After a client establishes an SSL-VPN connection to a VPC, it can access resources only in that VPC by default. To allow the client to access resources in other VPCs, first interconnect the VPCs using CEN or a VPC peering connection. Then, add routes in the relevant products to enable access. This allows the client to access resources in other VPCs, such as VPCs in the same region, across different regions, or under different accounts.
Overview
A client's ability to access resources across VPCs—for example, in other VPCs in the same region, across different regions, or under different accounts—depends on the VPC interconnection method. Both CEN and VPC peering connections support these interconnection scenarios. After the VPCs are interconnected, add the CIDR blocks of the destination VPCs to the SSL server and add routes to the client in the relevant products. This lets the client access resources in the interconnected VPCs through the SSL-VPN connection.
For more information about the differences between CEN and VPC peering connections, see VPC Interconnection.
CEN | VPC peering connection |
 |  |
Example
This topic uses the scenario shown in the following figure as an example. A client has established an SSL-VPN connection to VPC1 and can access resources in VPC1. Due to business requirements, remote employees also need to access resources in VPC2. First, interconnect VPC1 and VPC2 using CEN or a VPC peering connection. Then, add routes to the SSL server and to VPC1 or VPC2. This allows the client to access resources in VPC2 through the SSL-VPN connection.
Prerequisites
You have established an SSL-VPN connection from the client to VPC1, which allows the client to access resources in VPC1. For more information, see Connect a PC or an Android client to a VPC by using an SSL-VPN connection.
On the details page of the SSL server, view the configured client CIDR block and client virtual address. You will need this information for later configuration and connectivity tests.
ImportantEnsure the client CIDR block does not overlap with the CIDR blocks of VPC1 and VPC2. The CIDR blocks of VPC1 and VPC2 must also not overlap. If an overlap exists, you must modify the client CIDR block. This operation interrupts the SSL-VPN connection, and the client must reconnect.
Procedure
This topic describes how to configure cross-VPC communication using CEN and a VPC peering connection. You can choose either method.
Step 1: Interconnect the VPCs
CEN
This section describes how to use CEN to interconnect VPCs in different regions under the same account. If you want to use CEN for other scenarios, such as interconnecting VPCs under different accounts, see CEN Quick Start.
When you create the CEN instance, select Create CEN Only, specify a name for the CEN instance, and keep the default values for other parameters.
Create a transit router instance in the China (Hangzhou) region and another in the China (Shanghai) region. Use the default values for all other parameters.
Create VPC connections.
Connect VPC1 to the transit router in the China (Hangzhou) region and VPC2 to the transit router in the China (Shanghai) region.
Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
On the tab, find a transit router instance and click Create Connection in the Actions column.
On the Connection with Peer Network Instance page, connect VPC1 and VPC2 to their respective transit routers with the following settings.
Parameter
VPC1
VPC2
Network Type
Select Virtual Private Cloud (VPC).
Select Virtual Private Cloud (VPC).
Region
Select China (Hangzhou).
Select China (Shanghai).
Account
Keep the default value: Your Account.
Attachment Name
Enter VPC1-Attachment.
Enter VPC2-Attachment.
Networks
Select VPC1.
Select VPC2.
vSwitch
Select vSwitch instances in zones that the transit router supports.
In a region that supports multiple zones, you must select at least one vSwitch instance in each of two different zones. This setup provides zone-level disaster recovery for traffic between the VPC and the transit router. If you do not have enough vSwitches, you can create them as needed.
Advanced Settings
Keep the default settings, which enable all advanced options.
NoteIf the VPC route table already contains a route entry with a destination of 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, the system cannot automatically add another route entry with the same destination. You must manually add a route entry in the VPC route table that points to the VPC connection to enable communication between the VPC and the transit router.
You can click Networks next to Check Route to check whether such routes exist in the network instance.
Create an inter-region connection.
Because VPC1 and VPC2 are in different regions, you must create an inter-region connection between the transit routers in the China (Hangzhou) and China (Shanghai) regions.
On the tab, find a transit router instance and click Create Connection in the Actions column.
On the Connection with Peer Network Instance page, create the inter-region connection with the following settings.
Parameter
Description
Network Type
Select Inter-region Connection.
Region
Select China (Hangzhou).
