ApsaraDB RDS:Change the network type

Network types

• classic network: In a classic network, instances are not isolated at the network level. You can only block unauthorized access by configuring whitelists on each instance. The classic network is being phased out. For more information, see Classic network retirement plan.

• VPC: A Virtual Private Cloud (VPC) provides an isolated network environment. A VPC offers higher security, and we recommend the VPC network type.

  You can customize route tables, IP address ranges, and gateways in a VPC. You can also connect your on-premises data center to an Alibaba Cloud VPC by using an Express Connect circuit or a VPN Gateway to create a hybrid cloud and smoothly migrate applications to the cloud.

Limitations

• SQL Server 2008 R2 instances do not support switching from the classic network to a VPC. You have the following options:

  • Option 1: Upgrade the major engine version of the instance. During the upgrade process, you can change the network type to VPC.

  • Option 2: Create a new ApsaraDB RDS instance in the target VPC and then migrate your data to the new instance.

  • Option 3: If your applications no longer require a connection through the classic network, you can manually delete the classic network endpoint on the instance's Database Connection page. After deletion, the instance can be accessed only through its public endpoint. For more information, see Enable a public endpoint.

    Important

    • After a classic network endpoint is deleted, it cannot be recovered. Proceed with caution.

    • We recommend that you keep the classic network endpoint and first test connectivity using the public endpoint. After you confirm that everything works, delete the classic network endpoint.

• Temporary instances support only the classic network and cannot be switched to a VPC. For more information about how to log on to a temporary instance, see Log on to a temporary instance.

View the current network type

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Connection to view the current network type.

Switch from a classic network to a VPC

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Database Connection. Then, click Switch to VPC.

   Important

   If the Switch to VPC button is not displayed, your instance is either not in the classic network or is running SQL Server 2008 R2. Instances that run SQL Server 2008 R2 do not support switching from the classic network to a VPC. For solutions, see the Limitations section.

3. In the dialog box that appears, select a VPC and a vSwitch, and specify whether to retain the classic network endpoint.

   • Select a VPC. We recommend that you select the VPC where your ECS instance resides. Otherwise, your ECS instance and ApsaraDB RDS instance cannot communicate over the internal network unless you connect the two VPCs by using CEN or a VPN Gateway.

   • Select a vSwitch. If no vSwitch is available in the selected VPC, create one in the same availability zone as your instance. For more information, see Create a vSwitch.

   • Choose whether to select the Reserve original classic endpoint checkbox. The following table describes the options.

     Actions	Description
     Clear the checkbox	The classic network endpoint is not retained. The original classic network endpoint is converted to a VPC endpoint. The switch causes a transient connection interruption for about 30 seconds, immediately disconnecting any ECS instances in the classic network from the ApsaraDB RDS instance.
     Select the checkbox	You can retain the classic network address and generate a new VPC address to use the hybrid access mode. In hybrid access mode, an RDS instance can be simultaneously accessed by ECS instances in both the classic network and the VPC over the internal network. If you retain the classic network endpoint, no transient connection interruption occurs during the switch. The internal network connection from ECS instances in the classic network remains active until the classic network endpoint expires. Note Before the classic network endpoint expires, you must update your application configurations on the ECS instances in the VPC to use the new VPC endpoint. This ensures a smooth migration to the VPC. You will receive daily SMS notifications to the mobile number associated with your Alibaba Cloud account for seven days before the endpoint expires. For more information, see Hybrid access solution (retain both classic network and VPC endpoints).

4. Add the private IP address of the ECS instance in the VPC to the ApsaraDB RDS instance's whitelist. If no VPC-specific whitelist group exists, create one.

   Note

   You can view the private IP address of the ECS instance on its Instance Details page.

   In the left-side navigation pane of the RDS instance, click Data Security. On the Whitelist Settings tab, ensure that the whitelist mode is High-security Whitelist Mode, and then add the private IP address of the ECS instance to the default-vpc group.

5. Configure the application on your ECS instance to use the VPC endpoint of the ApsaraDB RDS instance.

   • If you chose to retain the classic network endpoint, update your application on the ECS instance to use the VPC endpoint of the ApsaraDB RDS instance before the classic network endpoint expires.

   • If you did not retain the classic network endpoint, any ECS instances in the classic network will be immediately disconnected from the ApsaraDB RDS instance after the switch. You must update the application on your ECS instance in the VPC to use the new VPC endpoint.

   Note

   To connect an ECS instance in a classic network to an ApsaraDB RDS instance in a VPC over an internal network, you can use ClassicLink or migrate the ECS instance to the VPC.

Related operations

You can also change the network type of an instance from classic network to VPC by using the API. For more information, see Switch an instance network type from classic network to VPC.