Dual-SAG inline connection with dynamic routing

Prerequisites

• You have created a Virtual Private Cloud (VPC) in the China (Beijing) region. For more information, see Create and manage a VPC.

• You have created a Cloud Enterprise Network (CEN) instance and attached the VPC in the China (Beijing) region to the CEN instance. For more information, see Create a CEN instance.

Network plan

The following table lists the example CIDR blocks used in this scenario. If you want to use your own CIDR blocks, ensure that the CIDR blocks of communicating networks do not overlap.

Step 1: Purchase SAG devices

After you purchase devices on the SAG console, Alibaba Cloud ships the devices to you and creates an SAG instance for you to manage your network configurations.

1. Log on to the SAG console.

2. In the left-side navigation pane, click SAG.

3. On the SAG page, choose Purchase SAG > Create SAG (CPE).

4. Configure the SAG device and click Buy Now.

   • Region: Select the area where the SAG devices are used. In this example, Mainland China is selected.

   • Instance Type: Select the model of the SAG device. This example uses SAG-1000.

   • Have SAG Hardware: Indicates whether you already have SAG hardware. In this example, No is selected.

   • Version: The device edition. This example uses the default Standard Edition.

   • Quantity: The number of devices to purchase. In this example, select 2.

   • Region: The area for the bandwidth subscription. This must match the device's usage area and cannot be changed.

   • Instance Name: The name of the SAG instance.

     The name must be 2 to 128 characters in length, start with a letter or a Chinese character, and can contain digits, periods (.), hyphens (-), and underscores (_).

   • Peak Bandwidth: Select the peak bandwidth. This example uses 30 Mbps.

   • Subscription Period: Select the subscription duration.

5. Confirm the order information and click Confirm Purchase.

6. In the Receiving Address dialog box, enter the shipping address for the gateway devices and click Buy Now.

7. On the Pay Now page, select a payment method and complete the payment.

8. You can check whether the order is placed on the Smart Access Gateway page. SAG devices will be shipped within two business days after you place the order. To check the shipping updates, perform the following operations:

   1. On the Smart Access Gateway page, find the target SAG instance.

   2. In the Operation column, click the icon and select View Shipping Update.

   3. In the Order Updates panel, view the shipping updates.

After you successfully place the order, the status of the SAG instance changes to Pending Shipment.

Step 2: Activate and bind the SAG devices

After you receive the gateway devices, check that all accessories are included. For more information, see SAG-1000 device specifications.

1. Log on to the SAG console.

2. On the SAG page, find the ID of the instance that you want to manage.

3. In the Operation column, click Activate.

4. Click the ID of the instance. On the instance details page, click the Device Settings tab and enter the serial number (SN) of the SAG device.

   Select a Hardware Type, enter the SN, and then click Add Device.

5. Click Add Device.

6. Repeat these steps to bind the second SAG device to the instance.

Step 3: Connect the SAG devices

After activating and binding the SAG devices, you must connect them to your on-premises network.

Before you begin, ensure that the gateway devices are powered on, have a stable 4G signal, and are connected to Alibaba Cloud. This section uses SAG 1 as an example. Perform the same steps to configure SAG 2 based on your network plan.

1. Log on to the SAG console.

2. On the SAG page, find the ID of the gateway instance that you want to manage.

3. On the instance details page, click the Device Settings tab and select the active device that you want to manage.

4. In the left-side navigation pane, click Assign Port Roles.

5. On the Assign Port Roles page, find the port that you want to manage, click Modify in the Operation column to modify the port role, and then click OK.

   In this scenario, the on-premises network uses a WAN port (Port 5) and a LAN port (Port 4). For more information, see Assign port roles.

6. Use an Ethernet cable to connect the WAN port (Port 5) of the SAG device to port G1 of the Internet-facing router.

7. Use an Ethernet cable to connect the LAN port (Port 4) of the SAG device to port G11 of the layer 3 switch.

Step 4: Configure ports

After connecting the gateway devices, you can configure their ports on the SAG console.

This section uses SAG 1 as an example. Perform the same steps to configure the ports of SAG 2 based on your network plan.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, click the ID of the gateway instance that you want to manage.

3. On the instance details page, click the Device Settings tab.

4. In the left-side navigation pane, click Manage LAN Ports.

5. In the LAN (Port 4) section, click Edit .

6. In the Configure LAN (Port 4) dialog box, configure the port based on the following information and click OK .

   • Link Type : Select static IP .

   • Interface address : Enter 192.168.50.1.

   • Mask address : Enter 255.255.255.252.

7. In the left-side navigation pane, click Manage WAN Ports.

8. In the WAN (Port 5) section, click Edit.

9. In the Configure WAN (Port 5) dialog box, configure the port based on the following information and click OK.

   • Connection Type: Select Static IP.

   • IP Address: Enter 192.168.100.1.

   • Mask: Enter 255.255.255.252.

   • Gateway : Enter 192.168.100.2.

     Note

     After you configure the gateway, the SAG device adds a default route.

Step 5: Configure OSPF dynamic routing

You can configure the OSPF dynamic routing protocol for the devices on the SAG console.

This section uses SAG 1 as an example. Perform the same steps to configure the OSPF dynamic routing protocol for SAG 2 based on your network plan.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, click the ID of the gateway instance that you want to manage.

