Deploy two SAG devices with LAN DHCP

IP address plan

The following table lists the sample IP addresses and CIDR blocks used in this tutorial. When you plan your own IP addresses and CIDR blocks, make sure they do not conflict.

Procedure

Step 1: Purchase the SAG devices

After you purchase SAG devices in the SAG console, Alibaba Cloud ships the devices to your specified address and creates an SAG instance for managing them.

1. Log on to the Smart Access Gateway console.

2. On the SAG page, click Purchase SAG.

3. Select Create SAG (CPE).

4. Configure the SAG devices and click Buy Now.

   • Region: Select the area where you want to deploy the SAG devices. In this example, Mainland China is selected.

   • Instance Type: Select the model of the SAG device. In this example, SAG-1000 is selected.

   • Have SAG hardware: Select whether you already have an SAG hardware device. In this example, No is selected.

   • Version: Select the edition of the SAG device. This example uses the default Standard Edition.

   • Quantity: Specify the number of SAG devices to purchase. In this example, 2 is selected.

   • Region: The region where the device's bandwidth is used. This must match the deployment region and cannot be changed.

   • Instance Name: Enter a name for the SAG instance.

   • Peak Bandwidth: Select the peak bandwidth for the network connection. In this example, 50 Mbps is selected.

   • Subscription Period: Select a subscription duration.

5. Confirm the order details and click Confirm purchase.

6. In the Receiving Address dialog box, enter the shipping address for the devices and click Buy Now.

7. On the Pay page, select a payment method and complete the payment.

8. You can check whether the order is placed on the Smart Access Gateway page. SAG devices will be shipped within two business days after you place the order. To check the shipping updates, perform the following operations:

   1. On the Smart Access Gateway page, find the target SAG instance.

   2. In the Operation column, click the icon and select View Shipping Update.

   3. In the Order Updates panel, view the shipping updates.

After the order is placed, the status of the SAG instance is Pending shipment.

Step 2: Activate and connect the SAG devices

After you receive the SAG devices, verify that all accessories are included. For more information, see SAG-1000 device specifications.

1. Log on to the Smart Access Gateway console.

2. In the top navigation bar, select the target region.

3. On the SAG page, find the target instance.

4. In the Operation column of the target instance, click Activate.

5. In the Activate dialog box, click OK.

6. Click the instance ID to go to the instance details page and view the active/standby roles of the SAG devices.

   Note

   • By default, the active/standby role of an SAG device is determined by its serial number. The device with the smaller serial number is the active device. The roles displayed in the console take precedence.

   • If you purchased the devices from a third-party vendor, you must manually bind the devices to the SAG instance. For more information, see Add a device. When you bind the devices, you can determine their roles. The first device you bind is the active device by default.

7. After you activate the devices, connect them to your private network according to their roles and the network topology.

   Active SAG device:

   • Use a network cable to connect the WAN port (Port 5) of the SAG device to port G1 of the egress router.

   • Use a network cable to connect the LAN port (Port 4) of the SAG device to port G11 of the Layer 2 switch.

   Standby SAG device:

   • Use a network cable to connect the WAN port (Port 5) of the SAG device to port G2 of the egress router.

   • Use a network cable to connect the LAN port (Port 4) of the SAG device to port G12 of the Layer 2 switch.

Step 3: Configure the SAG devices

You must log on to the web console of each SAG device to configure it. Before you begin, ensure the devices are powered on, have a stable 4G signal, and are connected to Alibaba Cloud.

1. Use a network cable to connect your computer to the management port (Port 2 by default) of the active SAG device, and then log on to its web console. For more information, see Step 1: Configure the local client and Step 2: Set a password for the first logon.

2. Assign port roles.

   Note

   By default, Port 5 is assigned the WAN role and Port 4 is assigned the LAN role. If you use the default configuration, you can skip this step. If the port roles have been modified, follow these steps to reassign them as required for your deployment.

   1. On the web console, click Configure.

   2. In the left-side navigation pane, click Port allocation.

   3. On the Port allocation page, find the target ports and select their port types.

      • Port 5: Select WAN.

      • Port 4: Select LAN.

   4. Click OK.

3. Configure the WAN port.

   1. In the left-side navigation pane, click Manage WAN Ports.

   2. On the Manage WAN Ports page, click Port 5 (WAN) to configure the WAN port.

      • Connection Type: Select Static IP.

      • IP Address: Enter the IP address of the WAN port. This example uses 192.168.100.1.

      • Mask: Enter the subnet mask of the WAN port. This example uses 255.255.255.252.

      • Gateway: Enter the IP address of the gateway. This example uses 192.168.100.2.

        Note

        Configuring the gateway automatically adds a default route to the SAG device.

   3. Click OK.

4. Configure the LAN port.

   1. In the left-side navigation pane, click Manage LAN Ports.

   2. On the Manage LAN Ports page, click Port 4 (LAN) to configure the LAN port.

      • Connection Type: Select Dynamic IP.

