Connect using two SAGs with static routing in inline mode

Example scenario

The following figure shows the on-premises network topology used in this tutorial. A Layer-3 switch connects to two Layer-2 switches, through which on-premises clients and servers are connected. Two SAG devices connect directly to the Layer-3 switch and provide a redundant connection from the on-premises network to Alibaba Cloud.

Prerequisites

• You have created a Virtual Private Cloud (VPC) in the China (Beijing) region. For more information, see Create and manage a VPC.

• You have created a Cloud Enterprise Network (CEN) instance and attached the VPC to the CEN instance. For more information, see Create a CEN instance.

Network plan

The following table lists example network settings for this scenario. If you use a different network plan, make sure the CIDR blocks of communicating networks do not overlap.

Step 1: Purchase SAG devices

After you purchase SAG devices on the SAG console, Alibaba Cloud ships the devices to you and creates a corresponding SAG instance to manage your network configurations.

1. Log on to the Smart Access Gateway console.

2. On the Smart Access Gateway page, choose Purchase SAG > Create SAG (CPE).

3. On the buy page, configure the SAG instance as follows, and then click Buy Now.

   • Region: The deployment area for the SAG device. In this example, select Mainland China.

   • Instance Type: The model of the SAG device. In this example, select SAG-1000.

   • Have SAG Hardware: Specify whether you already have SAG hardware. In this example, select No.

   • Version: The edition of the SAG device. In this example, the default value Standard Edition is used.

   • Quantity: The number of SAG devices to purchase. In this example, select 2.

   • Region: The area where the bandwidth is used. This must match the device's deployment area and cannot be changed.

   • Instance Name: Enter a name for the SAG instance.

     The name must be 2 to 128 characters in length and start with an uppercase or lowercase letter or a Chinese character. It can contain digits, periods (.), hyphens (-), and underscores (_).

   • Peak Bandwidth: The peak bandwidth of the connection. In this example, select 30 Mbps.

   • Subscription Period: Select the subscription duration.

4. Review your order, and then click Confirm Purchase.

5. In the Receiving Address dialog box, enter the shipping address, and then click Buy Now.

6. On the Pay Now page, click Confirm Payment.

7. You can check whether the order is placed on the Smart Access Gateway page. SAG devices will be shipped within two business days after you place the order. To check the shipping updates, perform the following operations:

   1. On the Smart Access Gateway page, find the target SAG instance.

   2. In the Operation column, click the icon and select View Shipping Update.

   3. In the Order Updates panel, view the shipping updates.

After the order is placed, the status of the SAG instance is Pending Shipment.

Step 2: Activate and bind SAG devices

After receiving the SAG devices, verify that all accessories are included. For more information, see SAG-1000 device specifications.

1. In the top navigation bar, select the region.

2. On the Smart Access Gateway page, find the target instance.

3. In the Operation column of the target instance, click Activate.

4. Click the ID of the target instance. On the instance details page, click the Device Settings tab and enter the serial number of the SAG device.

   Select a Hardware Type and click Add device.

5. Click Add Device.

6. Repeat the preceding steps to bind the second SAG device to the instance.

Step 3: Connect SAG devices

After activating and binding the SAG devices, connect them to your on-premises network.

Before you begin, make sure the SAG devices are powered on and have a stable 4G connection to Alibaba Cloud. This section uses SAG device 1 as an example. Perform the same steps for SAG device 2 based on your network plan.

1. On the Smart Access Gateway page, find and click the ID of the target SAG instance.

2. On the instance details page, click the Device Settings tab.

3. In the left-side navigation pane, click Assign Port Roles.

4. On the Assign Port Roles page, find the target port, click Edit in the Operation column to change the port role, and then click OK.

   In this example, the on-premises network uses WAN (Port 5) and LAN (Port 4). For more information about ports, see Assign port roles.

5. Use a network cable to connect the WAN port (Port 5) of the SAG device to port G1 of the internet-facing router.

6. Use a network cable to connect the LAN port (Port 4) of the SAG device to port G11 of the layer-3 switch.

Step 4: Configure ports

After connecting the SAG devices, configure their ports on the SAG console.

This section uses SAG device 1 as an example. Perform the same steps for SAG device 2 based on your network plan.

1. Log on to the Smart Access Gateway console.

2. On the Smart Access Gateway page, click the ID of the target SAG instance.

3. On the instance details page, click the Device Settings tab.

4. In the left-side navigation pane, click LAN port management .

5. In the LAN (Port 4) section, click Edit .

6. In the Configure LAN (Port 4) dialog box, configure the port based on the following information, and then click OK .

   SAG device 1:

   • Connection type : Select Static IP .

   • Interface address : The IP address of the LAN port. In this example, enter 192.168.50.1 .

   • Subnet mask : The subnet mask of the LAN port. In this example, enter 255.255.255.0 .

   SAG device 2:

   • Connection type : Select Static IP .

   • Interface address : The IP address of the LAN port. In this example, enter 192.168.50.3 .

   • Subnet mask : The subnet mask of the LAN port. In this example, enter 255.255.255.0 .

7. In the left-side navigation pane, click Manage WAN Ports.

8. In the WAN (Port 5) section, click Edit.

9. In the Configure WAN (Port 5) dialog box, configure the port based on the following information, and then click OK.

   SAG device 1:

   • Connection Type: Select Static IP.

   • IP Address: The IP address of the WAN port. In this example, enter 192.168.100.1.

