20 (192.168.3.20), 30 hops max, 60 byte packets
      1  100.64.1.241 (100.64.1.241)  1.451 ms  2.301 ms  2.827 ms
      2  100.64.1.241 (100.64.1.241)  2.047 ms  2.559 ms  1.790 ms
      3  10.10.1.5 (10.10.1.5)  1.124 ms  1.208 ms  1.320 ms    # VBR1
      4  192.168.3.20 (192.168.3.20)  1.391 ms  1.283 ms  1.385 ms

   • IDC-to-VPC direction

     Log on to a client in the on-premises IDC and execute the traceroute <IP address of the ECS instance in the VPC> command. The following response indicates that traffic from the IDC to the VPC is forwarded through the active circuit VBR1.

     [xxx@alf3tw6Z ~]$ traceroute 10.1.2.61
     traceroute to 10.1.2.61 (10.1.2.61), 30 hops max, 60 byte packets
      1  100.64.0.81 (100.64.0.81)  0.890 ms  1.154 ms  1.360 ms
      2  100.64.0.81 (100.64.0.81)  1.618 ms  1.871 ms  2.099 ms
      3  10.10.1.3 (10.10.1.3)  0.854 ms  0.976 ms  0.686 ms
      4  10.1.2.61 (10.1.2.61)  1.360 ms  1.349 ms  1.338 ms

3. Simulate a failure on the VBR1 circuit. Use the failover test feature to simulate a disconnection of the active circuit (VBR1) and verify that traffic switches to the standby circuit.

4. Run the traceroute command again to test whether the traffic is switched to the VBR2 link.

   • VPC-to-IDC direction

     Log in to an ECS instance in the VPC and run the traceroute <IP address of the on-premises IDC client> command. The following response indicates that traffic from the VPC to the IDC has been switched to VBR2.

     Hop 3, 10.10.2.5, is VBR2.

     [root@lppy32564ek5zZ ~]$ traceroute 192.168.3.20
     traceroute to 192.168.3.20 (192.168.3.20), 30 hops max, 60 byte packets
      1  100.64.2.1 (100.64.2.1)  1.774 ms  2.834 ms  2.048 ms
      2  100.64.2.1 (100.64.2.1)  1.360 ms  2.279 ms  2.585 ms
      3  10.10.2.5 (10.10.2.5)  1.201 ms  1.455 ms  1.340 ms
      4  192.168.3.20 (192.168.3.20)  1.342 ms  1.358 ms  1.332 ms

   • IDC-to-VPC direction

     Log in to a client in the local IDC and run the traceroute <IP address of an ECS instance in the VPC> command. The following response indicates that traffic from the IDC to the VPC has been switched to VBR2.

     [xxx zazcq7ialf3tw6Z ~]$ traceroute 10.1.2.61
     traceroute to 10.1.2.61 (10.1.2.61), 30 hops max, 60 byte packets
     1  100.64.1.65 (100.64.1.65)  1.442 ms  1.360 ms  1.469 ms
     2  100.64.1.65 (100.64.1.65)  2.082 ms  2.069 ms  2.056 ms
     3  10.10.2.3 (10.10.2.3)  1.292 ms  1.281 ms  1.266 ms
     4  10.1.2.61 (10.1.2.61)  1.411 ms  1.995 ms  1.982 ms