3. On the instance details page, click the Device Settings tab.

4. In the left-side navigation pane, click Manage Routes.

5. In the OSPF Protocol Settings section, click Edit.

6. In the Configure OSPF Protocol dialog box, enter the planned IP address information and click OK.

   Parameter	Description
   Area ID	The area ID of the device. Area ID of the active device: 1 Area ID of the standby device: 1
   Hello Time	Set the hello time to 3 seconds for both devices.
   Dead Time	Set the dead time to 10 seconds for both devices.
   Authentication Type	Select No Authentication for both devices.
   Router ID	The router ID of the device. Router ID of the active device: 192.168.100.1 Router ID of the standby device: 192.168.200.1
   Area Type	The area type. The default value is NSSA.

7. In the Dynamic Routing Settings section, select Enable OSPF Protocol.

8. For Port 4 (LAN), click Edit in the Operation column, select Enable OSPF, and then click OK.

Step 6: Configure the layer 3 switch and Internet-facing router

The configuration commands for switches vary based on the vendor. For specific commands, consult the documentation for your switch. This section uses a Cisco switch and router as an example.

• Switch configuration

  • Configure the port IP addresses and OSPF parameters.

    Note

    For an SAG device that uses OSPF, the network type of the OSPF interface must be set to point-to-point (P2P). Otherwise, routes are not calculated correctly.

    
    interface GigabitEthernet 0/11
    no switchport
    ip ospf network point-to-point   # The network type must be P2P.
    ip ospf hello-interval 3
    ip ospf dead-interval 10
    ip address 192.168.50.2 255.255.255.252  # The IP address of the switch port connected to SAG 1.
    interface GigabitEthernet 0/12
    no switchport
    ip address 192.168.60.2 255.255.255.252 # The IP address of the switch port connected to SAG 2.
    ip ospf network point-to-point     # The network type must be P2P.
    ip ospf dead-interval 10
    ip ospf hello-interval 3
    ! 
                                

  • Configure the loopback address and route advertisement information of the switch.

    Note

    OSPF must be configured as a not-so-stubby area (NSSA), which automatically generates and advertises a default route to the SAG devices.

    
    interface Loopback 0
    ip address 192.168.100.3 255.255.255.255# The loopback address of the switch.
    !
    router ospf 1
    router-id 192.168.100.3 # The router ID of the switch.
    network 172.16.0.0 0.15.255.255 area 0# The CIDR block of the on-premises servers.
    network 192.168.50.0 0.0.0.4 area 1 # The CIDR block of the switch interface connected to SAG 1.
    network 192.168.100.3 0.0.0.0 area 0# The loopback address of the switch.  
    network 192.168.60.0 0.0.0.4 area 1       # The CIDR block of the switch interface connected to SAG 2.
     area 1 nssa default-information-originate no-summary
    !
                                

• Route configuration on the Internet-facing router

  Configure static routes
  ip route 192.168.100.1 255.255.255.252  192.168.100.2  # The route from the Internet-facing router to SAG 1.
  ip route 192.168.200.1 255.255.255.252  192.168.200.2  # The route from the Internet-facing router to SAG 2.

Step 7: Configure network connections

After you configure the gateway devices, configure network connections to connect your on-premises network to Alibaba Cloud.

1. Create a Cloud Connect Network (CCN) instance.

   1. Log on to the SAG console.

   2. In the left-side navigation pane, click CCN.

   3. On the CCN page, click Create CCN Instance.

   4. On the Create CCN Instance page, enter a name for the CCN instance and click OK.

      The name must be 2 to 100 characters in length, start with a letter or a Chinese character, and can contain digits, underscores (_), and hyphens (-). After the instance is created, it appears in the CCN instance list. Click Bind CEN in the Actions column to associate it with a CEN instance.

2. Configure network connections.

   1. Log on to the SAG console.

   2. On the Smart Access Gateway page, click the ID of the instance that you want to configure, or click Network Configuration in the Operation column.

   3. On the Method to Synchronize with On-premises Routes tab, select Dynamic Routing.

   4. On the Network Instance Details tab, click Add Network, select a CCN instance and a network instance, and then click OK.

3. Bind the CCN instance to a CEN instance.

   1. Log on to the SAG console.

   2. In the left-side navigation pane, click CCN.

   3. Find the CCN instance that you want to bind and click Bind CEN Instance in the Operation column.

   4. In the Bind CEN Instance panel, select the CEN instance to bind and click OK.

      After you bind the CEN instance, the SAG devices in the CCN instance can communicate with the network instances, such as VPCs or virtual border routers (VBRs), that are attached to the CEN instance.

4. Configure security groups.

   1. Log on to the ECS console.

   2. In the left-side navigation pane, choose Network and Security Group > security groups.

   3. On the security groups page, find the security group that you want to manage and click Configure Rules in the Actions column.

   4. On the Inbound rules tab, click Add Manually.

   5. Add a security group rule to allow access from the on-premises network. For more information, see Add a security group rule.

Step 8: Test the connectivity

After you complete the configurations, test the connectivity by accessing cloud resources that are deployed in the connected VPC from a client in your on-premises network.