All Products
Search

This Product

    Platform For AI:Best practice for CEN cross-VPC access to a dedicated gateway

    Document Center

    Platform For AI:Best practice for CEN cross-VPC access to a dedicated gateway

    Last Updated:Jul 15, 2026

    To meet your requirements for security isolation and access control, the PAI-EAS dedicated gateway supports flexible access methods. You can access it from the public internet or privately from a Virtual Private Cloud (VPC) in the same or a different region. This topic focuses on the dedicated gateway, using a cross-region VPC access scenario to demonstrate how to use Cloud Enterprise Network (CEN) for access.

    Overview

    To access a dedicated gateway across VPCs, follow these four steps:

    1. Create a dedicated gateway and associate a VPC: Configure private network access for the gateway.

    2. Associate another VPC with the dedicated gateway: Add a VPC from a different region to the dedicated gateway and authorize DNS resolution.

    3. Verify connectivity: Confirm that the remote VPC can access the dedicated gateway through its endpoint.

    4. Create a service and associate the gateway: Deploy an inference service and bind it to the dedicated gateway to enable access from the remote VPC.

    image

    Prerequisites

    Before you begin, ensure you have the following resources:

    • You have created two VPCs (VPC1 and VPC2) in different regions, such as China (Beijing) and China (Hangzhou), each with a vSwitch. For more information, see VPCs and vSwitches.

    • You have connected the two VPCs by using CEN, VPC peering, or another method. For more information, see VPC connections.

    Step 1: Create a gateway and associate a VPC

    1. Create a dedicated gateway.

      1. Log on to the PAI console, select the China (Beijing) region, and then go to the Elastic Algorithm Service (EAS) page.

        1. In the top navigation bar, select a region, for example, China (Beijing).

        2. In the left navigation pane, choose Model Deployment > Elastic Algorithm Service (EAS).

        3. In the Select Workspace drop-down list, select your target workspace.

        4. Click Enter EAS.

      2. Go to the Inference Gateway tab and create a dedicated gateway.

    2. Add a VPC to the dedicated gateway.

      Click the name of the dedicated gateway. On the details page, go to the VPC tab and configure private access.

      In Step 3, select the VPC (ID) and vSwitch that you created in the China (Beijing) region.

      Note

      If you receive the following error message when you add the VPC, you must select a vSwitch in a supported zone.

      Vswitch vsw-2zeqwh8hv0gb96zcd**** in zone cn-beijing-g is not supported, supported zones: [cn-beijing-i cn-beijing-l cn-beijing-k]

      When the Status changes to Running, the VPC is successfully added.

    Step 2: Associate another VPC to the gateway

    On the dedicated gateway's details page, go to the VPC tab and click associate a VPC. In the configuration wizard, select the VPC that you created in the China (Hangzhou) region. This process authorizes the required DNS resolution.

    1. On the Gateway Access Control page, click the VPC tab, then click Associate VPC to the right of the target VPC record.

    2. In the Associate VPC dialog box, expand the target region in the Unassociated VPCs list on the left and select the VPCs to associate.

    3. Click > to move the selected VPCs to the Associated VPCs panel on the right.

    4. Click OK.

    Step 3: Verify connectivity

    1. On the details page of the dedicated gateway, go to the VPC tab and find the Endpoint.

      Copy the domain name, which is in the format gw-xxx-1-vpc.cn-beijing.pai-eas.aliyuncs.com.

    2. From a client in the VPC that you associated in Step 2, run a command to access the endpoint.

      A successful response indicates that you can access the dedicated gateway from the remote VPC.

      [root@iZbp10n5xxx...xxxuivuZ ~]# ping gw-tw1muxxx...xxx-vpc.cn-beijing.pai-eas.aliyuncs.com
PING ep-2zeia86xxx...xxx12e.epsrv-2zee3cuxxx...xxxsm.cn-beijing.privatelink.aliyuncs.com (192.168.0.177) 56(84) bytes of data.
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=1 ttl=100 time=33.7 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=2 ttl=100 time=32.7 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=3 ttl=100 time=32.8 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=4 ttl=100 time=32.7 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=5 ttl=100 time=32.8 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=6 ttl=100 time=32.6 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=7 ttl=100 time=32.6 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=8 ttl=100 time=32.6 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=9 ttl=100 time=32.6 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=10 ttl=100 time=32.8 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=11 ttl=100 time=32.6 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=12 ttl=100 time=32.6 ms

    Step 4: Create a service and associate the gateway

    Associate the gateway at deployment

    On the Elastic Algorithm Service (EAS) page, go to the Inference Service tab to deploy a custom model service. In the Features section, select the dedicated gateway that you created. For information about other parameters, see Custom deployment.

    In the Service Features section, enable the Dedicated Gateway toggle, then select the target gateway instance from the drop-down list on the right.

    Verify network connectivity

    1. Find the service endpoint.

      1. In the service list, click the name of your target service to go to its details page.

      2. Click View Invocation Information. In the Invocation Information dialog box that appears, click the Shared Gateway tab and copy the VPC Endpoint for later network connectivity verification.

    2. Verify that the EAS service can be accessed from the remote VPC through the dedicated gateway.

      From a client in the remote VPC, access the service endpoint. Remove the http:// prefix and the trailing / from the endpoint URL. A successful response confirms that the remote VPC can access the EAS service through the dedicated gateway.

      [root@iZbp13orbxxx         yZ ~]# ping tesxxx                cn-beijing.pai-eas.aliyuncs.com
PING ep-2zeiaxxx      2e.epsrv-2zee3cuso20c5jp1vcsm.cn-beijing.privatelink.aliyuncs.com (192.168.0.177) 56(84) bytes of data.
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=1 ttl=100 time=28.4 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=2 ttl=100 time=27.9 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=3 ttl=100 time=27.9 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=4 ttl=100 time=27.9 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=5 ttl=100 time=27.9 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=6 ttl=100 time=27.8 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=7 ttl=100 time=27.8 ms
64 bytes from 192.168.0.177 (192.168.0.177): icmp_seq=8 ttl=100 time=27.8 ms
^C
--- ep-2zeia86939xxx       xxx, beijing.privatelink.aliyuncs.com ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7011ms
rtt min/avg/max/mdev = 27.765/27.912/28.405/0.227 ms

    Related documents

    For more information about the billing and usage of the dedicated gateway, see dedicated gateway.