   • Mask: The subnet mask of the WAN port. In this example, enter 255.255.255.252.

   • Gateway : The IP address of the gateway. In this example, enter 192.168.100.2.

   SAG device 2:

   • Connection Type: Select Static IP.

   • IP Address: The IP address of the WAN port. In this example, enter 192.168.200.1.

   • Mask: The subnet mask of the WAN port. In this example, enter 255.255.255.252.

   • Gateway: The IP address of the gateway. In this example, enter 192.168.200.2.

   Note

   After you configure the gateway, the SAG device automatically adds a default route.

Step 5: Configure routing

After configuring the WAN and LAN ports, configure route synchronization from your on-premises network to the cloud and add a static route to define the egress path for cloud-to-on-premises traffic.

This section uses SAG device 1 as an example. Perform the same steps to configure SAG device 2 based on your network plan.

1. On the Smart Access Gateway page, click the ID of the target SAG instance.

2. On the instance details page, click the Network Configuration tab.

3. In the left-side navigation pane, click Method to Synchronize with On-premises Routes.

4. Select Static Routing, click Add Static Route, configure the static route, and then click OK.

   Add a static route for the on-premises network CIDR block: 172.16.0.0/12.

5. On the same instance page, click the Device Settings tab.

6. In the left-side navigation pane, click Manage Routes, and then click Add Static Route.

7. On the Add Static Route page, add a static route that directs traffic to the on-premises network.

   Parameter	Description
   Destination CIDR block	SAG device 1: 172.16.0.0/12 SAG device 2: 172.16.0.0/12
   Next hop IP	SAG device 1: 192.168.50.2 SAG device 2: 192.168.50.2
   Port	For both SAG devices, select Port 4 (LAN).

Step 6: Configure HA

In this scenario, configure HA to ensure redundancy and prevent single points of failure.

This section uses SAG device 1 as an example. Perform the same steps to configure SAG device 2 based on your network plan.

1. Log on to the Smart Access Gateway console.

2. Navigate to the Device Settings page using one of the following methods.

   • Click the ID of the target SAG instance. On the instance details page, click Device Settings.

   • Find the target SAG instance and choose > Device Settings from the Operation column.

3. On the Device Settings page, click Manage HA.

4. In the HA Information section, click the icon.

5. On the HA Settings page, select an HA mode.

   The following table describes the parameters.

   Configuration	Description
   HA Mode	Select Static for both SAG devices.
   Port	Select Port 4 (LAN) for both devices.
   Virtual IP	The virtual IP address used for HA. In this example, set this to 192.168.50.254 for both SAG devices.

6. Click Save.

Step 7: Configure layer-3 switch and router

Configuration commands vary by switch vendor. The following commands are for reference only. For detailed instructions, refer to your specific device documentation.

• Switch configuration

  Configure port IP addresses:
  interface GigabitEthernet 0/12
  switchport access vlan 10                 //Assign the port connected to the LAN port of SAG device 1 to VLAN 10.
  interface GigabitEthernet 0/14
  switchport access vlan 10                 //Assign the port connected to the LAN port of SAG device 2 to VLAN 10.
  interface  vlan 10
  ip address 192.168.50.2 255.255.255.0      //Client gateway address
  ip route 0.0.0.0 0.0.0.0 192.168.50.254    //The route from the switch to the internet.
                      

• Internet-facing router configuration

  Configure static routes:
  ip route 192.168.100.1 255.255.255.252  192.168.100.2  //The route from the internet-facing router to SAG device 1.
  ip route 192.168.200.1 255.255.255.252  192.168.200.2  //The route from the internet-facing router to SAG device 2.
                      

Step 8: Configure network connections

After configuring the SAG devices, set up the network connections between your on-premises network and Alibaba Cloud.

1. Create a Cloud Connect Network (CCN) instance.

   1. Log on to the Smart Access Gateway console.

   2. In the left-side navigation pane, click CCN.

   3. On the CCN page, click Create CCN Instance.

   4. In the Create CCN Instance pane, enter a name for the CCN instance and click OK.

      The name must be 2 to 100 characters in length and start with a letter or a Chinese character. It can contain digits, underscores (_), and hyphens (-). After the CCN instance is created, you can view it on the CCN instance list. The instance ID starts with ccn-. At this point, the instance is not yet bound to a CEN or SAG instance. In the Actions column, click Bind CEN to proceed.

2. Configure network connections.

   1. Log on to the Smart Access Gateway console.

   2. On the SAG page, find the SAG instance for which you want to configure the network and click Network Configuration in the Operation column.

   3. On the Network Instance Details tab, click Add Network. In the dialog box, select the CCN instance that you created, and then click OK.

3. Bind a CEN instance.

   1. Log on to the Smart Access Gateway console.

   2. In the left-side navigation pane, click CCN.

   3. Find the CCN instance that you want to bind to a CEN instance and click Bind CEN Instance in the Operation column.

   4. In the Bind CEN Instance pane, select the CEN instance that you want to bind, and then click OK.

      After binding, the SAG devices in the CCN instance can communicate with network instances attached to the CEN instance, such as VPCs and Virtual Border Routers (VBRs). The dialog box offers two options: Select existing CEN and Create new CEN. Select Select existing CEN and choose the target CEN instance from the drop-down list.

4. Configure a security group.

   Add a security group rule that allows your on-premises network to access resources in the VPC. For more information, see Add a security group rule.

Step 9: Test connection

After completing all configurations, access cloud resources in the VPC from an on-premises client to verify the connection.