Access OSS internally with SAG and CEN

Workflow

Step 1: Deploy and configure OSS

This tutorial deploys OSS from the console. What is Object Storage Service?.

1. Activate OSS. Activate OSS.

2. Create a bucket.

   1. Log on to the OSS console.

   2. In the left-side navigation pane, click Buckets, and then click Create Bucket.

   3. On the Create Bucket page, configure the bucket parameters, and then click Create.

      Parameters used in this tutorial. Create a bucket.

      Parameter	Description
      Bucket name	Enter a bucket name. The name cannot be changed after creation. In this example, shosstest is used.
      Region	The bucket region. Cannot be changed after creation. In this example, China (Shanghai) is selected.
      Storage class	The bucket storage class. In this example, Standard is selected. Standard storage provides high-performance object storage for frequent data access, suitable for social media, large websites, and big data analytics. Storage class overview.
      Redundancy type	The data redundancy type for the bucket. LRS Locally redundant storage (LRS) stores data copies on multiple devices within a single availability zone, ensuring data durability and availability against hardware failure. ZRS Zone-redundant storage (ZRS) stores data copies across multiple availability zones in the same region. This keeps your data accessible if one availability zone fails. Important ZRS is supported in the China (Shenzhen), China (Beijing), China (Hangzhou), China (Shanghai), China (Hong Kong), Singapore, and Indonesia (Jakarta) regions. ZRS is more expensive than LRS and cannot be disabled after you enable it. Exercise caution when you enable this feature. In this example, LRS is selected.
      ACL	The bucket ACL. In this example, Private is selected. Only the bucket owner can read and write objects. Other users cannot access them.
      Versioning	Specifies whether to enable versioning. In this example, Enable is selected. Versioning stores overwritten or deleted objects as historical versions, allowing you to restore any previous version. Versioning overview.
      Encryption Method	Server-side encryption. In this example, None is selected.
      Real-time Log Query	Real-time log query for OSS. In this example, Disable is selected.
      Scheduled backup	If you want to back up your OSS data on a schedule, enable this feature. Cloud Backup performs a daily backup and retains files for one week. In this example, Disable is selected.

3. Upload an object.

   1. In the left-side navigation pane, click Buckets . In the Bucket Name column, click the name of the target bucket.

   2. In the left-side navigation pane, choose Object Management > Objects.

   3. Click Upload Object .

   4. On the Upload Object page, configure the upload parameters.

      • Upload To : The storage path after upload. In this example, the default is used.

      • Object ACL : The object ACL. Default: Inherited from Bucket . In this example, the default is used.

      • Files to Upload : Select files or folders to upload. Click Select Files or Select Folders, or drag and drop files into this area. To remove a file, click Remove.

   5. Click Upload Object. In the Task List panel, wait for the upload to complete, and then close the Task List panel.

4. Configure object permissions.

   For data security, the OSS resources in this tutorial are set to private. You must grant access permissions to allow specific users to access specific OSS resources. The following steps grant read-only permission for an image to all users. Grant permissions on specific resources by using a bucket policy.

   1. In the left-side navigation pane, click Buckets . In the Bucket Name column, click the name of the target bucket.

   2. In the left-side navigation pane, choose Object Management > Objects.

   3. Click Authorize .

   4. On the Bucket Policy page, click Authorize .

   5. In the Authorize panel, configure the following parameters and click OK .

      • Applied To : In this example, Specified Resource is selected.

      • Resource Paths : In this example, enter SHOSS.jpg .

      • Authorized User : In this example, All Accounts (*) is selected.

      • Authorized Operation : In this example, Read-Only (excluding ListObject) is selected.

Step 2: Connect clients to Alibaba Cloud

Purchase an SAG App instance, configure the network, and create client accounts on the SAG console. On-premises clients can then connect to Alibaba Cloud through the SAG client.

1. Purchase an SAG App instance.

   1. Log on to the SAG console.

   2. In the left-side navigation pane, choose Smart Access Gateway App > SAG App Instances.

   3. On the Smart Access Gateway App page, click Create SAG App and configure the following parameters.

      • RegionRegion: The region where the SAG client is used. In this example, China (Shanghai) is selected.

      • Number of Client Accounts: The maximum number of client accounts. Create one account for each user. In this example, the default value of 10 is used.

        Note

        You can purchase 5 to 1,000 client accounts. Client accounts are priced on a tiered model. Billing for SAG App instances.

      • Data Plan Per Account: Free data transfer per account per month. Not shareable and does not roll over. Default: 5 GB/month.

      • Billing Method When Data Plan is Exhausted: Overages after the free plan are billed on a pay-as-you-go basis.

      • Subscription Period: The subscription duration of the data plan for each account, measured in months. Auto-renewal is supported. In this example, the default value of 1 Month is used.

   4. Click Buy Now, confirm the order, and complete the payment.

2. Configure the network.

   After purchase, configure the SAG App network by specifying a private CIDR block and binding it to a CCN instance.