      • Private CIDR Block: Select Custom CIDR Block and enter 192.168.50.0/24.

      • Interface IP: Enter the IP address of the LAN port. This example uses 192.168.50.1.

      • DHCP start IP: This example uses 192.168.50.3.

      • DHCP end IP: This example uses 192.168.50.253.

      • Lease Term: 48 hours.

      • DHCP failover: Turn on this feature.

        Note

        The DHCP failover feature must be used with the HA feature. The HA virtual IP address serves as the gateway address and is automatically advertised to clients. When DHCP failover and HA are enabled on both the active and standby SAG devices, the devices back up each other's DHCP server and gateway functions, improving network availability.

   3. Click OK.

5. Enable HA.

   1. In the left-side navigation pane, click HA Settings.

   2. On the HA Settings page, select Static route HA and configure the HA parameters.

      • Port: Select Port 4 (LAN).

      • Virtual IP: Enter the virtual IP address. This example uses 192.168.50.254.

   3. Click OK.

6. Configure the standby SAG device.

   Repeat the configuration steps on the web console of the standby SAG device using the following parameters:

   • Port 5 (WAN) configuration:

     • Connection Type: Select Static IP.

     • IP Address: Enter the IP address of the WAN port. This example uses 192.168.200.1.

     • Mask: Enter the subnet mask of the WAN port. This example uses 255.255.255.252.

     • Gateway: Enter the IP address of the gateway. This example uses 192.168.200.2.

       Note

       Configuring the gateway automatically adds a default route to the SAG device.

   • Port 4 (LAN) configuration:

     • Connection Type: Select Dynamic IP.

     • Private CIDR Block: Select Custom CIDR Block and enter 192.168.50.0/24.

     • Interface IP: Enter the IP address of the LAN port. This example uses 192.168.50.2.

     • DHCP start IP: This example uses 192.168.50.3.

     • DHCP end IP: This example uses 192.168.50.253.

     • Lease Term: 48 hours.

     • DHCP failover: Turn on this feature.

   • HA configuration: Select Static route HA.

     • Port: Select Port 4 (LAN).

     • Virtual IP: Enter the virtual IP address. This example uses 192.168.50.254.

Step 4: Configure on-premises route synchronization

Configure on-premises route synchronization in the SAG console. This synchronizes your private network routes to the cloud, enabling communication with cloud resources.

1. Log on to the Smart Access Gateway console.

2. In the top navigation bar, select the target region.

3. On the SAG page, click the target instance ID.

4. On the instance details page, click the Network Configuration tab.

5. In the left-side section of the page, click Method to Synchronize with On-premises Routes.

6. Select Static Routing, click Add Static Route, configure the static route, and then click OK.

   Add a static route for the CIDR block of the private network that needs to communicate with the cloud: 192.168.50.0/24.

Step 5: Configure cloud network connection

After you configure the devices, set up the cloud-side network connection in the SAG console to connect your private network to Alibaba Cloud.

1. Create a Cloud Connect Network (CCN) instance.

   1. Log on to the Smart Access Gateway console.

   2. In the top navigation bar, select the Mainland China region.

      The CCN instance region must match the deployment area specified for the SAG devices.

   3. In the left-side navigation pane, click CCN.

   4. On the CCN page, click Create CCN Instance.

   5. In the Create CCN Instance dialog box, enter a name for the CCN instance and click OK.

      After the CCN is created, the new instance appears in the CCN instance list. The Bound CEN instance column is empty and the Bound SAG instances column shows 0/0.

2. Bind the SAG instance to the CCN instance.

   1. In the left-side navigation pane, click Smart Access Gateway .

   2. On the SAG page, find the target instance and click Network Configuration in the Operation column.

   3. In the left-side section of the page, click Network Instance Details.

   4. On the Network Instance Details tab, click Attach Network, select the CCN instance that you just created, and then click OK.

3. Bind the CCN instance to a CEN instance.

   Binding the CCN to a CEN instance allows SAG devices in the CCN instance to communicate with the VPC attached to the CEN instance.

   1. In the left-side navigation pane, click CCN.

   2. Find the CCN instance that you just created and click Bind CEN Instance in the Operation column.

   3. In the Bind CEN Instance dialog box, select Existing CEN, select the CEN instance to bind, and then click OK.

4. Configure security group rules.

   Add a security group rule to the security group of your ECS instance to allow access from your private network's CIDR block (192.168.50.0/24). For more information, see Add a security group rule.

Step 6: Test the connection

After you complete the preceding configurations, set your client to obtain an IP address automatically and then verify that it can access cloud resources in the connected VPC.

1. On your client computer, configure the network adapter to obtain an IP address automatically. For detailed instructions, see the documentation for your operating system. The following steps use a Windows OS as an example.

   In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, select Obtain an IP address automatically and Obtain DNS server address automatically, and then click OK.

2. The SAG device automatically assigns an IP address to the client. Once the client receives an IP address, test the connection by accessing cloud resources in the VPC.