This topic describes how to configure active/standby connections between a data center and a virtual private cloud (VPC) by using an IPsec-VPN connection and an Express Connect circuit. The IPsec-VPN connection is associated with a transit router.
Scenario
The following scenario is used as an example. A company has a data center in Shanghai, and has deployed a VPC in the China (Hangzhou) region. Applications and services are deployed on Elastic Compute Service (ECS) instances in the VPC. The company wants to establish active/standby connections between the data center and the VPC.
Networking
Network settings
The following network settings are used in this topic:
The data center is connected to Alibaba Cloud through an Express Connect circuit and an IPsec-VPN connection.
When the Express Connect circuit and IPsec-VPN connection are working as expected, all traffic between the data center and the VPC is forwarded through the Express Connect circuit. When the Express Connect circuit fails, the IPsec-VPN connection takes over.
When you create an IPsec-VPN connection, set Gateway Type to Public and set Associate Resource to CEN.
BGP dynamic routing is configured for the data center, the virtual border router (VBR), and the IPsec-VPN connection to implement route learning and advertising. This facilitates route configuration.
Only IPsec-VPN connections in specific regions support BGP. For more information about regions, see Regions that support BGP dynamic routing.
ImportantThe following content describes the data transfer in this scenario:
When the Express Connect circuit, the IPsec-VPN connection, and BGP dynamic routing work as expected, the VPC can learn routes that point to the data center through the Express Connect circuit and the IPsec-VPN connection. In addition, the data center can learn routes that point to the VPC through the Express Connect circuit and the IPsec-VPN connection. By default, the routes learned through the Express Connect circuit have a higher priority than those learned through the IPsec-VPN connection. Therefore, data is transferred through the Express Connect circuit between the VPC and the data center by default.
When the Express Connect circuit is down, the routes learned through the Express Connect circuit are revoked and the routes learned through the IPsec-VPN connection automatically take effect. Data is transferred through the IPsec-VPN connection between the VPC and the data center. After the Express Connect circuit recovers, the Express Connect circuit takes over and the IPsec-VPN connection serves as a standby connection.
Network planning
When you allocate CIDR blocks, make sure that the CIDR blocks of the data center and VPC do not overlap.
Resource | CIDR block and IP address |
VPC | Primary CIDR block: 172.16.0.0/16
|
IPsec-VPN connection | BGP configuration: The CIDR block of the tunnel, the BGP IP address, and the autonomous system number (ASN) on the data center side are 169.254.10.0/30, 169.254.10.1, and 45104 (default), respectively. |
VBR | VBR configuration:
|
On-premises gateway device | Public IP address: 211.XX.XX.68 |
BGP configuration: The CIDR block of the tunnel, the BGP IP address, and the ASN on the data center side are 169.254.10.0/30, 169.254.10.2, and 65530, respectively. | |
Data center | CIDR blocks to be connected to the VPC:
|
Preparations
Make sure that the following prerequisites are met before you start:
A VPC is created in the China (Hangzhou) region. Applications are deployed on the ECS instance in the VPC. For more information, see Create a VPC with an IPv4 CIDR block.
A CEN instance is created. An Enterprise Edition transit router is created in the China (Hangzhou) and China (Shanghai) regions. For more information, see Create a CEN instance and Create a transit router.
ImportantWhen you create a transit router, you must configure a CIDR block for the transit router. Otherwise, IPsec-VPN connections cannot be associated with the transit router.
If you have already created a transit router, you can configure a CIDR block for the transit router. For more information, see Transit router CIDR blocks.
You understand the security group rules of the ECS instance in the VPC. Make sure that the rules allow the ECS instance to communicate with the data center. For more information, see View security group rules and Add a security group rule.
Procedure
Step 1: Deploy an Express Connect circuit
You must deploy an Express Connect circuit to connect the data center to Alibaba Cloud.
Create a dedicated Express Connect circuit.
In this example, a dedicated Express Connect circuit named Circuit1 is created in the China (Shanghai) region. For more information, see Create and manage a dedicated connection over an Express Connect circuit.
Create a VBR.
Log on to the Express Connect console.
In the left-side navigation pane, click Virtual Border Routers (VBRs).
