Express Connect:Load-balance Express Connect circuits to the cloud using ECR

Step 1: Apply for physical ports

This step shows you how to apply for ports in high-reliability mode, which provides strong disaster recovery capabilities. After your application is approved, the system creates two physical port instances.

Step 2: Create VBRs

1. Log on to the Express Connect console and select the China (Beijing) region.

2. On the Physical Port page, click a physical port instance ID. On the details page, click Create VBR to create VBR1.

3. In the Create VBR panel, set Account Type to Current Account, configure the key parameters, then click OK.

   Key parameters: For Physical Connection Interface, select Leased Line and choose the corresponding physical connection interface instance. Set VLAN ID to 1308, VBR Bandwidth to 200 Mbps, Alibaba Cloud-side IPv4 to 10.10.1.3, On-premises-side IPv4 to 10.10.1.2, and IPv4 Subnet Mask to 255.255.255.0.

4. Repeat the preceding steps to create VBR2, and then click OK.

   Key parameters for VBR2: For Physical Connection Interface, select Leased Line. Set VLAN ID to 1309, VBR Bandwidth to 200 Mbps, Alibaba Cloud-side IPv4 to 10.10.2.3, On-premises-side IPv4 to 10.10.2.2, IPv4 Subnet Mask to 255.255.255.0, and set Enable IPv6 to Disabled.

Step 3: Create and associate an ECR

1. Create an Express Connect Router (ECR)

   1. In the left-side navigation pane, click Express Connect Router (ECR), and then click Create ECR.

   2. In the dialog box that appears, enter 64512 for ASN, keep the default values for the other parameters, select the checkbox to agree to the billing rules, then click OK.

2. Associate the ECR with the VBRs

   1. Click the ID of the ECR instance that you created. On the VBR tab, click Add VBR.

   2. In the dialog box that appears, configure the following parameters and click OK.

      • Resource Ownership: Select Same Account.

      • Region: China (Beijing).

      • Networks: Select the VBR1 instance.

   3. Repeat the preceding steps to associate the ECR with VBR2.

3. Associate the ECR with the TR

   1. Click the ID of the ECR instance, and then click the TR tab.

   2. Click Associate TR. In the dialog box that appears, configure the following parameters, keep the default values for the other parameters, then click OK.

      • CEN ID: Select the Cloud Enterprise Network (CEN) instance that you created.

      • Region: China (Beijing).

      • Transit Router: Select the Transit Router (TR) instance that you created.

Step 4: Configure BGP and enable BFD

Configure BGP peering between your on-premises gateway devices and the VBRs. A BGP session is established when the BGP peer status becomes Established, allowing route exchange to begin.

After peering is established, the data center can automatically learn routes from the cloud by using BGP. Advertise the CIDR block of the data center from your on-premises gateway devices so that the VBRs can learn the routes to the data center. This configuration enables servers in the data center to access cloud resources.

Step 5: Verify the setup

1. Test the network connectivity.

   Log on to the ECS instance in the VPC instance and run the ping <IP address of the client in the on-premises IDC> command to access the client in the on-premises IDC.

   A response similar to the following output indicates that the network connection between the data center and the VPC is established.

   [xxx                 2564ek5zZ ~]$ ping 192.168.3.20
   PING 192.168.3.20 (192.168.3.20) 56(84) bytes of data.
   64 bytes from 192.168.3.20: icmp_seq=1 ttl=60 time=1.38 ms
   64 bytes from 192.168.3.20: icmp_seq=2 ttl=60 time=1.17 ms
   64 bytes from 192.168.3.20: icmp_seq=3 ttl=60 time=1.16 ms
   64 bytes from 192.168.3.20: icmp_seq=4 ttl=60 time=1.15 ms
   64 bytes from 192.168.3.20: icmp_seq=5 ttl=60 time=1.16 ms
   64 bytes from 192.168.3.20: icmp_seq=6 ttl=60 time=1.16 ms
   64 bytes from 192.168.3.20: icmp_seq=7 ttl=60 time=1.11 ms
   ^C
   --- 192.168.3.20 ping statistics ---
   7 packets transmitted, 7 received, 0% packet loss, time 6006ms
   rtt min/avg/max/mdev = 1.113/1.179/1.379/0.086 ms

2. Run the traceroute command to check if the two Express Connect circuits have achieved load-balanced access. If traceroute is not installed, you can run a command such as sudo yum install traceroute for CentOS to install it.

