Before you get started with Virtual Private Cloud (VPC), we recommend that you understand the limits and learn how to increase quotas.

Limits on VPCs and vSwitches

Item Limit Adjustable
Number of VPCs that can be created in each region 10

You can navigate to the Quota Management page to request a quota increase. For more information, see Manage resource quotas.

Number of vSwitches that can be created in each VPC 150
Available CIDR blocks for each VPC
  • We recommend that you use 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or one of their subnets.
  • You can also use a custom CIDR block other than 100.64.0.0/10, 224.0.0.0/4, 127.0.0.0/8, 169.254.0.0/16, or their subnets.
N/A
Number of secondary IPv4 CIDR blocks that can be created in each VPC 5
Number of secondary IPv6 CIDR blocks that can be created in each VPC 3
Number of customer CIDR blocks that can be created in each VPC 3
Number of private IP addresses that can be used by cloud resources in each VPC 60,000
Note
  • If an Elastic Compute Service (ECS) instance has only one private IP address, the ECS instance uses only one network address.
  • If an ECS instance is associated with multiple elastic network interfaces (ENIs), or multiple IP addresses are assigned to an ENI, the number of network addresses used by the ECS instance equals the total number of the IP addresses assigned to the ENIs that are associated with the ECS instance.
Number of tags that can be added to each VPC 20
Number of tags that can be added to each vSwitch 20

Limits on vRouters and route tables

Item Limit Adjustable
Number of vRouters that can be created in each VPC 1. N/A
Number of custom route tables that can be created in each VPC 9

You can navigate to the Quota Management page to request a quota increase. For more information, see Manage resource quotas.

Number of custom route entries that can be created in each route table 200
VPCs that do not support custom route tables If the VPC contains an ECS instance of the following types, the VPC does not support custom route tables:

ecs.c1, ecs.c2, ecs.c4, ecs.c5, ecs.ce4, ecs.cm4, ecs.d1, ecs.e3, ecs.e4, ecs.ga1, ecs.gn4, ecs.gn5, ecs.i1, ecs.m1, ecs.m2, ecs.mn4, ecs.n1, ecs.n2, ecs.n4, ecs.s1, ecs.s2, ecs.s3, ecs.se1, ecs.sn1, ecs.sn2, ecs.t1, and ecs.xn4.

For more information, see Advanced VPC features.

If your Elastic Compute Service (ECS) instance does not support advanced virtual private cloud (VPC) features, upgrade or release the ECS instance.
Number of tags that can be added to each route table 20

Limits on Dynamic Host Configuration Protocol (DHCP) options sets

Item Limit Adjustable
Number of DHCP options sets that can be created with each Alibaba Cloud account 10 N/A
Number of VPCs that can be associated with each DHCP options set 10
Number of DHCP options sets that can be associated with each VPC 1.
Number of domain names that can be specified in each DHCP options set 1.
Number of DNS server IP addresses that can be specified in each DHCP options set 4
VPCs that cannot be associated with DHCP options sets If the VPC contains an ECS instance of the following instance families, the VPC does not support DHCP options sets:

ecs.c1, ecs.c2, ecs.c4, ecs.c5, ecs.ce4, ecs.cm4, ecs.d1, ecs.e3, ecs.e4, ecs.ga1, ecs.gn4, ecs.gn5, ecs.i1, ecs.m1, ecs.m2, ecs.mn4, ecs.n1, ecs.n2, ecs.n4, ecs.s1, ecs.s2, ecs.s3, ecs.se1, ecs.sn1, ecs.sn2, ecs.t1, and ecs.xn4.

For more information, see Advanced VPC features.

If your Elastic Compute Service (ECS) instance does not support advanced virtual private cloud (VPC) features, upgrade or release the ECS instance.