In the top navigation bar, select the region where you want to create the VBR.
In this example, China (Shanghai) is selected.
On the Virtual Border Routers (VBRs) page, click Create VBR.
In the Create VBR panel, set the following parameters and click OK.
The following table describes only the key parameters. The default values are used for the other parameters. For more information, see Create and manage a VBR.
Parameter
Description
VBR
Account Type
Select the account type of the VBR.
In this example, Current Account is selected.
Name
Enter a name for the VBR.
In this example, VBR is used.
Physical Connection Information
Select the Express Connect circuit to be associated with the VBR.
In this example, Dedicated Physical Connection is selected, and the Express Connect circuit created in Step1 is selected.
VLAN ID
Enter a VLAN ID for the VBR.
NoteMake sure that the VLAN ID of the VBR is the same as the VLAN ID of the interface that the on-premises gateway device uses to connect to the Express Connect circuit.
In this example, 201 is used.
Set VBR Bandwidth Value
Specify a maximum bandwidth value for the VBR.
Select a maximum bandwidth value based on your business requirements.
IPv4 Address (Alibaba Cloud Gateway)
Specify an IPv4 address to route network traffic from the VPC to the data center.
In this example, 10.0.0.2 is used.
IPv4 Address (Data Center Gateway)
Specify an IPv4 address for the gateway device in the data center to route network traffic from the data center to the VPC.
In this example, 10.0.0.1 is used.
Subnet Mask (IPv4 Address)
Enter the subnet mask of the specified IPv4 addresses.
In this example, 255.255.255.252 is used.
Configure a BGP group for the VBR.
On the Virtual Border Routers (VBRs) page, click the ID of the VBR that you want to manage.
On the details page, click the BGP Groups tab.
On the BGP Groups tab, click Create BGP Group, set the following parameters, and then click OK.
The following table describes only the key parameters. The default values are used for the other parameters. For more information, see Create a BGP group.
Parameter
Description
VBR
Name
Enter a name for the BGP group.
In this example, VBR-BGP is used.
Peer ASN
Enter the ASN of the gateway device in the data center.
In this example, 65530 is used.
Configure a BGP peer for the VBR.
On the VBR details page, click the BGP Peers tab.
On the BGP Peers tab, click Create BGP Peer.
In the Create BGP Peer panel, set the following parameters and click OK.
The following table describes only the key parameters. The default values are used for the other parameters. For more information, see Create a BGP peer.
Parameter
Description
VBR
BGP Group
The BGP group to which you want to add the BGP peer.
In this example, VBR-BGP is selected.
BGP Peer IP Address
The IP address of the BGP peer.
In this example, the IP address 10.0.0.1 is entered. This is the IP address of the interface that the on-premises gateway device uses to connect to the Express Connect circuit.
Configure BGP routing for the on-premises gateway device.
After you configure BGP for the on-premises gateway device, the on-premises gateway device and the VBR can work as BGP peers and enable automatic route learning and advertising. The following configurations are used for reference only. The commands may vary based on the network device vendor. Contact the vendor to obtain the information about specific commands.
router bgp 65530 //Enable BGP and configure the ASN of the data center. 65530 is used in this example. 65530 is used in this example. bgp router-id 10.0.0.1 //Enter the ID of the BGP router. In this example, 10.0.0.1 is used. bgp log-neighbor-changes neighbor 10.0.0.2 remote-as 45104 //Establish a peering connection to the VBR. ! address-family ipv4 network 192.168.0.0 mask 255.255.255.0 //Advertise the CIDR block of the data center. network 192.168.1.0 mask 255.255.255.0 network 192.168.2.0 mask 255.255.255.0 neighbor 10.0.0.2 activate //Activate the BGP peer. exit-address-family !
Step 2: Configure a CEN instance
After you deploy an Express Connect circuit, the data center can connect to Alibaba Cloud through the Express Connect circuit. However, the data center cannot communicate with the VPC. You must attach the VBR and the VPC to a CEN instance to enable communication between the data center and the VPC.
Attach the VPC to the CEN instance.
Log on to the CEN console.
On the Instances page, find the CEN instance that you created and click its ID.
