Cloud Enterprise Network:How transit routers work

Connect network instances

You can connect the following network instances to an Enterprise Edition transit router:

• One or more virtual private clouds (VPCs)

  • In regions where Enterprise Edition transit routers are available in only one zone, such as China (Nanjing - Local Region), make sure that the VPC to be connected has at least one vSwitch in the zone and that the vSwitch has at least one available IP address. When you connect the VPC to the Enterprise Edition transit router, an elastic network interface (ENI) is created in the vSwitch. The ENI occupies one IP address in the vSwitch and forwards network traffic between the VPC and Enterprise Edition transit router.

  • In regions where Enterprise Edition transit routers are available in more than one zone, such as China (Hangzhou), make sure that the VPC to be connected has at least two vSwitches. The vSwitches need to be located in different zones, with each having an available IP address. When you connect the VPC to the Enterprise Edition transit router, an ENI is created in each of the vSwitches. Each ENI occupies one IP address in the vSwitch and forwards network traffic between the VPC and Enterprise Edition transit router. The two vSwitches support zone-disaster recovery to ensure uninterrupted data transmission between the VPC and the transit router.

    Note

    • For information about the regions and zones that support Enterprise Edition transit routers, see What is CEN?.

    • If your Enterprise Edition transit router is deployed in a region that supports multiple zones, we recommend that you create a vSwitch in each of the zones for VPC connections. Make sure that each vSwitch has at least one idle IP address. This way, the network latency is reduced and the network performance is improved due to shorter data transmission distance. For more information, see VPC connection routing principles.

• Create an ECR connection

• IPsec-VPN connections

• Transit router instances

• Create a VBR connection

Routing

• Route table

  After network instances are connected to an Enterprise Edition transit router, routes of the network instances are stored in route tables. The Enterprise Edition transit router forwards traffic of the network instances based on the routes in the route table.

  Each Enterprise Edition transit router has a default route table. You can also create custom route tables for Enterprise Edition transit routers. Default route tables are isolated from custom route tables for access control.

• Associated forwarding

  Associated forwarding controls how network traffic is forwarded. An Enterprise Edition transit router can forward network traffic for a network instance by querying routes only after the network instance connection is associated with the route table.

  Each network instance connection can have an associated forwarding correlation with the route tables of only one Enterprise Edition transit router.

• Route learning

  Route learning controls how a network instance advertises routes. The routes of a network instance can be advertised to an Enterprise Edition transit router only after you enable route learning between the network instance connection and the route tables of the transit router.

  You can enable route learning between the network instance connection and the route tables of one or more Enterprise Edition transit routers. Then, routes can be advertised from the network instance to the route tables.

• Custom route entries

  You can add custom routes to the route tables of an Enterprise Edition transit router to manage traffic forwarding.

• Default route behavior

  After a network instance is connected to an Enterprise Edition transit router, no routes are advertised to the network instance by default. You can enable route synchronization to turn on the feature. For more information, see Route synchronization.

• Click to see more routing control features

  • Prefix list

    The route tables of Enterprise Edition transit routers can be associated with prefix lists. After association, the system automatically adds the routes that point to the CIDR blocks in the prefix list to the route table of the transit router. This reduces your workload.

  • Routing policy

    You can configure routing policies to control route advertisement for the route tables of an Enterprise Edition transit router. You can add a routing policy to specify whether to advertise the routes in transit routers to network instances or other transit routers. You can modify routing policies to adjust the attributes of routes.

    When you add a routing policy, you must specify a route table of an Enterprise Edition transit router. The routing policy is associated with the specified route table and is used to filter and modify the routes in the route table.

    If a VBR or an IPsec-VPN connection is connected to an Enterprise Edition transit router, the system automatically adds a route whose priority is 5000, action is Reject, and direction is Egress Regional Gateway to the route table. This route forbids network communication between the VBR or IPsec-VPN connection and other VBRs or IPsec-VPN connections that are also connected to the transit router. For more information, see Default routing policy.

  • Aggregated routes

    After you connect a VPC to an Enterprise Edition transit router, you can aggregate multiple specific routes in the transit router route table that is associated with the VPC into one aggregate route. After route synchronization is enabled for the VPC, the aggregate route, instead of the specific routes, is automatically advertised to the VPC. Route aggregation reduces the number of routes and accelerates route synchronization.