   CCN is a key component of SAG. After binding, on-premises clients associated with the SAG instance can access Alibaba Cloud through the CCN instance. What is CCN?.

   1. On the Smart Access Gateway App page, find the instance that you created and click Quick Configuration in the Operation column.

   2. On the Quick Configuration page, configure the network.

      • CCN Instance ID/Name: You can bind a CCN instance in one of two ways. In this example, Create CCN is selected.

        • Existing CCN : If you have an existing CCN instance, you can select it from the drop-down list.

        • Create CCN : If you do not have a CCN instance, enter a name. The system automatically creates a CCN instance in the current region and binds it.

      • Optional:Standby and Active DNS: This parameter is optional. Customize the primary and backup DNS servers for the SAG App instance. The system pushes the configuration to clients automatically. In this example, this parameter is left empty.

      • Private CIDR Block: Configure the private CIDR block for clients. The system assigns an IP address from this block on each connection. Ensure CIDR blocks do not overlap. In this example, 192.168.10.0/24 is used.

3. Associate with a CEN instance.

   Bind the CCN instance to CEN. After binding, on-premises clients can access the OSS cloud service through CEN.

   1. Click Next: Associate with a CEN (optional) to bind to a CEN instance.

   2. You can bind to a CEN instance in one of two ways. This tutorial uses an existing CEN instance to allow clients to communicate with cloud resources. Select Existing CEN and choose your CEN instance.

      • Existing CEN: If you have an existing CEN instance, you can select it from the drop-down list.

      • Create CEN: If you do not have a CEN instance, enter a name. The system automatically creates a CEN instance and binds it.

4. Create client accounts.

   Create client accounts. Users log on to the SAG client with these credentials to connect to the internal network.

   1. Click Next: Create a client account to configure client accounts.

      • Username: This parameter is optional.

        Note

        • Usernames for client accounts within the same SAG App instance must be unique.

        • If you provide only an email address, the system generates a username and password automatically, using the email as the username.

      • Email Address: This parameter is required. The email address to receive account information.

      • Static IP:

        • If you enable this feature, specify an IP address for the client. The account always uses this IP address to access Alibaba Cloud.

          Note

          The specified IP address must be within the private CIDR block.

        • If you disable this feature, the system assigns an IP address from the private CIDR block on each connection.

      • Set Maximum Bandwidth: Maximum bandwidth per account. In this example, the default is used.

        Valid range: 1-2,000 Kbps. Default: 2,000 Kbps.

      • Set Password: This parameter is optional. Set the password for client login.

   2. Click Confirm Creation.

      Important

      • If no inter-region connection exists, create one between the VPC region's transit router and the CCN instance's transit router. Create an inter-region connection.

      • If an inter-region connection already exists, proceed to the next step.

5. Connect the client to Alibaba Cloud.

   1. After configuration, click Download Now to download and install the client. Install the client.

   2. After installation, employees log on with their credentials to connect to the internal network. Connect to the internal network.

   After a successful connection, the client status shows that the Internal Network Connection is established. The bandwidth limit is 2.0 Mbps. You can click Disconnect to end the connection.

Step 3: Configure routes to OSS

Configure routes to OSS on the CEN console. After configuration, CEN routes traffic from the CCN-associated network to OSS, enabling on-premises clients to access OSS.

1. Log on to the CEN console.

2. Click the ID of the target CEN instance.

3. On the Basic Information > Transit Router tab, find the transit router that is in the same region as the cloud service and click its ID.

4. On the details page of the transit router, click the Route Table tab.

5. On the Route Table tab, select the target route table from the list on the left. On the Route Entry tab of the Route Table Details section, click Add Route Entry.

6. In the Add Route Entry dialog box, configure the following parameters and click OK.

   Parameter	Description
   Route Table	The current route table is selected by default.
   Transit Router ID	The current transit router instance is selected by default.
   Name	Enter a name for the route entry.
   Destination CIDR	Enter the IP address or CIDR block of the cloud service. For example, enter the service CIDR blocks for OSS in the China (Shanghai) region: 100.98.35.0/24 100.98.110.0/24 100.98.169.0/24 100.118.102.0/24 Note We recommend that you add all service CIDR blocks for the region to the route entry.
   Blackhole Route	Whether to configure a blackhole route: Yes: This is a blackhole route. All traffic that matches this route is dropped. No: This is not a blackhole route. You must specify a next hop for the route. In this tutorial, select No.
   Next Hop	Select the next hop for the route entry. Select the connection ID of the VPC instance that is attached to the transit router.
   Description	Enter a description for the route entry.

Step 4: Test the connection

After completing the preceding steps, on-premises clients can connect to the internal network through the SAG client and access OSS resources.

For example, in a browser, use the internal URL https://shosstest.oss-cn-shanghai-internal.aliyuncs.com/SHOSS.jpg to download the SHOSS.jpg image that you uploaded.

• The URL format for accessing a file is: https://<bucket-name>.<vpc-endpoint>/<object-name>.

• To find the VPC endpoint for your region, see Access OSS by using endpoints and bucket domain names.