On the tab, find the transit router that you want to manage and click Create Connection in the Actions column.
On the Connection with Peer Network Instance page, set the following parameters and click OK.
Parameter
Description
VPC connection
Network Type
Specify the type of network instance.
In this example, VPC is selected.
Region
Select the region of the network instance.
China (Hangzhou) is selected in this example.
Transit Router
The system automatically displays the transit router in the current region.
Resource Owner ID
Specify whether the network instance belongs to the current Alibaba Cloud account.
In this example, Your Account is selected.
Billing Method
Select a billing method for the VPC connection. Default value: Pay-As-You-Go. For more information about the billing rules for transit routers, see Billing rules.
Attachment Name
Enter a name for the VPC connection.
In this example, VPC-test is used.
Networks
Select a network instance.
In this example, the VPC created in the Preparations section is selected.
vSwitch
Select the vSwitches that are deployed in the zones of the transit router.
If the transit router supports only one zone in the current region, select a vSwitch in the zone.
If the transit router supports multiple zones in the current region, you need to select at least two vSwitches that reside in different zones. When the VPC and transit router communicate, the vSwitches are used to implement zone-disaster recovery.
We recommend that you select a vSwitch in each zone to reduce the network latency and improve network performance because data can be transmitted over a shorter distance.
Make sure that each selected vSwitch has at least one idle IP address. If the VPC does not have a vSwitch in the zone supported by the transit router or the vSwitch does not have an idle IP address, create a new vSwitch in the zone. For more information, see Create and manage a vSwitch.
For more information, see Connect VPCs.
In this example, vSwitch 1 is selected in Zone H and vSwitch 2 is selected in Zone I.
Advanced Settings
Specify whether to enable the advanced features. By default, all advanced features are enabled.
In this example, the default settings are used.
Attach the VBR to the CEN instance.
On the tab, find the transit router in the China (Shanghai) region and click Create Connection in the Actions column.
On the Connection with Peer Network Instance page, configure the following parameters and click OK:
Parameter
Description
VBR
Instance Type
Specify the type of network instance.
In this example, Virtual Border Router (VBR) is selected.
Region
Select the region of the network instance.
In this example, China (Shanghai) is selected.
Transit Router
The system automatically displays the transit router in the current region.
Resource Owner ID
Specify whether the network instance belongs to the current Alibaba Cloud account.
In this example, Your Account is selected.
Attachment Name
Enter a name for the network connection.
In this example, VBR-test is used.
Network Instance
Select a network instance.
In this example, the VBR is selected.
Advanced Configuration
Specify whether to enable the advanced features. By default, all advanced features are enabled.
In this example, the default settings are used.
Purchase a bandwidth plan.
The transit router associated with the VBR and the transit router associated with the VPC are deployed in different regions. By default, the VBR cannot communicate with the VPC in this scenario. To allow the VBR to communicate with the VPC across regions, you need to create an inter-region connection between the transit router in the China (Hangzhou) region and the transit router in the China (Shanghai) region.
You can allocate bandwidth to an inter-region connection from a bandwidth plan or pay for the bandwidth usage of the inter-region connection on a pay-by-data-transfer basis. In this example, a bandwidth plan is used.
Purchase a bandwidth plan to allocate bandwidth for inter-region communication before you create an inter-region connection.
On the Instances page, find the CEN instance that you want to manage and click its ID.
On the details page of the CEN instance, choose and click Purchase Bandwidth Plan(Subscription).
On the buy page, configure the following parameters, click Buy Now, and then complete the payment.
Parameter
Description
CEN ID
Select the CEN instance for which you want to purchase the bandwidth plan.
After you complete the payment, the bandwidth plan is automatically associated with the CEN instance.
In this example, the CEN instance created in the Preparations section is selected.
Area A
Select one of the areas where you want to enable inter-region communication.
Mainland China is selected in this example.
NoteAfter you purchase a bandwidth plan, you cannot change the areas that you selected for the bandwidth plan.
For more information about the regions and areas that support bandwidth plans, see Work with a bandwidth plan.
Area B
Select the other area where you want to enable inter-region communication.
Mainland China is selected in this example.
Billing method
Displays the billing method of the bandwidth plan. The default billing method is Pay by Bandwidth.
