Virtual Private Cloud:Connect VPCs

Features

• CEN

  Before you use CEN to connect different VPCs, you must make sure that the CIDR blocks to be connected do not overlap.

  CEN uses transit routers to build private network channels between VPCs. The VPCs can reside in the same region or in different regions. The hub-spoke connection mode of transit routers allows you to connect VPCs to transit routers over VPC connections. Then, the transit routers automatically synchronize the routes of the VPCs.

  Transit routers require simple configuration and support various routing policies and quality of service (QoS) mechanisms. This helps you plan complex networks and implement access control. However, transit routers have limits on the bandwidth. You are also charged for traffic processing if you use transit routers. Therefore, the CEN solution costs more than the VPC peering connection solution.

• VPC peering connection

  When you connect VPCs by using VPC peering connections, make sure that the CIDR blocks to be connected do not overlap with each other.

  If you want to create VPC peering connections for a large number of VPCs, the configuration becomes more complex because of the connection mode of VPC peering connections and the requirements for point-to-point route configuration. VPC peering connections are not suitable for scenarios in which a large number of VPCs must be fully connected. However, VPC peering connections provide benefits such as unlimited bandwidth, low latency, and no fees for the VPC peering connections created for VPCs in the same region.

• PrivateLink

  PrivateLink allows you to establish stable and secure private connections between VPCs in which endpoint services are deployed and VPCs in which endpoints are deployed. PrivateLink requires easy network configuration and meets the requirements of various scenarios. The VPCs that are connected by using PrivateLink must reside in the same zone.

  When you use PrivateLink to connect different VPCs, the CIDR blocks of the VPCs in which endpoint services are deployed and VPCs in which endpoints are deployed can overlap.

  This solution can tolerate overlapping CIDR blocks and does not require route configurations. It also provides strong network isolation and access control capabilities, enabling highly secure network connections. However, PrivateLink supports only one-way access.

• VPN Gateway

  Before you use VPN gateways to connect different VPCs, you must make sure that the CIDR blocks to be connected do not overlap.

  This solution requires complex configuration. You must create VPN gateways, customer gateways, and IPsec-VPN connections, and configure routes for the VPN gateways. Therefore, we recommend that you do not use this method when you want to connect a large number of VPCs.

Architecture

You can connect multiple VPCs by using CEN, VPN gateways, VPC peering connections, and PrivateLink, so that the VPCs can access resources in the other VPCs. You can use PrivateLink to share the service resources in a VPC to other VPCs without establishing private network connections.

CEN

You can use CEN to connect VPCs in the same region or in different regions. The following figure shows how CEN is used to connect three VPCs in the same region.

Note To allow VPCs in different regions to communicate with each other, you must purchase a bandwidth plan and set up cross-region connections. VPCs within the same region can communicate with each other through transit routers. You do not need to purchase a bandwidth plan or create cross-region connections. For information about how to purchase bandwidth plans and create cross-region connections, see Work with a bandwidth plan and Manage inter-region connections.

VPC peering connection

A VPC peering connection is a private network connection between two VPCs. You can enable multiple VPCs to communicate with each other by establishing VPC peering connections. If you want to connect more than two VPCs by using VPC peering connections, you must establish a peering connection for every pair of the VPCs. The following figure shows how to use the VPC peering connection solution to connect three VPCs.

Note When you create a VPC peering connection, one VPC serves as the requester and the other VPC serves as the accepter. The requester and the accepter can reside in the same region or in different regions.

PrivateLink

In PrivateLink, endpoint services can use Classic Load Balancer (CLB) instances as service resources. You can use PrivateLink to enable a VPC to access a CLB instance that serves as the service resource in another VPC. The following figure shows how two VPCs are connected by using PrivateLink so that one of the VPCs can access the CLB instance in the other VPC.

VPN gateways

You can connect two VPCs by connecting two VPN gateways through an encrypted IPsec-VPN tunnel. The following figure shows how two VPCs are connected by using VPN gateways.

Note We recommend that you do not use this solution if you want to connect a VPC in a Chinese mainland region and one in a region outside the Chinese mainland. This is because cross-border connections are unstable. If you need to establish cross-border connections, we recommend that you use the CEN solution. For more information, see What is CEN?.

Configuration method