Connect on-premises networks outside the Chinese mainland to Alibaba Cloud

Background information

In this example, a company in Singapore connects clients in its office to Alibaba Cloud through SAG, as shown in the following figure.

The following table lists the network resources used in this example.

Prerequisites

• A VPC is deployed in the Singapore (Singapore) region. For more information, see Create and manage a VPC.

• A CEN instance is created and associated with the VPC. For more information, see Create a VPC connection.

• An SAG device is prepared.

  You cannot purchase SAG devices in the SAG console in areas outside the Chinese mainland. To purchase SAG devices in areas outside the Chinese mainland, contact your account manager.

Procedure

Step 1: Purchase bandwidth for the SAG device

After you purchase an SAG device, purchase bandwidth for it in the SAG console. Alibaba Cloud then creates an SAG instance to facilitate device management.

1. Log on to the SAG console.

2. In the top navigation bar, select the region.

3. On the Smart Access Gateway page, choose Purchase SAG > Create SAG (CPE).

4. On the buy page, configure the parameters as described in the following table and click Buy Now.

   Parameter	Description
   Smart Access Gateway Device
   Region	Select the area where you want to use the SAG device. In this example, Singapore (Singapore) is selected. Note If the area that you want to select is not listed on the buy page, we recommend that you select the nearest area. For example, if you want to use SAG devices in Thailand which is not listed on the buy page, you can select China (Hong Kong).
   Instance Type	The model of the SAG device. In this example, select SAG-100WM.
   Have SAG Devices Already	In this example, Yes is selected and cannot be changed.
   Quantity	Skip this parameter. In this example, the default value is used.
   Smart Access Gateway Bandwidth
   Region	The region where the bandwidth for the SAG device will be used. This must be the same as the Region specified for the SAG device and cannot be changed.
   Instance Name	Specify a name for the SAG instance. In this example, test123 is used.
   Peak Bandwidth	Specify the maximum bandwidth that the SAG device can reach. Unit: Mbit/s. In this example, the default value is used.
   Subscription Period	Select a subscription duration. In this example, the default value is used.

5. On the Confirm Order page, verify the settings and click Confirm Purchase.

6. In the Receiving Address dialog box, enter the shipping information for the SAG device and click Buy Now.

   Note

   You must provide the address of the recipient before you can complete the payment. The console does not record this information.

7. On the Pay Now page, select a payment method and complete the payment.

Step 2: Configure the SAG device

Configure the SAG device and connect it to your on-premises network.

1. Connect the SAG device to your on-premises network.

   1. After you receive the SAG device, check whether you have received all the accessories in the purchase order.

   2. After you start the SAG device, connect the wide area network (WAN) port to the modem and connect the local area network (LAN) port to the client.

      In this example, the client in the Singapore (Singapore) region is directly connected to the SAG device. The default gateway configurations are used. For more information about how to change the WAN and LAN ports, see Configure SAG-100WM in the web console.

2. Log on to the SAG console.

3. In the top navigation bar, select the Singapore region. In the left-side navigation pane, click Smart Access Gateway.

4. Activate the SAG device.

   1. On the Smart Access Gateway page, find the target SAG instance. In the Operation column, choose > Activate.

   2. In the Activate dialog box, click OK.

5. Associate the SAG device with the SAG instance.

   Associating SAG devices with SAG instances facilitates device management and configuration.

   1. Go to the Device Settings page in one of the following ways:

      • On the Smart Access Gateway page, click the ID of the target SAG instance. On the instance details page, click the Device Settings tab.

      • On the Smart Access Gateway page, find the target SAG instance. In the Operation column, choose > Device Settings.

   2. On the Device Settings tab, enter the serial number of your SAG device and click Add Device.

6. Configure routes.

   1. On the Smart Access Gateway page, find the target SAG instance and click Network Configuration in the Operation column.

   2. On the Method to Synchronize with On-premises Routes tab, select Static Routing and click Add Static Route.

   3. Enter the private CIDR block of your on-premises store and click OK.

      In this example, 192.168.10.0/24 is used. Therefore, the IP addresses of clients are allocated from 192.168.10.0/24.

Step 3: Establish network communication

Create network connections to allow the clients in the office to communicate with the VPC.

1. Log on to the SAG console.

2. In the top navigation bar, select the Singapore region.

3. Associate the SAG instance with the CCN instance.

   Note

   If you have an existing CCN instance, proceed to Step 3.d.

   1. In the left-side navigation pane, click CCN.

   2. On the CCN page, click Create CCN Instance.

   3. On the Create CCN Instance page, enter a name for the CCN instance and click OK.

   4. In the left-side navigation pane, choose Smart Access Gateway > Instances.

   5. On the Smart Access Gateway page, find the target SAG instance and click Network Configuration in the Operation column.

   6. Click the Network Instance Details tab and then click Attach Network.

   7. Configure the network information and click OK.

      • Network Type: Select CCN.

      • Resource Group: In this example, select Default Resource Group.

      • Network Instance: Select the ID of the CCN instance that you created.

4. Attach the CCN instance to a CEN instance.

   1. In the left-side navigation pane, click CCN.

   2. Find the target CCN instance and click Bind CEN Instance in the Operation column.

   3. On the Bind CEN Instance page, select the CEN instance that you want to attach and click OK.

      After the CCN instance is attached to the CEN instance, SAG devices associated with the CCN instance can communicate with VPCs attached to the CEN.

5. Configure a security group.

   1. Log on to the ECS console.

   2. In the top navigation bar, select the target resource group and the Singapore region. In the left-side navigation pane, click Instance.

   3. Find the target ECS instance and choose More > Network & Security Group > Configure Security Group in the Operation column.

   4. Find the target security group and click Configure Rules in the Operation column.

      Note

      If you do not create a security group when you create an ECS instance, a default security group is created. If you want to add an ECS instance to a custom security group, you can create a custom security group. For more information, see Create a security group.

   5. Create a security group rule that allows access from the on-premises network of the office to the VPC. For more information, see Add a security group rule.

      Set Authorization Object to the CIDR block of the private network. In this example, 192.168.10.0/24 is used.

Step 4: Test network connectivity

Run the ping command to test network connectivity between the office and the ECS instance. An echo reply packet confirms that the on-premises network is connected to Alibaba Cloud.

<The IP address of the ECS instance in the VPC>