For more information about bandwidth plan billing, see Billing rules.
Bandwidth
Select a bandwidth value based on your business requirements. Unit: Mbit/s.
Bandwidth_package_name
Enter a name for the bandwidth plan.
Order time
Select a subscription duration for the bandwidth plan.
You can select Auto-renewal to allow the system to automatically renew the bandwidth plan.
Create an inter-region connection.
On the Instances page, find the CEN instance that you want to manage and click its ID.
Navigate to the tab and click Set Region Connection.
On the Connection with Peer Network Instance page, set the following parameters and click OK.
Parameter
Description
Network type
Inter-region Connection is selected in this example.
Region
Select the region that you want to connect.
China (Hangzhou) is selected in this example.
Transit Router
The system automatically displays the ID of the transit router in the selected region.
Attachment Name
Enter a name for the inter-region connection.
In this example, Cross-Region-test is used.
Peer Region
Select the other region to be connected.
In this example, China (Shanghai) is selected.
Transit Router
The system automatically displays the ID of the transit router in the selected region.
Bandwidth Allocation Mode
The following modes are supported:
Allocate from Bandwidth Plan: Bandwidth resources are allocated from a purchased bandwidth plan.
Pay-By-Data-Transfer: You are charged for data transfer over the inter-region connection.
In this example, Allocate from Bandwidth Plan is selected.
Bandwidth Plan
Select the bandwidth plan that is associated with the CEN instance.
Bandwidth
Specify a bandwidth value for the inter-region connection. Unit: Mbit/s.
Advanced Settings
By default, all advanced features are enabled. In this example, the default setting is used.
Step 3: Create an IPsec-VPN connection
After you complete the preceding steps, the data center can communicate with the VPC through the Express Connect circuit. The following section describes how to create an IPsec-VPN connection.
Log on to the VPN Gateway console.
Create a customer gateway.
Before you create an IPsec-VPN connection, you need to create a customer gateway to provide information about the on-premises gateway device to Alibaba Cloud.
In the left-side navigation pane, choose .
In the top navigation bar, select the region of the customer gateway.
VPN gateways do not support cross-border IPsec-VPN connections. Therefore, you need to follow the nearby access principle and select a region that is closest to your data center when you choose the region in which your customer gateway is deployed. In this example, China (Shanghai) is selected.
For more information about cross-border connections, see What are inter-border connections and intra-border connections?.
On the Customer Gateway page, click Create Customer Gateway.
In the Create Customer Gateway panel, set the following parameters and click OK.
Parameter
Description
Customer Gateway
Name
Enter a name for the customer gateway.
In this example, Customer-Gateway is used.
IP Address
Enter the public IP address of the on-premises gateway device to be connected to Alibaba Cloud.
In this example, 211.XX.XX.68 is used.
ASN
Enter the BGP ASN of the on-premises gateway device.
In this example, 65530 is used.
Create an IPsec-VPN connection.
After you create a customer gateway, you need to create an IPsec-VPN connection from Alibaba Cloud to the on-premises gateway device.
In the left-side navigation pane, choose .
In the top navigation bar, select the region where you want to create the IPsec-VPN connection.
The IPsec-VPN connection and the customer gateway must be created in the same region. In this example, China (Shanghai) is selected.
On the IPsec-VPN connection page, click Create IPsec-VPN Connection.
On the Create IPsec-VPN Connection page, set the parameters for the IPsec-VPN connection, and click OK.
You are charged for using IPsec-VPN connections. For more information, see Billing.
Parameter
Description
IPsec-VPN connection
Name
Enter a name for the IPsec-VPN connection.
In this example, IPsec is used.
Associate Resource
Select the type of network resource to be associated with the IPsec-VPN connection.
CEN is selected in this example.
Gateway Type
Select the type of gateway used by the IPsec-VPN connection.
In this example, Public is selected.
CEN Instance ID
Select a CEN instance.
In this example, the CEN instance created in the Preparations section is selected.
Transit Router
The transit router to be associated with the IPsec-VPN connection.
The system automatically selects the transit router in the region in which the IPsec-VPN connection is created.
