Express Connect:Configure and manage health checks

Step 1: Configure the CEN health check

1. 登录云企业网管理控制台。

2. In the left-side navigation pane, click Health Checks.

3. On the Health Checks page, select the region in which a VBR is deployed. Then, click Set Health Check.

4. In the Add Health Check panel, configure the following parameters and click OK.

   Parameter	Description
   Instances	The CEN instance to which the VBR is attached.
   Virtual Border Router (VBR)	The VBR that you want to monitor.
   Source IP	The source IP address. You can select one of the following methods to specify the source IP address: Automatic IP Address: The system automatically assigns an IP address from the 100.96.0.0/16 CIDR block. We recommend that you select this option. Note If you select this option and an ACL policy is configured on the peer , you must modify the ACL policy to allow this CIDR block. Otherwise, the health check fails.   Custom IP Address: You need to specify an idle IP address within the 10.0.0.0/8, 192.168.0.0/16, or 172.16.0.0/12 CIDR block. The specified IP address cannot be the IP address with which you want to communicate, the IP address of the VBR on the Alibaba Cloud side, or the IP address of the VBR on the user side.
   Destination IP	The IP address of the VBR on the user side.
   Probe Interval (Seconds)	The interval at which probe packets are sent for the health check. Unit: seconds.
   Probe Packets	The number of probe packets that are sent for health checks. Unit: packet.
   Change Route	Specifies whether to allow the health check feature to switch to the redundant route. By default, Change Route is turned on. This indicates that the health check feature can switch to the redundant route. If a redundant route is configured on the CEN instance, the health check feature immediately switches to the redundant route if an error is detected on the Express Connect circuit. If you turn off Change Route, the health check feature does not switch to the redundant route. Only probing is performed. The health check feature does not switch to the redundant route even if an error is detected on the Express Connect circuit. Warning Before you turn off Change Route, make sure that the system can switch to a redundant route by using other mechanisms. Otherwise, network connections are interrupted if the Express Connect circuit is down.

Step 2: Configure data center health check

You must add the required health check configurations in your data center to ensure the feature works correctly.

1. Add a return route for probe packets in your data center.

   Important

   • If your VBR instance uses Border Gateway Protocol (BGP), Alibaba Cloud automatically advertises the health check source IP address (with a 32-bit mask) to your data center after you configure the health check. You do not need to configure a return route for the probe packets in your data center.

   • If your VBR instance uses static routing, you must manually configure a route entry in your data center. The destination of the route entry must be the health check source IP address with a 32-bit subnet mask, and the next hop must point to the Alibaba Cloud side of the corresponding Express Connect circuit. Otherwise, the health check ping packets cannot return along the original path, and Alibaba Cloud incorrectly determines that the Express Connect circuit is unavailable.

   Configuration commands vary by device vendor. The following example is for reference only. For the specific commands, consult your device vendor.

   # Configure the return route for probe packets.
   ip route <Health Check Source IP 1> 255.255.255.255 <Alibaba Cloud-side IPv4 interconnect IP 1>
   ip route <Health Check Source IP 2> 255.255.255.255 <Alibaba Cloud-side IPv4 interconnect IP 2>

   This command adds a route entry on your data center's border router. The destination is the health check source IP address, with the next hop set to the Alibaba Cloud-side IPv4 interconnect IP of the VBR. This ensures probe packets are returned to the VPC over the correct circuit.

2. Implement a health check in your data center.

   You can use Bidirectional Forwarding Detection (BFD) or Network Quality Analyzer (NQA) to check connectivity from your data center to the VBR. For specific commands, consult your device vendor.

   Important

   • When you configure an NQA probe, do not use the Alibaba Cloud-side IPv4 interconnect IP of the VBR as the probe destination. Otherwise, incorrect failovers may occur when the circuit is healthy, or failovers may not occur when the circuit is down. You must use the health check source IP address from Step 1 as the destination for probing the cloud network from your data center. This IP address supports only ICMP probes.

   • If you do not have a redundant Express Connect circuit, we recommend configuring a static summary route to the cloud that is independent of NQA results. This ensures that traffic continues to be forwarded even if an NQA probe fails while the circuit itself remains active.

3. Associate health checks with routing.

   If your data center is connected to Alibaba Cloud through multiple Express Connect circuits, you must configure health check-based route association in your data center. This ensures that your data center can also detect the connectivity of the Express Connect circuits and automatically switch routes based on the health check results. For specific commands, consult your device vendor.

Clear a health check

You can clear the health check configuration from a VBR.

1. Log on to the Express Connect console.

2. In the top navigation bar, select the region. In the left-side navigation pane, choose VPC Peering Connections > VBR-to-VPC.

3. On the VBR-to-VPC page, find the target peering connection. In the Actions column, choose > Health Check.

4. In the Health Check panel, click Clear. In the Clear Health Check Settings dialog box, click OK.

Configure CloudMonitor alerts for health checks

1. Log on to the CloudMonitor console.

2. In the left-side navigation pane, choose Alerts > Alert Rules.

3. On the Alert Rules page, click Create Alert Rule.

4. In the Create Alert Rule panel, set Product to Express Connect - Peering Connections, Express Connect - VBR, or Express Connect - Physical Connections, configure the alert rule, and then click OK.

   This section describes only the parameters that are most relevant to this topic. For information about other parameters, see Create an alert rule.

   Click + Add Rule > Simple Metric. In the Add Rule Description panel, configure the following parameters and click OK.

   Parameter	Description
   Rule Name	Enter a name for the alert rule.
   Metric Type	The metric type for the alert rule. This topic uses Simple Metric as an example. For information about multi-metric and dynamic threshold configurations, see Create an alert template.
   Monitoring indicators	Select the metric to monitor. The available health-check-related metrics are as follows: Express Connect - Peering Connections Healthy Check Loss Rate: The packet loss rate of health checks initiated from the VPC. RouterInterfaceResponseTime: The latency of health checks initiated from the VPC. Unit: ms. Express Connect - VBR VbrHealthyCheckLatency: The latency of VBR health checks. Unit: μs. VbrHealthyCheckLossRate: The packet loss rate of VBR health checks. Express Connect - Physical Connections PhysicalConnectionStatus: The connection status of the Express Connect circuit.
   Threshold and Alert Level	Specify the conditions that trigger the alert, the threshold value, and the alert's severity level.
   Chart Preview	A preview of the monitoring chart for the selected metric.