Documentation
Home Page Smart Access Gateway Use Cases Connect a one-arm SAG device with static routes

Connect a one-arm SAG device with static routes

Updated at:
Copy as MD
Product

This tutorial shows you how to use a Smart Access Gateway (SAG) device in one-arm mode to connect an on-premises site to Alibaba Cloud.

Prerequisites

  • You have created a Virtual Private Cloud (VPC). For more information, see Create and manage a VPC.

  • You have created a Cloud Enterprise Network (CEN) instance and attached the VPC to the CEN instance. For more information, see Create a CEN instance.

Background

In this example, an enterprise uses an SAG-1000 hardware device in one-arm mode to connect its on-premises site in the Chinese mainland to services deployed in a VPC in the China (Beijing) region. This setup allows resources to communicate between the sites without changing the enterprise's existing network architecture.

单机单WAN口架构图

Network planning

The following table provides example values for network planning. If you plan your own CIDR blocks, ensure that the CIDR blocks of interconnecting networks do not overlap.

Network node

Network plan

On-premises site

Service CIDR block: 172.16.0.0/12

SAG WAN port (Port 5): 192.168.100.1/30, gateway: 192.168.100.2

Layer 3 switch port G11: 192.168.100.2/30

  • Egress router port G1: 192.168.80.1/30

  • Layer 3 switch port G2: 192.168.80.2/30

Alibaba Cloud VPC in China (Beijing)

10.0.0.0/16

Procedure

单机单WAN口配置流程

Step 1: Purchase an SAG device

After you purchase an SAG device on the SAG console, Alibaba Cloud ships the device to you and creates an SAG instance for device management.

Note

To use an SAG device in a region outside the Chinese mainland, you must purchase the hardware from a third party. For more information, see Purchase SAG devices.

  1. Log on to the Smart Access Gateway console.

  2. On the Smart Access Gateway page, click Purchase SAG.

  3. Select Create SAG (CPE).

  4. On the Smart Access Gateway page, set the following parameters, and then click Buy Now.

    • Region: The region where the SAG device is used. In this example, select Mainland China.

    • Instance Type: The model of the SAG device. In this example, select SAG-1000.

    • Have SAG Hardware Already: Select whether you already have an SAG device. In this example, select No.

    • Version: The edition of the SAG device. This example uses the default Standard Edition edition.

    • Quantity: The number of SAG devices to purchase. In this example, select 1.

    • Region: The bandwidth region used by the Smart Access Gateway (SAG) device. This region is the same as the region of the SAG device and cannot be modified.

    • Instance Name: The name of the SAG instance.

    • Peak Bandwidth: The peak bandwidth of the network. In this example, select 50 Mbps.

    • Subscription Period: Select a subscription duration.

  5. Confirm the order information, select the terms of service, and then click Confirm Purchase.

  6. In the Receiving Address dialog box, enter your shipping address, and then click Buy Now.

  7. On the Pay page, select a payment method and complete the payment.

  8. You can check whether the order is placed on the Smart Access Gateway page. SAG devices will be shipped within two business days after you place the order. To check the shipping updates, perform the following operations:

    1. On the Smart Access Gateway page, find the target SAG instance.

    2. In the Operation column, click the ellipsis-v icon and select View Shipping Update.

    3. In the Order Updates panel, view the shipping updates.

After the order is placed, the SAG instance status changes to Pending Shipment.

Step 2: Activate and connect the SAG device

After you receive the SAG device, verify that all accessories are included. For more information, see SAG-1000 device specifications.

After verifying the device, activate and connect it.

  1. Log on to the Smart Access Gateway console.

  2. In the top navigation bar, select the region where your SAG instance is deployed.

  3. On the Smart Access Gateway page, find the target instance and bind the device to the SAG instance. For more information, see Add a device.

  4. After the device is bound, return to the Smart Access Gateway page. In the Operation column of the target instance, click 更多 > Activate.

  5. In the Activate dialog box, click OK.

  6. After the device is activated, connect the SAG device to your on-premises network as shown in the topology diagram.

    Use a network cable to connect the WAN port of the SAG device to port G11 of the Layer 3 switch.

    This example uses the WAN port (Port 5). If Port 5 on your device is not a WAN port, you can change the port role. For more information, see Assign port roles.

    Note

    • Only SAG-1000 V2.0 devices support port role assignment.

    • Before you assign port roles, make sure that the SAG device is powered on, has a stable 4G signal, and is connected to Alibaba Cloud.

Step 3: Configure the SAG device

After connecting the device, you can configure its ports and routes in the SAG console.

Before you begin, make sure that the device is started, has a stable 4G signal, and is connected to Alibaba Cloud.