Zone
Select the zone in which the IPsec-VPN connection is created. Make sure that the IPsec-VPN connection is created in a zone that supports transit routers.
In this example, Shanghai Zone F is selected.
Customer Gateway
Select the customer gateways to be associated with the IPsec-VPN connection.
In this example, Customer-Gateway is selected.
Routing Mode
Select a routing mode.
In this example, Destination Routing Mode is selected.
Effective Immediately
Specify whether to immediately start IPsec negotiations. Valid values:
Yes: starts negotiations when the configuration is complete.
No: starts connection negotiations when traffic is received.
In this example, Yes is selected.
Pre-Shared Key
Enter a pre-shared key that is used to authenticate the on-premises gateway devices.
The pre-shared key must be 1 to 100 characters in length, and can contain digits, letters, and the following characters:
~`!@#$%^&*()_-+={}[]\|;:',.<>/?.If you do not specify a pre-shared key, the system generates a random 16-bit string as the pre-shared key. After you create an IPsec-VPN connection, you can click Edit to view the pre-shared key that is generated by the system. For more information, see Modify an IPsec-VPN connection.
ImportantThe IPsec-VPN connection and the peer gateway device must use the same pre-shared key. Otherwise, the system cannot establish an IPsec-VPN connection.
In this example, fddsFF123**** is used.
Encryption Configuration
Set encryption configurations, including IKE configurations and IPsec configurations.
In this example, ikev2 is selected for the Version parameter in the IKE Configurations section. The default values are used for other parameters. For more information, see Create and manage an IPsec-VPN connection in single-tunnel mode.
BGP Configuration
Specify whether to enable BGP. By default, BGP is disabled.
In this topic, BGP is enabled.
Tunnel CIDR Block
Enter the CIDR block that is used by the IPsec tunnel.
The CIDR block must fall within 169.254.0.0/16. The subnet mask of the CIDR block must be 30 bits in length.
In this example, 169.254.10.0/30 is used.
Local BGP IP address
Enter a BGP IP address for the IPsec-VPN connection.
This IP address must fall within the CIDR block of the tunnel.
In this example, 169.254.10.1 is used.
Local ASN
Enter the ASN of the IPsec-VPN connection.
In this example, 45104 is used.
Health Check
Specify whether to enable the health check feature. The health check feature is disabled by default.
In this topic, the health check feature is disabled.
After the IPsec-VPN connection is created, the system assigns a public IP address to the IPsec-VPN connection to connect to the data center. You can view the gateway IP address of the IPsec-VPN connection on the details page, as shown in the following figure.
NoteThe system assigns gateway IP addresses to IPsec-VPN connections only after you associate the IPsec-VPN connections with transit routers. When you create an IPsec-VPN connection, if you set Associate Resource to Do Not Associate or VPN Gateway, the system does not assign a gateway IP address to the IPsec-VPN connection.
Download the configuration of the IPsec-VPN connection peer.
On the IPsec Connections page, find the IPsec-VPN connection that you created. In the Actions column, click Download Peer Configuration.
Add VPN configurations and BGP configurations to the on-premises gateway device.
After the IPsec-VPN connection is created, perform the following steps to add the VPN and BGP configurations to the on-premises gateway device. This way, the data center can communicate with Alibaba Cloud over the IPsec-VPN connection.
The following configurations are for reference only. The commands may vary based on the network device vendor. Contact the vendor to obtain the information about specific commands.
Open the command-line interface (CLI) of the gateway device.
