Smart Access Gateway:Deploy two SAG devices in one-arm mode and enable dynamic routing

Prerequisites

• A virtual private cloud (VPC) is deployed in the China (Beijing) region. For more information, see Create and manage a VPC.

• A Cloud Enterprise Network (CEN) instance is created and associated with the VPC in the China (Beijing) region. For more information, see Create a CEN instance.

Network planning

Step 1: Purchase SAG devices

After you purchase SAG devices in the SAG console, Alibaba Cloud delivers the devices to the specified address and creates an SAG instance to help you facilitate network management.

1. Log on to the SAG console.

2. In the left-side navigation pane, click Smart Access Gateway.

3. On the Smart Access Gateway page, choose Purchase SAG > Create SAG (CPE).

4. Configure the following parameters and click Buy Now:

   • Area: Select the area where you want to use the SAG device. In this example, Mainland China is selected.

   • Device Spec: Select the model of the SAG device. In this example, SAG-1000 is selected.

   • Have SAG Devices Already: Select whether you already have an SAG device. In this example, No is selected.

   • Edition: Select the edition of the SAG device. In this example, Standard is selected.

   • Quantity: Select the number of SAG devices that you want to purchase. In this example, 2 is selected.

   • Area: Select the area where the SAG bandwidth is used. This area must be the same as that of the SAG device and cannot be modified.

   • Instance Name: Enter a name for the SAG instance.

     The name must be 2 to 128 characters in length, and can contain letters, digits, periods (.), hyphens (-), and underscores (_). It must start with a letter.

   • Peak Bandwidth: Select a maximum bandwidth value for network connections. In this example, 30Mbps is selected.

   • Subscription Duration: Select a subscription duration.

5. Confirm the order information and click Confirm Purchase.

6. In the Shipping Address dialog box, enter the recipient information and then click Buy Now.

7. In the Pay step, select a payment method and complete the payment.

8. You can check whether the order is placed on the Smart Access Gateway page. SAG devices will be shipped within two business days after you place the order. To check the shipping updates, perform the following operations:

   1. On the Smart Access Gateway page, find the SAG instance that you want to query.

   2. Choose > View Shipping Update in the Actions column.

   3. In the Order Updates panel, view the shipping updates.

Step 2: Activate the SAG devices

After you receive the SAG devices, check whether you have received all the accessories. For more information, see SAG-1000 device specifications.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, click the ID of the SAG instance that you want to manage.

3. Click Activate in the Actions column.

4. Click the ID of the SAG instance that you want to manage. On the details page, click the Device Management tab and enter the serial number of the SAG device.

   

5. Click Add Device.

6. Repeat this step to associate the other SAG device with the SAG instance.

Step 3: Connect the SAG devices to your on-premises network

After you activate the SAG devices and associate them with the SAG instance, you must connect the devices to your on-premises network.

Before you begin, make sure that the devices are activated, the 4G networks work as expected, and the devices are connected to Alibaba Cloud. The active device is used in this example. Repeat this step to connect the standby device to your on-premises network.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, click the ID of the SAG instance that you want to manage.

3. On the instance details page, click the Device Management tab.

4. In the left-side navigation tree, click Assign Port Roles.

5. In the Assign Port Roles section, find the port and click Edit in the Actions column. Assign a role to the port and click OK.

   The WAN port (port 5) is used in this example. For more information, see Assign port roles.

6. Use a network cable to connect the WAN port (port 5) of the SAG device to port G11 of the Layer 3 switch.

Step 4: Configure ports

After the SAG devices are connected to your private network, you can configure the device ports in the SAG console.

The active device is used in this example. Repeat this step to configure the ports of the standby device.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, click the ID of the SAG instance.

3. On the instance details page, click the Device Management tab.

4. In the left-side navigation tree, click Manage WAN Ports.

5. In the WAN (Port 5) section, click Edit.

6. In the Configure WAN (Port 5) dialog box, configure the following parameters and click OK:

   • Link Type: Select Static.

   • IP Address: Enter the IP address of the WAN port. In this example, 192.168.100.1 is used.

   • Subnet Mask: Enter the subnet mask of the WAN port IP address. In this example, 255.255.255.252 is used.

   • Gateway: Enter the IP address of the gateway. In this example, 192.168.100.2 is used.

     Note

     After the parameters are configured, a default route is added to the SAG device.

Step 5: Configure OSPF-based dynamic routing

You can configure OSPF-based dynamic routing for SAG devices in the SAG console.

The active device is used in this example. Repeat this step to configure OSPF-based dynamic routing for the standby device.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, click the ID of the SAG instance.