   • From the VPC to the data center

     Log on to an ECS instance in the VPC and run the traceroute <IP address of the on-premises IDC client> command. The response indicates that traffic from the VPC to the IDC is load-balanced. The traceroute command verifies the routing path from the VPC to the IDC, and the third hop passes through the gateway nodes (10.10.1.5 and 10.10.2.5).

     [root@ixxxxxxxx ~]$ traceroute 192.168.3.20
     traceroute to 192.168.3.20 (192.168.3.20), 30 hops max, 60 byte packets
      1  100.64.2.1 (100.64.2.1)  2.490 ms 100.64.1.241 (100.64.1.241)  2.035 ms 100.64.2.1 (100.64.2.1)  1.433 ms
      2  100.64.1.241 (100.64.1.241)  3.738 ms  3.228 ms 100.64.2.1 (100.64.2.1)  2.828 ms
      3  10.10.1.5 (10.10.1.5)  1.434 ms 10.10.2.5 (10.10.2.5)  1.368 ms  1.253 ms
      4  192.168.3.20 (192.168.3.20)  1.250 ms  1.319 ms  1.341 ms  *

   • From the data center to the VPC

     Log on to the client in your local IDC and run the traceroute <IP address of the ECS instance in the VPC> command. The response indicates that load-balanced access is implemented for traffic from the IDC to the VPC. The command verifies the routing path from the IDC to the VPC, where the third hop passes through the key routing nodes 10.10.2.3 and 10.10.1.3.

     $ traceroute 10.1.2.61
     traceroute to 10.1.2.61 (10.1.2.61), 30 hops max, 60 byte packets
      1  100.64.0.81 (100.64.0.81)  1.233 ms  100.64.1.65 (100.64.1.65)  0.837 ms  1.930 ms
      2  100.64.0.81 (100.64.0.81)  1.431 ms  100.64.1.65 (100.64.1.65)  2.357 ms  1.927 ms
      3  10.10.2.3 (10.10.2.3)  0.686 ms  10.10.1.3 (10.10.1.3)  0.905 ms  0.793 ms
      4  10.1.2.61 (10.1.2.61)  1.289 ms  1.270 ms  1.281 ms

3. Simulate a VBR1 link failure. In this example, use the failure drill feature to simulate a VBR1 link failure and test failover to the healthy link.

4. Run the traceroute command again to verify that the traffic is switched to the VBR2 link.

   • From the VPC to the data center

     Log on to an ECS instance in the VPC and run the traceroute <IP address of the on-premises IDC client> command. The following response indicates that traffic from the VPC to the IDC has been switched to VBR2.

     The third hop, 10.10.2.5, is the egress gateway on the CPE2 path.

     [root@2564ek5zZ ~]$ traceroute 192.168.3.20
     traceroute to 192.168.3.20 (192.168.3.20), 30 hops max, 60 byte packets
      1  100.64.2.1 (100.64.2.1)  1.393 ms  2.030 ms  2.576 ms
      2  100.64.2.1 (100.64.2.1)  2.335 ms  1.750 ms  2.805 ms
      3  10.10.2.5 (10.10.2.5)  1.328 ms  1.218 ms  1.453 ms
      4  192.168.3.20 (192.168.3.20)  1.261 ms  1.282 ms  1.269 ms

   • From the data center to the VPC

     Log on to a client in the on-premises IDC and run the traceroute <IP address of an ECS instance in the VPC> command. The following response message indicates that traffic from the IDC to the VPC has been switched to VBR2.

     The third hop, 10.10.2.3, is the VBR2 routing node.

     [alf3tw6Z ~]$ traceroute 10.1.2.61
     traceroute to 10.1.2.61 (10.1.2.61), 30 hops max, 60 byte packets
      1  100.64.1.65 (100.64.1.65)  1.479 ms  1.018 ms  2.207 ms
      2  100.64.1.65 (100.64.1.65)  2.399 ms  1.914 ms  1.623 ms
      3  10.10.2.3 (10.10.2.3)  0.818 ms  1.075 ms  1.160 ms
      4  10.1.2.61 (10.1.2.61)  1.373 ms  1.363 ms  1.364 ms