All Products
Search
Document Center

Virtual Private Cloud:Examples of VPC peering connections

Last Updated:Jul 04, 2024

A peering connection connects two virtual private clouds (VPCs). You can create VPC peering connections to enable communication between multiple VPCs. VPC peering connections can also work with Cloud Enterprise Network (CEN) transit routers to enable communication among VPCs. This topic provides examples on how to use VPC peering connections.

Scenarios

Use VPC peering connections to enable communication among multiple VPCs

You can create VPC peering connections to connect two or more VPCs. You can also create a VPC peering connection between VPCs within different Alibaba Cloud accounts. This way, VPCs can communicate with each other and share resources.

Procedure

  1. Create VPCs that you want to connect. For more information, see Create a VPC and vSwitches.

  2. Create a VPC peering connection. For more information, see Create and manage a VPC peering connection.

  3. Configure routes. For more information, see Configure routes.

Communication between two VPCs

As shown in the following figure, a peering connection pcc-aaabbb is created between VPC A and VPC B. The two VPCs can communicate with each other and share resources.

image

When both VPC A and VPC B are assigned an IPv6 CIDR block, you can add IPv4 or IPv6 routes of the peer VPC to the route table of each VPC. You can select IPv4 or IPv6 based on your business requirements.

Route table

Destination address

Next hop

VPC A

172.16.0.0/16

pcc-aaabbb

2408:4006:121b:3f00::/56

pcc-aaabbb

VPC B

192.168.0.0/16

pcc-aaabbb

2408:4006:121b:4000::/56

pcc-aaabbb

If VPC A and VPC B use the same CIDR block, but the CIDR blocks of the vSwitches in VPC A and VPC B do not overlap, you can add vSwitch CIDR blocks of the peer VPC as the destination address to create peering connections.

image

Route table

Destination address

Next hop

VPC A

10.2.1.0/24

pcc-aaabbb

VPC B

10.2.0.0/24

pcc-aaabbb

Communication among three VPCs

As shown in the following figure, peering connections are established between VPC A and VPC B, between VPC B and VPC C, and between VPC A and VPC C. Each VPC can communicate with the other two VPCs and share resources.

image

If both VPC A and VPC B are assigned an IPv6 CIDR block, but VPC C is not assigned an IPv6 CIDR, the route tables of the VPCs are configured as described in the following table. VPC A and VPC B can communicate with each other over a peering connection in an IPv6 environment. VPC C cannot communicate with VPC A or VPC B over IPv6.

Route table

Destination address

Next hop

VPC A

172.16.0.0/16

pcc-aaabbb

2408:4006:121b:3f00::/56

pcc-aaabbb

10.1.0.0/16

pcc-aaaccc

VPC B

192.168.0.0/16

pcc-aaabbb

2408:4006:121b:4000::/56

pcc-aaabbb

10.1.0.0/16

pcc-bbbccc

VPC C

192.168.0.0/16

pcc-aaaccc

172.16.0.0/16

pcc-bbbccc

Communication among more than three VPCs

As shown in the following figure, peering connections are established among VPC A, VPC B, VPC C, VPC D, and VPC E. Each VPC can communicate with the other VPCs and share resources. In this scenario, five VPCs need to communicate with each other.

image

As shown in the preceding figure, a peering connection is established between each two of the five VPCs. The number of VPC peering connections is N × (N-1)/2. When N is 5, a total of 10 peering connections are established. Routes that point to each VPC peering connection are configured for each VPC. This way, each VPC can communicate with the other VPCs. Each VPC is assigned an IPv6 CIDR block. The following table describes how routes are configured.

Route table

Destination address

Next hop

VPC A

172.16.0.0/16

pcc-aaabbb

2408:4006:121b:3f00::/56

pcc-aaabbb

10.1.0.0/16

pcc-aaaccc

2408:4006:121b:5b00::/56

pcc-aaaccc

172.17.0.0/16

pcc-aaaddd

2408:4006:121b:5d00::/56

pcc-aaaddd

10.2.0.0/16

pcc-aaaeee

2408:4006:121b:5c00::/56

pcc-aaaeee

VPC B

192.168.0.0/16

pcc-aaabbb

2408:4006:121b:4000::/56

pcc-aaabbb

10.1.0.0/16

pcc-bbbccc

2408:4006:121b:5b00::/56

pcc-bbbccc

172.17.0.0/16

pcc-bbbddd

2408:4006:121b:5d00::/56

pcc-bbbddd

10.2.0.0/16

pcc-bbbeee

2408:4006:121b:5c00::/56

pcc-bbbeee

VPC C

192.168.0.0/16

pcc-aaaccc

2408:4006:121b:4000::/56

pcc-aaaccc

172.16.0.0/16

pcc-bbbccc

2408:4006:121b:3f00::/56

pcc-bbbccc

172.17.0.0/16

pcc-cccddd

2408:4006:121b:5d00::/56

pcc-cccddd

10.2.0.0/16

pcc-ccceee

2408:4006:121b:5c00::/56

pcc-ccceee

VPC D

192.168.0.0/16

pcc-aaaddd

2408:4006:121b:4000::/56

pcc-aaaddd

172.16.0.0/16

pcc-bbbddd

2408:4006:121b:3f00::/56

pcc-bbbddd

10.1.0.0/16

pcc-cccddd

2408:4006:121b:5b00::/56

pcc-cccddd

10.2.0.0/16

pcc-dddeee

2408:4006:121b:5c00::/56

pcc-dddeee

VPC E

192.168.0.0/16

pcc-aaaeee

2408:4006:121b:4000::/56

pcc-aaaeee

172.16.0.0/16

pcc-bbbeee

2408:4006:121b:3f00::/56

pcc-bbbeee

10.1.0.0/16

pcc-ccceee

2408:4006:121b:5b00::/56

pcc-ccceee

172.17.0.0/16

pcc-dddeee

2408:4006:121b:5d00::/56

pcc-dddeee

Note

The number of VPC peering connections and the number of route entries vary based on the number of VPCs. For example, if you want to connect every two of 10 VPCs, you must create 45 VPC peering connections and configure routes to the other 9 VPCs for each VPC. In this case, the configuration becomes complex. We recommend that you create VPC peering connections for no more than 10 VPCs.

