When your enterprise's business resources are hosted outside Alibaba Cloud—in an on-premises data center or a third-party cloud—a SASE connector bridges those resources to the SASE gateway. This lets your users reach internal resources over a secure, managed network path without exposing them to the public internet.
This topic explains how to create a connector, deploy it on your server, configure forwarding policies, and disable the connector when needed.
Network connection diagram
Prerequisites
Before you begin, ensure that you have:
Root access to the server or virtual machine that hosts your business resources
Create a connector to enable network connections
Setting up a SASE connector involves three steps: create the connector in the console, deploy it on the server, and configure forwarding policies to control access.
Step 1: Create a SASE connector
Log on to the SASE console. In the left-side navigation pane, choose Private Access > Network Settings.
Click the Services Outside Alibaba Cloud tab.
On the Connectors tab, click Add Connector.
In the Add Connector panel, configure the parameters, then click OK.
ImportantIf Instance Switch is turned off, users cannot access office applications through the SASE client. Proceed with caution.
Parameter Description Region The region of the connector. Select the region closest to your server for best performance. Instance Name The name of the connector. Instance Switch Enables or disables the connector. Set to Enabled so users can access associated applications from the SASE client. You can also toggle this setting on the Connectors tab or in the connector's Details panel.
After the connector is created, it appears on the Connectors tab.
Step 2: Deploy the connector on your server
On the Connectors tab, find the connector and click Deploy in the Actions column.
In the Deploy panel, copy the deployment command.
Log on to your server or virtual machine as the root user and run the command.
The Deploy panel also provides commands to upgrade or uninstall the connector, and to export logs.
Step 3: Configure forwarding policies
Forwarding policies define which users and applications route traffic through the connector.
On the Connectors tab, click Forwarding Policies.
On the Forwarding Policies page, click Create Policy.
In the Create Policy panel, configure the parameters, then click OK.
Parameter Description Policy Name The name of the policy. Description A description of the policy. Priority The priority of the policy. Valid values: 1 to 100. A lower value means higher priority. Policy Details The applicable users and associated applications. Associated Connector The connector to associate with this policy. Policy Status Set to Enabled for the policy to take effect.
View connector details
On the Connectors tab, find the connector and click Details in the Actions column. The Instance Information tab shows:
| Field | Description |
|---|---|
| Authorization License | The license status of the connector. |
| Instance Status | Whether the connector is online. |
| Associate Policy | The forwarding policies linked to the connector. |
| Bandwidth Trend Chart | Historical bandwidth usage. |
Use this information to estimate bandwidth requirements and decide whether to adjust server configuration or add more connector-deployed servers.
Basic information
Bandwidth Trend Chart
From the same panel, you can also view and modify the forwarding policies associated with the connector.
View server information
On the Connectors tab, find the connector and click Details in the Actions column. On the Deploy Server tab, you can view:
| Field | Description |
|---|---|
| Status | Whether the server is running. |
| Endpoint IP Address | The public endpoint of the server. |
| Private IP Address | The private IP address of the server. |
| Bandwidth Trend Chart | Historical bandwidth usage for the server. |
| CPU Utilization | Current CPU load. |
| Memory Usage | Current memory consumption. |
| Packet Loss Rate | The rate of dropped packets. |
| Latency | Network latency to the connector. |
Use this information to evaluate whether servers perform as expected and whether their configuration meets your bandwidth requirements.
View alert settings
On the Connectors tab, find the connector and click Details in the Actions column. On the Alert Setting tab, you can see which alert types are enabled:
| Alert type | Configurable threshold |
|---|---|
| Connection Status of Connector Server | No |
| Connector Server Bandwidth | Yes |
| Connector Server Latency | Yes |
Alert settings only take effect after you configure message push settings. For details, see Configure message push.
Disable a connector
Disabling a connector blocks all users from accessing office applications through the SASE client. Proceed with caution.
To disable a connector, use either of the following methods:
On the Connectors tab, turn off the switch in the Instance Switch column.
Click Details in the Actions column and turn off Instance Switch in the panel.
What's next
After enabling network connections, configure applications to let users access them:
References
To allow traffic from specific IP addresses after configuring applications, see Configure an office application whitelist.
To connect SASE to business applications on Alibaba Cloud, see Enable network connections for services on Alibaba Cloud.
To connect SASE to applications in global offices, see Enable network connections for applications in global office scenarios.