  1. Configure the port.

    1. On the SAG page, click the ID of the instance.

    2. On the details page of the SAG instance, click the Device Settings tab.

    3. In the left-side pane, click Manage WAN Ports.

    4. In the WAN (Port 5) section, click Edit.

    5. In the Configure WAN (Port 5) panel, set the following parameters, and then click OK.

      Parameter

      Description

      Connection Type

      Select Static IP.

      Priority

      Use the default value 1.

      IP Address

      The IP address of the WAN port. In this example, enter 192.168.100.1.

      Mask

      The subnet mask of the WAN port IP address. In this example, enter 255.255.255.252.

      Gateway

      The gateway IP address. In this example, enter 192.168.100.2.

      Note

      After you configure the gateway, the SAG device automatically adds a default route.

  2. Configure on-premises route synchronization.

    You must synchronize on-premises routes to the cloud to enable communication between your on-premises network and cloud resources.

    1. On the details page of the SAG instance, click the Network Configuration tab.

    2. In the left-side pane, click Method to Synchronize with On-premises Routes.

    3. Select Static Routing, click Add Static Route, configure the static route, and then click OK.

      Add a static route for the on-premises CIDR block that needs to communicate with the cloud: 172.16.0.0/12.

  3. Configure a static route.

    Configure a static route to direct traffic from the on-premises network to the WAN port. This allows the 4G network to be used as a backup.

    1. On the Smart Access Gateway page, click the ID of the instance.

    2. On the details page of the SAG instance, click the Device Settings tab.

    3. On the Device Settings page, click the Manage Routes tab.

    4. On the Manage Routes tab, click Add Static Route.

    5. In the Add Static Route panel, add a static route to the on-premises network with the following information, keep the default values for other settings, and then click OK.

      In this example:

      Parameter

      Description

      Destination CIDR Block

      The destination CIDR block. In this example, enter 172.16.0.0/12.

      Next Hop

      The IP address of the next hop. In this example, enter the IP address of the peer device connected to the WAN port: 192.168.100.2.

      Port

      The outbound port to the destination network segment. In this example, select the WAN port that you configured in Step 1.

Step 4: Configure the switch and egress router

You must also add route configurations for the switch and egress router that are connected to the SAG device. This section provides an example for a specific brand of switch and router. Configurations vary based on the device manufacturer. For more information, see the documentation for your devices.

  1. Configure routes for the layer 3 switch.

    
interface GigabitEthernet 0/11
no switchport
ip address 192.168.100.2 255.255.255.252             # Set the IP address for the switch port connected to the SAG device.  
ip route 10.0.0.0 255.255.0.0 192.168.100.1          # Add a route to the VPC in China (Beijing).
ip route 0.0.0.0 0.0.0.0 192.168.80.1                # Add a default route to the internet.

  2. Configure routes for the egress router.

    
ip route 192.168.100.0 255.255.255.252 192.168.80.2   # Add a route to the SAG device.

Step 5: Configure the cloud network connection

After configuring the device, set up the cloud network connection to bridge your on-premises network and Alibaba Cloud.

  1. Create a Cloud Connect Network (CCN) instance.

    1. Log on to the Smart Access Gateway console.

    2. In the top navigation bar, select the Mainland China region.

      The CCN and SAG device must be in the same region.

    3. In the left-side navigation pane, click CCN.

    4. On the CCN page, click Create CCN Instance.

    5. On the Create CCN Instance page, enter a name for the CCN instance, and then click OK.

      After the CCN instance is created, it appears in the instance list.

  2. Bind the SAG instance to the CCN instance.

    1. In the left-side navigation pane, click Smart Access Gateway.

    2. On the Smart Access Gateway page, click Network Configuration in the Operation column of the target instance.

    3. In the left-side navigation pane, click Network Instance Details.

    4. On the Network Instance Details tab, click Add Network, select Bind CCN, choose the CCN instance you created, and then click OK.

  3. Bind the CCN instance to a CEN instance.

    Binding CCN to CEN allows the SAG device in the CCN instance to communicate with the VPC attached to the CEN instance.

    1. In the left-side navigation pane, click CCN.

    2. Find the target CCN instance and click Bind CEN Instance in the Operation column.

    3. On the Bind CEN Instance page, click Existing CEN, choose your CEN instance, and then click OK.

  4. Configure security group rules.

    Configure a security group rule for the ECS instance in your VPC to allow traffic from the on-premises CIDR block 172.16.0.0/12. For more information, see Add a security group rule.

Step 6: Test the connection

After completing the configuration, use a client on your on-premises site to access cloud resources in the VPC.

Previous：SAG inline deploymentNext：Connect a single SAG device with one-arm dynamic routing