Use VPC peering connections to enable communication between multiple VPCs and a central VPC

When you deploy your services, you must assign separate VPCs to different services or branches to ensure service security. These VPCs must be connected to the central-service VPC or central-branch VPC to share resources. For example:

  • An enterprise creates different VPCs for different departments. The enterprise wants the departments to be independent of each other but be able to access common services that are deployed in the central VPC, such as file sharing services and middleware services.

  • An enterprise provides services for multiple users, and the services are deployed in a separate service VPC. The enterprise wants the VPCs of different users to be independent of each other but be able to communicate with the separate service VPC.

Procedure

  1. Create VPCs that you want to connect. For more information, see Create a VPC and vSwitches.

  2. Create a VPC peering connection. For more information, see Create and manage a VPC peering connection.

  3. Configure routes. For more information, see Configure routes.

image

The preceding figure shows that an enterprise has four branches and one central department, and services are deployed in the central department. The enterprise wants to allow each branch to access the services in the central department but to be independent of each other. You can create VPC peering connections and configure routes that point to the VPC peering connections for the branch VPCs, as shown in the preceding figure. This way, each branch can access the services in the central department but cannot communicate with each other. The following table describes how routes are configured.

Route table

Destination address

Next hop

VPC A

172.16.0.0/16

pcc-aaabbb

2408:4006:121b:3f00::/56

pcc-aaabbb

10.1.0.0/16

pcc-aaaccc

2408:4006:121b:5b00::/56

pcc-aaaccc

172.17.0.0/16

pcc-aaaddd

2408:4006:121b:5d00::/56

pcc-aaaddd

10.2.0.0/16

pcc-aaaeee

2408:4006:121b:5c00::/56

pcc-aaaeee

VPC B

192.168.0.0/16

pcc-aaabbb

2408:4006:121b:4000::/56

pcc-aaabbb

VPC C

192.168.0.0/16

pcc-aaaccc

2408:4006:121b:4000::/56

pcc-aaaccc

VPC D

192.168.0.0/16

pcc-aaaddd

2408:4006:121b:4000::/56

pcc-aaaddd

VPC E

192.168.0.0/16

pcc-aaaeee

2408:4006:121b:4000::/56

pcc-aaaeee

Use VPC peering connections and transit routers to enable communication among multiple VPCs

The following table describes the differences between VPC peering connections and transit routers.

Billing method

VPC peering connection

Transit router

Connection method

Full mesh, which allows VPCs to communicate with each other over VPC peering connections.

Hub-spoke, which allows VPCs to connect to transit routers over VPC connections.

Route advertisement

Unsupported

Supported

Configuration complexity

The configuration is complex. You must create VPC peering connections and configure routes that point to each VPC peering connection for each peer VPC.

The configuration is simple. You need to only connect VPCs to a transit router and configure routes that route network traffic from the VPCs to the transit router.

Maximum number of supported VPCs

10

1,000

Billing rules

Intra-region peering connections are free of charge. If you create a VPC peering connection between VPCs that reside in different regions, you are charged for outbound traffic of the VPCs.

You are charged for transit routers and traffic processing. You are also charged for outbound data transfer over inter-region connections.

If you want to create VPC peering connections for a large number of VPCs, the configuration becomes more complex because of the connection mode of VPC peering connections and the requirements for point-to-point route configuration. VPC peering connections are not suitable for scenarios in which a large number of VPCs must be fully connected. However, VPC peering connections support low latency and are free of charge if the requester and accepter VPCs are in the same region.

The hub-spoke connection mode of transit routers allows you to connect VPCs to transit routers over VPC connections. Then, the transit routers automatically synchronize the routes of the VPCs. Transit routers require simple configurations and support various routing policies and quality of service (QoS) mechanisms. This helps you build complex networks and implement access control. However, transit routers support limited bandwidth and charge data processing fees. Compared with VPC peering connections, transit routers require a higher cost.

You cannot use only VPC peering connections or only transit routers to build complex networks that require both high bandwidth and cost-effectiveness. You can use VPC peering connections together with transit routers to meet your requirements.

For example, an enterprise creates multiple VPCs in multiple regions and requires communication among the VPCs, routing policy control, and cost reduction.

  • To enable communication among VPCs in the same region, you can create VPC peering connections. No fees are generated, and the network latency is low.

  • To enable communication among VPCs in different regions, you can use a transit VPC to connect the VPCs to a transit router. Transit routers also support routing policies that help you implement fine-grained routing.

  • For VPCs that are deployed in different regions and require high bandwidth, you can create inter-region VPC peering connections. In this example, an inter-region VPC peering connection is created between VPC A and VPC C.

image

Procedure

  1. Create a CEN instance and a transit router in each region. For more information, see Create a CEN instance and Create a transit router.

  2. Connect the VPCs to the transit router in the region. For more information, see Create a VPC connection.

  3. Create an inter-region VPC peering connection. For more information, see Create a VPC peering connection.

  4. Configure routes. For more information, see Configure routes.