Limits on shared vSwitches

Item Limit Adjustable
Number of participants supported by each VPC 20 N/A
Number of participants supported by each vSwitch in a VPC 20
Number of vSwitches that can be shared with each participant 10
Number of IP addresses that each VPC can use Number of IP addresses that each shared VPC can use
Cloud resources that can be created in a shared vSwitch
  • ECS instance
  • SLB instances
  • ApsaraDB RDS instances
  • Terway components
  • ApsaraDB for MongoDB instances
  • ApsaraDB for Redis instances
  • Message Queue for Apache Kafka instances
  • Elastic Search
  • Container Registry instances
  • PolarDB for MySQL clusters
 N/A
Limits on security groups in a shared VPC
  • A resource participant cannot create resources in security groups that belong to other resource participants or the resource owner. The security groups include the default security group.
  • The resource owner cannot create resources in security groups that belong to resource participants.
Types of vSwitches that can be shared Non-default vSwitches

Limits on flow logs

Item Limit Adjustable
Number of flow logs that can be created in each region 10 N/A
ECS instance families that do not support flow logs
  • When you enable flow logs for a VPC or a vSwitch, ECS instances in the VPC or vSwitch do not support flow logs if they belong to the following instance types. Other ECS instances that meet the requirements support flow logs:
  • ENIs that are associated with ECS instances of the following instance families do not support flow logs:

    ecs.c1, ecs.c2, ecs.c4, ecs.c5, ecs.ce4, ecs.cm4, ecs.d1, ecs.e3, ecs.e4, ecs.ga1, ecs.gn4, ecs.gn5, ecs.i1, ecs.m1, ecs.m2, ecs.mn4, ecs.n1, ecs.n2, ecs.n4, ecs.s1, ecs.s2, ecs.s3, ecs.se1, ecs.sn1, ecs.sn2, ecs.t1, and ecs.xn4.

Upgrade the ECS instances that do not support flow logs. For more information, see Upgrade the instance types of subscription instances and Change the instance type of a pay-as-you-go instance.

Limits on network access control lists (ACLs)

Item Limit Adjustable
Number of network ACLs that can be created in each VPC 200 N/A
Number of network ACLs that can be associated with a vSwitch 20
Number of rules that can be added to a network ACL
  • Inbound rules: 20
  • Outbound rules: 20

You can navigate to the Quota Management page to request a quota increase. For more information, see Manage resource quotas.

VPCs that do not support network ACLs If the VPC contains an ECS instance of the following instance families, the VPC does not support network ACLs:

ecs.c1, ecs.c2, ecs.c4, ecs.c5, ecs.ce4, ecs.cm4, ecs.d1, ecs.e3, ecs.e4, ecs.ga1, ecs.gn4, ecs.gn5, ecs.i1, ecs.m1, ecs.m2, ecs.mn4, ecs.n1, ecs.n2, ecs.n4, ecs.s1, ecs.s2, ecs.s3, ecs.se1, ecs.sn1, ecs.sn2, ecs.t1, and ecs.xn4.

For more information, see Advanced VPC features.

If your Elastic Compute Service (ECS) instance does not support advanced virtual private cloud (VPC) features, upgrade or release the ECS instance.
Note If the VPC contains an ECS instance of the specified ECS instance families and the network ACL feature is enabled, you must upgrade or release the ECS instance so that the network ACL can work as expected.

Limits on high-availability virtual IP addresses (HAVIPs)

Item Limit Adjustable
Network types that support HAVIPs VPCs N/A
Number of HAVIPs that can be associated with each ECS instance 5
Number of ECS instances or ENIs that can be associated with each HAVIP 2
Whether HAVIPs support broadcasting and multicasting Not supported
Note HAVIPs support only unicasting. To implement high availability through third-party software such as keepalived, you must modify the configuration file to change the communication method to unicasting.
Number of HAVIPs that can be created with each Alibaba Cloud account 5

You can navigate to the Quota Management page to request a quota increase. For more information, see Manage resource quotas.

Number of HAVIPs that can be created in each VPC 5
Number of route entries that point to an HAVIP in each VPC 5

Limits on traffic mirroring

Item Limit Adjustable
The number of traffic mirror sessions that you can create in each region with each Alibaba Cloud account 20000 N/A
The number of traffic mirror sessions supported by each traffic mirror source 1
The number of traffic mirror sources that can be specified in each traffic mirror session 1
The number of traffic mirror destinations that can be specified by each Alibaba Cloud account Unlimited
The number of traffic mirror sessions supported by each traffic mirror destination
  • 200 (if the traffic mirror destination is an internal-facing SLB instance)
  • 10 (if the traffic mirror destination is an ENI)
The number of rules that can be specified in each filter 10
The number of traffic mirror sessions that can be associated with each filter 1000