Documentation
Home Page Smart Access Gateway Use Cases Cross-region office local networking with SAG-1000

Cross-region office local networking with SAG-1000

Updated at:
Copy as MD
Product

In this tutorial, you deploy Smart Access Gateway (SAG) SAG-1000 devices at a headquarters and a branch office to establish cross-region network connectivity. The solution uses standalone bypass deployment with static routing. You complete the end-to-end process from device purchase to connectivity verification without modifying your existing network architecture.

Solution architecture

The implementation process consists of the following milestones:

  1. Purchase an SAG device for use in the China (Mainland) region.

  2. Activate and connect the SAG device.

  3. Configure the SAG device (WAN port, route synchronization, and static routes).

  4. Configure the Layer 3 switch and egress router.

  5. Configure cloud network connections (CCN and, optionally, CEN).

  6. Configure the branch office.

  7. Verify connectivity.

The following table lists the example network segment plan used in this tutorial. If you plan your own network segments, make sure that interconnected segments do not conflict.

Site

Node / Interface

IP address / CIDR

Gateway

Headquarters

Service network

172.16.0.0/12

—

Headquarters

SAG WAN (Port 5)

192.168.100.1/30

192.168.100.2

Headquarters

Layer 3 switch, G11 port

192.168.100.2/30

—

Headquarters

Egress router, G1 port

192.168.80.1/30

—

Headquarters

Layer 3 switch, G2 port

192.168.80.2/30

—

Branch office

Service network

10.0.0.0/16

—

Step 1: Purchase a Smart Access Gateway device

After you purchase an SAG device in the SAG console, Alibaba Cloud ships the device to you and creates an SAG instance for managing the device.

Note

If you want to use SAG in a region outside mainland China, contact your account manager for purchase details. For more information, see Purchase SAG devices for regions outside mainland China.

  1. Log on to the Smart Access Gateway console.

  2. On the Smart Access Gateway page, click Purchase SAG.

  3. Select Create SAG (CPE).

  4. On the Smart Access Gateway page, configure the SAG device based on the following information, and then click Buy Now.

    • Region: The region where the SAG device is used. In this example, select Mainland China.

    • Instance Type: The SAG device model. In this example, select SAG-1000.

    • Existing SAG Hardware: Whether you already have an SAG hardware device. In this example, select No.

    • Version: The device edition of the SAG. In this example, use the default Standard Edition.

    • Quantity: The number of SAG devices to purchase. In this example, select 1.

    • Region: The bandwidth region where the SAG device is used. This region is consistent with the usage region and cannot be modified.

    • Instance Name: The name of the SAG instance.

    • Peak Bandwidth: The peak bandwidth of the communication network. In this example, select 50 Mbps.

    • Subscription Period: The subscription duration.

  5. Confirm the order information, select the service agreement, and then click Confirm Purchase.

  6. In the Receiving Address dialog box, enter the shipping address for the gateway device, and then click Buy Now.

  7. On the Pay page, select a payment method, and then complete the payment.

  8. Verify that the order was placed successfully on the SAG instances page. The SAG device is shipped within two business days after the order is placed. To check the logistics status:

    1. On the Smart Access Gateway page, find the target SAG instance.

    2. In the Operation column, choose ellipsis-v > View Shipping Update.

    3. View the logistics information in the Order Updates panel.

    After the order is placed, the target SAG instance status changes to Pending Delivery.

Step 2: Activate and connect the Smart Access Gateway device

After you receive the SAG device, verify that all device accessories are included. For more information about device accessories, see SAG-1000 device accessories.

  1. Log on to the Smart Access Gateway console.

  2. In the top navigation bar, select the target region.

  3. On the Smart Access Gateway page, find the target instance. Bind the device to the SAG instance. For more information, see Bind a device to an SAG instance.

  4. After binding, return to the Smart Access Gateway page. In the Operation column of the target instance, click More > Activate.

  5. In the Activate dialog box, click OK.

  6. After activating the device, connect the SAG device to the local office network as shown in the topology. Connect the WAN port of the SAG device to the G11 port of the Layer 3 switch by using a network cable.

    This example uses the WAN port (Port 5). If your Port 5 is not a WAN port, you can modify the port role. For more information, see Modify port roles.

Note

Only SAG-1000 devices with version 2.0 support the port role assignment feature. Before assigning port roles, make sure the device is powered on with a normal 4G signal and is connected to Alibaba Cloud.

Step 3: Configure the Smart Access Gateway device

After connecting the device, configure the port and route settings in the SAG console. Before you proceed, make sure the device is powered on with a normal 4G signal and is connected to Alibaba Cloud. The following instructions use the headquarters configuration as an example. The branch office configuration follows the same process with different IP addresses.

Configure the WAN port

  1. On the SAG page, click the target instance ID.

  2. On the SAG instance details page, click the Device Settings tab.

  3. In the left-side navigation pane of the tab, click Manage WAN Ports.

  4. In the WAN (Port 5) section, click Edit.

  5. On the WAN (Port 5) Configuration page, configure the port based on the following information, and then click OK.

    Parameter

    Description

    Connection Type

    Select Static IP.