  • Multi-region VBR equal-cost routes

    An Enterprise Edition transit router may learn routes from multiple VBRs. If the routes have the same attributes other than region IDs, network traffic is forwarded based on the region IDs in alphabetical order. If Multi-region Equal-cost Multi-path (ECMP) routing is enabled for VBRs and the routes have the same attributes other than region IDs, those routes are considered equal-cost routes.

Route priority

Traffic that enters into Enterprise Edition transit routers is routed based on the Longest Prefix Match principle. In cases where multiple routes to the same destination CIDR block exist, the routing is determined in the following order of priority:

1. Determine route conflicts.

   Note

   Ensure that you avoid creating primary and secondary routes or ECMP routes with identical destination CIDR blocks between different VPCs or between VPCs and on-premises networks. The Enterprise Edition transit router reports a routing conflict upon receiving new routes with the same destination CIDR block, which results in disconnection between the new and existing networks to prevent disruptions to online operations.

   • When a static or dynamic route that points to a VPC connection already exists, new routes for the same destination are flagged as a routing conflict.

   • When a dynamic route from a VPC instance already exists, new routes for the same destination are flagged as a routing conflict.

   • When a static or dynamic route that is not from VPC instances already exists, new VPC route entries for the same destination are flagged as a routing conflict.

2. For route entries with the same destination CIDR block that do not cause routing conflicts, the route priority will be determined by comparing the following items in order:

   1. Custom route entries and entries of prefix lists have the same priority in the route table. When both are configured, they automatically form ECMP routes.

   2. If all route entries are automatically learned, the priority is determined based on the source resources and listed in descending order: VBR instances or Express Connect Router (ECR) instances > Cloud Connect Network (CCN) instances > IPsec connections (VCO).

   3. If the source resources of the route entries are the same, the BGP AS_PATH attribute is compared. Routes with shorter BGP AS_PATH length are preferred.

   4. If BGP AS_PATH lengths are the same, routes whose source resources are in the same region as the Enterprise Edition transit router take higher precedence over those from different regions.

   5. If the source resources are in the same region, the priority is determined by the route priority defined in routing policies. The smaller the value, the higher the priority.

   6. If the route entries apply no routing policy or the same routing policy, the priority is determined based on the following principles:

      • If the source resources of route entries are located in the same region as the transit router, these entries will automatically form ECMP routes.

      • If the source resources of route entries are located in different region from the transit router, route entries are ranked according to the region ID of their corresponding next-hop transit routers. Entries with alphabetically earlier region IDs are prioritized.

      • Important

        The Enterprise Edition transit router table supports the Multi-region ECMP Routing for VBRs feature. If you enable it, the system will no longer compare the region IDs of next-hop transit routers from VBR instances, as these entries will automatically form ECMP routes.

IPv6 Description

Enterprise Edition transit routers are capable of learning and propagating IPv6 routes as well as forwarding IPv6 traffic. By connecting VPC, ECR, and VBR instances to the transit router, you can enable IPv6 communication for the associated local networks in the same region or across regions.

Network instances supported by IPv6

Limits

• The multicast feature does not support IPv6 network communication.

• IPv6 route entries consume the route table entry quota of the transit routers.

  For example, if the maximum number of route entries for a transit router is 10,000, the combined total of IPv4 and IPv6 entries must be lower than the quota.

• IPv4 and IPv6 traffic and routing behaviors are aligned for all features of transit routers, with the exception of the following scenarios.

• When you select IPv Automatically Create Route That Points to Transit Router and Add to All Route Tables of Current VPC upon creating a VPC connection, the system automatically adds three custom route entries of 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 to all route tables, directing IPv4 traffic to the transit router. However, IPv6 routes are not added automatically.

  To enable IPv6 communication through the transit router for a VPC instance, activate route synchronization after creating a VPC connection, or manually add IPv6 route entries in the VPC route tables. This step is necessary for routing IPv6 traffic to the transit router. For more information, see Use Enterprise Edition transit routers to establish IPv6 communication among VPCs in different regions