When your organization requires that desktop traffic stays on a private network — for example, to meet compliance requirements or to reach internal resources — connect Alibaba Cloud Workspace clients to cloud computers over a virtual private cloud (VPC) instead of the Internet. This topic explains how VPC-based access works and helps you choose the right connectivity solution.
How it works
Every cloud computer connection uses two independent links:
| Link | Purpose | Network path |
|---|---|---|
| Management link | Handles authentication, session control, and desktop management | Runs through the management VPC, fully managed by Alibaba Cloud |
| Data link | Carries desktop traffic: video, input, and audio | Runs through the office network VPC |
For VPC-based access, both links require valid routes between your on-premises network and their respective VPCs. If either link lacks a route, the connection fails.
Connection methods
The Elastic Desktop Service (EDS) Enterprise console lets you set the connection method per cloud computer. The method controls which network paths are accepted.
| Connection method | Allowed access paths |
|---|---|
| Internet | Internet only |
| VPC | Enterprise VPC only |
| Internet and VPC | Internet or VPC |
Use VPC when all clients connect through a private network. Use Internet and VPC when you need to support both access paths at the same time.
Network architecture
To connect your on-premises network to the office network VPC of a cloud computer, attach both networks to a Cloud Enterprise Network (CEN) instance. CEN enables private connections between network instances — VPCs, virtual border routers (VBRs), and cloud connect networks (CCNs) — so traffic flows between on-premises and cloud resources without traversing the Internet.
The architecture includes the following components:
| Component | Role in VPC-based access |
|---|---|
| CEN | The backbone of the hybrid cloud connection. CEN attaches network instances (VPCs, VBRs, CCNs) and enables routing between them. For more information, see What is CEN? or Combine multiple connection methods to build an enterprise-class hybrid cloud. |
| Management VPC | Hosts management components that handle session control and desktop operations. Managed by Alibaba Cloud — no configuration required from you. |
| Office network VPC (secure office network) | A dedicated VPC assigned specific CIDR blocks for desktop traffic. This is the VPC your on-premises network must reach to carry the data link. |
| Express Connect | Connects an on-premises data center to Alibaba Cloud using an Express Connect circuit. One end connects to the data center gateways; the other connects to a VBR. When the VBR and the office network VPC are both attached to CEN, the data center can reach the VPC over a private, high-speed link. For more information, see What is Express Connect?. |
| Smart Access Gateway (SAG) | An SD-WAN service for connecting branch offices and remote sites. SAG works with CCN to route traffic into CEN, making it a good fit for distributed teams and software-only deployments. For more information, see What is SAG?. |
| VPN Gateway | Creates encrypted tunnels between an on-premises network and an Alibaba Cloud VPC. Because VPN Gateway requires a server endpoint in the cloud, a user VPC is needed to host that server. For more information, see What is VPN Gateway?. |
Choose a connectivity solution
Select the solution that matches your infrastructure and team structure.
| Solution | Best for | Guide |
|---|---|---|
| SAG App | Individual users or remote workers who need software-only access without hardware. Install the SAG App on a computer or mobile phone to connect over CCN. | Access cloud computers by using the SAG App over VPCs |
| VPN Gateway (IPsec-VPN) | Site-to-site connectivity between a data center and a VPC, or between two VPCs. Use this when you already have a VPN-capable device at the data center. | Access cloud computers by using IPsec-VPN over VPCs |
| VPN Gateway (SSL-VPN) | Client-to-site connectivity for individual Alibaba Cloud Workspace clients that need access to applications and services deployed in a VPC. | Access cloud computers by using SSL-VPN over VPCs |
| Express Connect | High-throughput, low-latency connectivity for data centers with dedicated physical circuits. Combine an Express Connect circuit with an IPsec-VPN connection to configure active/standby links for redundancy. | Access cloud computers by using Express Connect circuits over VPCs |