    Priority

    Use the default value 1.

    IP Address

    The IP address of the WAN port. In this example, enter 192.168.100.1.

    Mask

    The subnet mask of the WAN port IP address. In this example, enter 255.255.255.252.

    Gateway

    The gateway IP address. In this example, enter 192.168.100.2. After you configure the gateway, the SAG device automatically adds a default route.

Configure offline route synchronization

Configure offline route synchronization to advertise the local office service network segments to the cloud. This prepares the network for connectivity with other branches.

  1. On the SAG instance details page, click the Network Configuration tab.

  2. In the left-side navigation pane of the tab, click Method to Synchronize with On-premises Routes.

  3. Select Static Routing, click Add Static Route, enter the network segment that the local office needs to interconnect with other branches, and then click OK.

Configure static routes

Configure local network segment routes on the SAG to enable connectivity between the SAG device and local network segments.

  1. On the Smart Access Gateway page, click the target instance ID.

  2. On the SAG instance details page, click the Device Settings tab.

  3. On the Device Settings page, click the Manage Routes tab.

  4. On the Manage Routes page, click Add Static Route.

  5. On the Add Static Route page, add a static route to the local office based on the following information, keep other default settings, and then click OK.

    Parameter

    Description

    Destination CIDR Block

    The destination network segment. In this example, enter 172.16.0.0/12.

    Next Hop

    The next hop IP address. In this example, enter the peer IP address of the WAN port: 192.168.100.2.

    Port

    The outbound port to the destination network segment. In this example, select the WAN port configured in the port configuration.

Step 4: Configure the switch and egress router

Add route configurations to the Layer 3 switch and egress router that connect to the SAG device. This ensures that the SAG device can reach the local service network and the internet. Before you proceed, make sure a Layer 3 switch and an egress router are deployed in the local network with working internet connectivity.

Because configuration commands vary by vendor, refer to your device vendor documentation for exact CLI syntax. The following instructions use the headquarters configuration as an example. The branch office configuration follows the same process with different IP addresses.

Configure Layer 3 switch routes

Configure the Layer 3 switch to route traffic between the SAG device and the local service network. Based on the network plan in this tutorial, configure the following:

  • Set the G11 port IP address to 192.168.100.2/30 (connecting to the SAG WAN port).

  • Set the G2 port IP address to 192.168.80.2/30 (connecting to the egress router).

  • Add a static route that directs traffic for the SAG service network through the SAG WAN port IP address (192.168.100.1).

Configure egress router routes

Configure the egress router to forward traffic between the Layer 3 switch and the internet. Based on the network plan in this tutorial, configure the following:

  • Set the G1 port IP address to 192.168.80.1/30 (connecting to the Layer 3 switch G2 port).

  • Configure routing to enable internet access for the SAG device through the egress router.

Step 5: Configure cloud network connections

After the device configuration is complete, configure cloud network connections to enable connectivity between branch offices. The following instructions use the headquarters configuration as an example.

Create a Cloud Connect Network (CCN)

  1. Log on to the Smart Access Gateway console.

  2. In the top navigation bar, select the Mainland China region.

    Note

    The CCN region must be the same as the region where the SAG device is used.

  3. In the left-side navigation pane, click CCN.

  4. On the CCN page, click Create CCN Instance.

  5. On the Create CCN Instance page, configure the CCN name, and then click OK.

    After the CCN instance is created, it appears in the CCN instance list.

Bind the Cloud Connect Network

  1. In the left-side navigation pane, click Smart Access Gateway.

  2. On the Smart Access Gateway page, click Network Configuration in the Operation column of the target instance.

  3. In the left-side navigation pane of the tab, click Network Instance Details.

  4. Under the Network Instance Details tab, click Network Instance Details, select to bind a Cloud Connect Network, select the CCN instance you created, and then click OK.

Bind a Cloud Enterprise Network (CEN)

This step is required when branch offices are in different SAG regions — for example, when connecting offices in mainland China with offices outside mainland China. If all branch offices are within the same SAG region and use the same CCN, you can skip this step.

Before you proceed, make sure you have created a CEN instance and bound a VPC network instance to the CEN. After binding, SAG devices in the CCN can communicate with SAG devices in other CCNs that are associated with the same CEN instance.

  1. In the left-side navigation pane, click CCN.

  2. Find the target CCN instance and click Bind CEN Instance in the Operation column.

  3. On the Bind CEN Instance page, click Existing CEN, select the CEN instance to bind, and then click OK.

Step 6: Configure the branch office

Repeat Step 1 through Step 5 to configure the branch office. Replace the headquarters-specific values with the values from your branch office network plan.

Update the Layer 3 switch and egress router configurations at the branch site to match the branch office network plan.

Step 7: Verify connectivity

After you complete all configurations at both the headquarters and branch offices, verify the network connectivity between the two sites.

Previous：Use CasesNext：SAG inline deployment