Peer region
Select China (Shanghai).
Bandwidth Allocation Mode
Select Pay-By-Data-Transfer.
NoteIn Pay-By-Data-Transfer mode, data transfer fees for inter-region connections are billed by CDT.
Bandwidth
Enter a bandwidth value for the inter-region connection in Mbit/s.
Advanced Settings
Keep the default settings, which enable all advanced options.
VPC peering connection
This section describes how to use a VPC peering connection to interconnect VPCs in different regions under the same account. If you want to use a VPC peering connection for other scenarios, such as interconnecting VPCs under different accounts, see Use a VPC peering connection to enable private communication between VPCs.
Create a VPC peering connection.
Log on to the VPC Peering Connection console and select the region of the requester VPC from the top navigation bar.
In this example, VPC1 is the requester VPC. Select the China (Hangzhou) region.
If this is your first time using a VPC peering connection, on the VpcPeer page, click Activate CDT, and then click Activate in the dialog box.
On the VpcPeer page, click Create VPC Peering Connection and configure the parameters.
Configure routes for the VPC peering connection.
On the VpcPeer page, find the VPC peering connection that you created. In the Requester VPC column, click Configure route to add a route entry to VPC1 that points to VPC2. This allows the client to access VPC2 through VPC1.
(Optional) In the Accepter VPC column, click Configure route to add a route entry to VPC2 that points to VPC1.
After you complete this step, VPC1 and VPC2 can communicate with each other over their private networks. If you do not require private communication between VPC1 and VPC2, you can skip this step.
Step 2: Add the destination CIDR block
Add the CIDR block of VPC2 to the SSL server. The VPN gateway allows the client to access resources in that CIDR block only after you add it.
If the client needs to access resources in multiple interconnected VPCs, you must add the CIDR blocks of all these VPCs to the SSL server.
Log on to the VPN Gateway console.
In the left-side navigation pane, choose Network Interconnection > VPN > SSL Servers.
In the top navigation bar, select the region of the SSL server.
On the SSL Servers page, find the target SSL server and click Edit in the Actions column.
In the Modify SSL Server panel, click Add Local CIDR Block, enter the CIDR block of VPC2, and then click OK.
Step 3: Configure the client route
CEN
Advertise the route from VPC1 to the client to CEN. This allows VPC2 to communicate with the client through CEN.
Log on to the VPC console.
In the top navigation bar, select the region of VPC1.
In the left-side navigation pane, click Route Tables.
On the Route Tables page, find the route table of VPC1 and click its ID.
On the tab, find the route that points to the client, and click Advertise in the Route Advertisement Status column.
VPC peering connection
Log on to the VPC Peering Connection console. On the VpcPeer page, find the VPC peering connection that you created. In the Accepter VPC column, click Configure route to add a route entry for VPC2 that points to the client.
If the client needs to access resources in multiple interconnected VPCs, you must add a route to the client in the route table of each destination VPC.
Step 4: Test connectivity
After you complete these steps, the client and resources in VPC2 can communicate with each other.
Open a command-line interface on the client.
Run the
ifconfigcommand to view the network interface of the established SSL-VPN connection.Run the
ping <ECS IP address> -I <SSL-VPN tunnel interface>command to ping the ECS2 instance from the SSL-VPN tunnel interface. If you receive reply packets, this indicates that the client can access resources in VPC2.NoteBefore you run the ping command, ensure that the security group rules of ECS2 and the access control rules on the client allow ICMP traffic.
Log on to the ECS2 instance in VPC2 and run the
ping <client virtual address>command to ping the client. If you receive reply packets, this indicates that ECS2 can also access the client.
FAQ
CEN connectivity test failure
When you create VPC and inter-region connections with all Advanced Settings enabled, the transit router automatically propagates and learns routes. However, if you did not enable all Advanced Settings, added custom route entries, or have route conflicts in your environment, the transit router might fail to learn routes or create route entries. This can result in connectivity issues. Log on to the relevant product consoles to check the routes of each instance in your VPC interconnection scenario. Ensure each instance has routes to the interconnected VPCs and the client. If any routes are missing, add them manually. For more information, see Add a custom route entry to an Enterprise Edition transit router and Add a custom route entry.