Run the following commands to configure an IKEv2 proposal and policy:
crypto ikev2 proposal alicloud encryption aes-cbc-128 //Configure the encryption algorithm. In this example, aes-cbc-128 is used. integrity sha1 //Configure the authentication algorithm. In this example, sha1 is used. group 2 //Configure the DH group. In this example, group 2 is used. exit ! crypto ikev2 policy Pureport_Pol_ikev2 proposal alicloud exit !Run the following command to configure an IKEv2 keyring:
crypto ikev2 keyring alicloud peer alicloud address 47.XX.XX.213 //Specify the public IP address of the gateway on the Alibaba Cloud side of the IPsec-VPN connection. In this example, 47.XX.XX.213 is specified. pre-shared-key fddsFF123**** //Configure the pre-shared key. In this example, fddsFF123**** is used. exit !Run the following command to configure an IKEv2 profile:
crypto ikev2 profile alicloud match identity remote address 47.XX.XX.213 255.255.255.255 //Match the public IP address of the gateway on the Alibaba Cloud side of the IPsec-VPN connection. In this example, 47.XX.XX.213 is matched. identity local address 211.XX.XX.68 //Specify the public IP address of the on-premises gateway device. In this example, 211.XX.XX.68 is used. authentication remote pre-share //Set the authentication mode of the remote side to PSK. authentication local pre-share //Set the authentication mode of the data center to PSK. keyring local alicloud //Invoke the IKEv2 keyring. exit !Run the following command to configure a transform set:
crypto ipsec transform-set TSET esp-aes esp-sha-hmac mode tunnel exit !Run the following command to configure an IPsec profile, and invoke the transform set, Perfect Forward Secrecy (PSF), and the IKEv2 profile:
crypto ipsec profile alicloud set transform-set TSET set pfs group2 set ikev2-profile alicloud exit !Run the following commands to configure the IPsec tunnel:
interface Tunnel100 ip address 169.254.10.2 255.255.255.252 //Specify the IP address of the tunnel on the on-premises gateway device side. In this example, 169.254.10.2 is used. tunnel source GigabitEthernet1 tunnel mode ipsec ipv4 tunnel destination 47.XX.XX.213 //Specify the IP address of the tunnel on the Alibaba Cloud side. In this example, 47.XX.XX.213 is used. tunnel protection ipsec profile alicloud no shutdown exit ! interface GigabitEthernet1 //Configure the IP address of the interface that is used to connect to the VPN gateway. ip address 211.XX.XX.68 255.255.255.0 negotiation auto !Run the following command to configure BGP:
//Add the following configuration to On-premises Gateway Device 3: router bgp 65530 neighbor 169.254.10.1 remote-as 45104 //Configure the ASN of the BGP peer. In this example, the BGP ASN of the IPsec-VPN connection is used, which is 45104. neighbor 169.254.10.1 ebgp-multihop 10 //Set the eBGP hop-count to 10. ! address-family ipv4 neighbor 169.254.10.1 activate //Activate the BGP peer. exit-address-family !
Step 4: Test the network connectivity
After you complete the preceding steps, the data center can communicate with the VPC through the IPsec-VPN connection or the Express Connect circuit. When the Express Connect circuit and IPsec-VPN connection are working as expected, all traffic between the data center and the VPC is forwarded through the Express Connect circuit. When the Express Connect circuit is not working as expected, the IPsec-VPN connection takes over. The following section describes how to test the network connectivity and whether active/standby connections are established.
Test the network connectivity.
Log on to the ECS instance in the VPC. For more information, see Guidelines on ECS instance connection.
Run the ping command on the ECS instance to access a client in the data center.
ping <IP address of the client in the data center>If the ECS instance receives echo reply messages, the data center can communicate with the VPC.
Test whether active/standby connections are established.
Continuously send requests from a client in the data center to an ECS instance in the VPC or use iPerf3 to send requests from the client to the ECS instance. For more information about how to install and use Iperf3, see Test the performance of an Express Connect circuit.
Log on to the Alibaba Cloud Management Console, and check the monitoring data of the IPsec-VPN connections.
In error-free scenarios, no traffic data is displayed because the Express Connect circuit serves as the active connection.
You can perform the following steps to go to the details page of the IPsec-VPN connection.
Log on to the VPN Gateway console.
In the top navigation bar, select the region in which the IPsec-VPN connection is created.
In the left-side navigation pane, choose .
On the IPsec Connections page, find the IPsec-VPN connection and click its ID.
Go to the details page of the IPsec-VPN connection and view the traffic monitoring data on the Monitor tab.
Interrupt the connection over the Express Connect circuit.
You can disable the interface connected to the Express Connect circuit on the on-premises gateway device to perform a switchover. For more information about how to disable the interface, see the manuals of your on-premises gateway device.
Log on to the VPN Gateway console and check the traffic data on the details page of the IPsec-VPN connection.