3. On the instance details page, click the Device Management tab.

4. In the left-side navigation pane, click Manage Routes.

5. In the OSPF Protocol Settings section, click Edit.

6. In the Configure OSPF Protocol dialog box, enter the information about the allocated IP address and click OK.

   Parameter	Description
   Area ID	Enter the area IDs of the active and standby devices. Area ID of the active device: 1. Area ID of the standby device: 1.
   Hello Time	Set the hello time to 3 seconds for both devices.
   Dead Time	Set the dead time to 10 seconds for both devices.
   Authentication Type	Select Disable Authentication for both devices.
   Router ID	Enter the router IDs of the active and standby devices. Router ID of the active device: 192.168.100.1. Router ID of the standby device: 192.168.200.1.
   Area Type	Default value: NSSA.

7. In the WAN/LAN Dynamic Routing Settings section, select Enable OSPF Protocol.

8. Find the WAN port (port 5), click Edit in the Actions column, select Enable OSPF, and then click OK.

Step 6: Configure the Layer 3 switch and Internet-facing router

The commands used to configure switches vary based on the switch provider. For more information, see the manuals issued by your providers. A switch and router provided by Cisco are used in this example.

• configure the Layer 3 switch

  • Set the port IP addresses and OSPF parameters.

    Note

    For each SAG device, the network type of ports that use the OSPF protocol must be set to peer-to-peer (P2P). Otherwise, the SAG device cannot calculate routes correctly.

    
    
    interface GigabitEthernet 0/11
    no switchport
    ip ospf network point-to-point#Set the network type to P2P.
    ip ospf hello-interval 3
    ip ospf dead-interval 10
    ip address 192.168.100.2 255.255.255.252#The port IP address of the peer switch of the SAG device.
    
    
    interface GigabitEthernet 0/13
    no switchport
    ip address 192.168.200.2 255.255.255.252#The port IP address of the peer switch of Device 2.
    ip ospf network point-to-point          #Set the network type to P2P.
    ip ospf dead-interval 10
    ip ospf hello-interval 3
    
    !
    
                                

  • Specify the loopback address and route advertisement information.

    Note

    OSPF requires an NSSA, automatically generates a default route, and advertises it to the SAG device.

    
    
    interface Loopback 0
    ip address 192.168.100.3 255.255.255.255 #The loopback address of the switch.
    !
    
    router ospf 1
    router-id 192.168.100.3#The router ID of the switch.
    network 172.16.0.0 0.15.255.255 area 0 #The CIDR block of the on-premises server.
    network 192.168.100.0 0.0.0.4 area 1 #The CIDR block of the switch port connected to Device 1.
    network 192.168.100.3 0.0.0.0 area 0   #The loopback IP address of the switch. 
    network 192.168.200.0 0.0.0.4 area 1     #The CIDR block of the switch port connected to Device 2 
    area 1 nssa default-information-originate no-summary
    
    !
    
                                

• Configure the Internet-facing router

  Add static routes
  
  ip route 192.168.100.1 255.255.255.252 192.168.80.2 #The route to the SAG device.
  ip route 192.168.200.1 255.255.255.252  192.168.80.2  #The route to Device 2.

Step 7: Set up network connections

After you configure the SAG devices, you must set up network connections to connect the on-premises network to Alibaba Cloud.

1. Connect the SAG instance to a CCN instance.

   1. Log on to the SAG console.

   2. In the left-side navigation pane, click CCN.

   3. On the CCN page, click Create CCN Instance.

   4. In the Create CCN Instance panel, enter a name for the CCN instance and click OK.

      The name must be 2 to 100 characters in length, and can contain letters, digits, underscores (_), and hyphens (-).

2. Set up network connections.

   1. Log on to the SAG console.

   2. On the Smart Access Gateway page, click the ID of the SAG instance or click Network Configuration in the Actions column.

   3. On the Method to Synchronize with On-premises Routes tab, select Dynamic Routing.

   4. On the Network Instance Details tab, click Attach Network, select a CCN instance, and then click OK.

      

3. Attach the CCN instance to a CEN instance.

   1. Log on to the SAG console.

   2. In the left-side navigation pane, click CCN.

   3. Find the CCN instance and click Bind CEN Instance in the Actions column.

   4. In the Bind CEN Instance panel, select the CEN instance that you want to use and click OK.

      After the CCN instance is attached to the CEN instance, SAG devices associated with the CCN instance can communicate with VPCs that are attached to the CEN instance.

4. Configure a security group.

   1. Log on to the Elastic Compute Service (ECS) console.

   2. In the left-side navigation pane, choose Network & Security > Security Groups.

   3. On the Security Groups page, find the security group that you want to manage and click Manage Rules in the Actions column.

   4. In the access Rule section, click Add Rule.

   5. Create a security group rule that allows access from the on-premises network to the VPC. For more information, see Add a security group rule.

Step 8: Test network connectivity

After you complete the preceding steps, access cloud resources deployed in the VPC from a client in your on-premises network to test the connectivity.