In error-free scenarios, the IPsec-VPN connection takes over after the Express Connect circuit is down. Therefore, you can view traffic data.
Routing configuration
In this topic, the default routing configuration is used to create the IPsec-VPN connection, VPC connection, VBR connection, and inter-region connection. When the default routing configuration is used, CEN automatically learns and distributes routes to enable the data center to communicate with the VPC. The following sections describe the default routing configuration.
IPsec-VPN connection
If you associate an IPsec-VPN connection with a transit router when you create the IPsec-VPN connection, the system automatically applies the following routing configuration to the IPsec-VPN connection:
The IPsec-VPN connection is associated with the default route table of the transit router. The transit router forwards traffic from the IPsec-VPN connection based on the default route table.
The destination-based routes that you configure for the IPsec-VPN connection and the routes learned from the data center through the IPsec-VPN connection by using BGP dynamic routing are automatically propagated to the default route table of the transit router.
The transit router automatically propagates the routes in the default route table to the BGP route table associated with the IPsec-VPN connection.
The routes learned from the VPC through the IPsec-VPN connection by using BGP dynamic routing are automatically propagated to the data center.
VPC
If you use the default routing configuration (with all advanced features enabled) when you create a VPC connection, the system automatically applies the following routing configuration to the VPC:
Associate with Default Route Table of Transit Router
After this feature is enabled, the VPC connection is automatically associated with the default route table of the transit router. The transit router forwards the traffic of the VPC based on the default route table.
Propagate System Routes to Default Route Table of Transit Router
After this feature is enabled, the system routes of the VPC are advertised to the default route table of the transit router. This way, the VPC can communicate with other network instances that are connected to the transit router.
Automatically Create Route That Points to Transit Router and Adds to All Route Tables of Current VPC
After this feature is enabled, the system automatically adds the following three routes to all route tables of the VPC: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The routes point to the VPC connection.
VBR
If you use the default routing configuration (with all advanced features enabled) when you create a VBR connection, the system automatically applies the following routing configuration to the VBR:
Associate with Default Route Table of Transit Router
After this feature is enabled, the VBR connection is automatically associated with the default route table of the transit router. The transit router forwards the traffic of the VBR based on the default route table.
Propagate System Routes to Default Route Table of Transit Router
After this feature is enabled, the system routes of the VBR are automatically advertised to the default route table of the transit router.
Propagate Routes to VBR
After this feature is enabled, the system automatically advertises the routes in the route table that is associated with the VBR connection to the VBR.
Inter-region connections
If you use the default routing configuration (with all advanced features enabled) when you create an inter-region connection, the system automatically applies the following routing configuration to the inter-region connection:
Associate with Default Route Table of Transit Router
After this feature is enabled, the inter-region connection is automatically associated with the default route table of the transit router. The transit router uses the default route table to forward network traffic across regions.
Propagate System Routes to Default Route Table of Transit Router
After this feature is enabled, the inter-region connection advertises system routes to the default route table of the transit router.
Automatically Advertise Routes to Peer Region
After this feature is enabled, the routes of the transit router deployed in the current region are automatically advertised to the route table of the peer transit router. The routes are used for cross-region communication between network instances.
View routes
You can check routes in the console.
For more information about routes of transit routers, see View routes of an Enterprise Edition transit router.
For more information about routes of VPCs, see Create and manage a route table.
For more information about routes of VBRs, perform the following steps:
Log on to the Express Connect console.
In the left-side navigation pane, click Virtual Border Routers (VBRs).
In the top navigation bar, select the region where the VBR is deployed.
On the Virtual Border Routers (VBRs) page, click the ID of the VBR that you want to manage.
On the details page of the VBR, view the custom routes, BGP routes, and CEN routes of the VBR on the Routes tab.
To view the routes of an IPsec-VPN connection, go to the details page of the IPsec-VPN connection:
Log on to the VPN Gateway console.
In the top navigation bar, select the region in which the IPsec-VPN connection is created.
In the left-side navigation pane, choose .
On the IPsec Connections page, click the ID of the IPsec-VPN connection that you want to manage.
Go to the details page of the IPsec-VPN connection and view the route information on the BGP Route Table tab.