Cloud Enterprise Network:Create a VPC connection

Use an Enterprise Edition transit router

How a VPC connection works

An Enterprise Edition transit router supports one or more zones in a region. For more information, see Regions and zones that support Enterprise Edition transit routers.

• If an Enterprise Edition transit router is deployed in a region that supports only one zone, for example, China (Nanjing - Local Region), make sure that the VPC has at least one vSwitch in the zone before you create a VPC connection on the Enterprise Edition transit router. The vSwitch must have at least one idle IP address. When you connect the VPC to the Enterprise Edition transit router, the transit router creates an elastic network interface (ENI) on the vSwitch of the VPC. The ENI occupies one IP address on the vSwitch and forwards network traffic between the VPC and the transit router.

• If an Enterprise Edition transit router is deployed in a region that supports multiple zones, for example, China (Shanghai), make sure that the VPC has at least two vSwitches in the zones before you create a VPC connection on the Enterprise Edition transit router. The vSwitches must be deployed in different zones and each vSwitch must have at least one idle IP address. When you connect the VPC to the Enterprise Edition transit router, the transit router creates an ENI in each of the vSwitches. Each ENI occupies one IP address in the vSwitch and forwards network traffic between the VPC and the transit router. The two vSwitches support zone-disaster recovery to ensure uninterrupted data transmission between the VPC and the transit router.

• Note

  • Ensure that an idle IPv6 address exists when you enable the IPv6 function upon creating a VPC connection. The Enterprise Edition transit router occupies an IPv4 address and an IPv6 address in the VPC when creating an ENI.

  • If your Enterprise Edition transit router supports multiple zones, we recommend that you create a vSwitch in each of the zones and make sure that each vSwitch has at least one idle IP address for creating VPC connections. This way, the network latency is reduced and the network performance is improved due to shorter data transmission distance. For more information about how network traffic is forwarded between the VPC and the transit router, see the How routes are selected for a VPC connection section in this topic.

How routes are selected for a VPC connection

After a VPC is connected to an Enterprise Edition transit router, network traffic from the VPC is forwarded over the shortest route to reduce network latency. This section describes how an Enterprise Edition transit router selects routes for a VPC connection.

Route selection is performed three times to send a request from the initiator to the acceptor over a VPC connection.

No.	Description
①	The first routing. When the request is forwarded from the initiator to the Enterprise Edition transit router, it undergoes the first routing process based on the following criteria: After the initiator sends the request, the system queries the route table associated with the vSwitch of the initiator and forwards the request. If the route table contains a custom route whose next hop is the ENI of the transit router (an ENI that is created in the vSwitch of the transit router), the request is routed to the ENI and then enters the transit router through the ENI. If the route table does not contain such a custom route, the request is routed to the ENI of the transit router that is associated with the initiator network connection. If the zone where the initiator vSwitch is located is associated with the transit router, the request is routed to the ENI in that zone and then routed to the Enterprise Edition transit router through the ENI. Click to view the example If the zone where the initiator vSwitch is located is not associated with the transit router, the request is routed to the default ENI that is associated with the initiator network connection (when the VPC connection is created, the transit router randomly selects one ENI as the default ENI) and then routed to the transit router through the ENI. Click to view the example
②	The second routing. When the request is forwarded from the Enterprise Edition transit router to the acceptor network instance, it undergoes a second routing process based on the following criteria: After the Enterprise Edition transit router receives the request, it queries the route table associated with the initiator network connection. The Enterprise Edition transit router finds the next hop and then routes the request to the ENI associated with the acceptor network connection. If the zone where the source ENI is located is associated with the acceptor VPC connection, the request is routed to the Enterprise Edition transit router ENI in that zone and then to the acceptor network instance through the ENI. Click to view the example If the zone where the source ENI is located is not associated with the acceptor VPC connection, the request is routed to the default ENI of the acceptor network connection (when the VPC connection is created, the transit router randomly selects one ENI as the default ENI) and then to the acceptor network instance through the ENI. Click to view the example
③	The third routing. When the request undergoes the third routing process, the system routes it to the acceptor based on the route table associated with the vSwitch that accepts the request. Click to view the example

Prerequisites

• An Enterprise Edition transit router has been created in the region where the VPC resides. For more information, see Create a transit router.

• The VPC has sufficient vSwitches in the zone supported by the Enterprise Edition transit router. Each vSwitch has at least one idle IP address. For more information about how to create a vSwitch, see Create a vSwitch.

  • If the Enterprise Edition transit router is deployed in a region that supports only one zone, for example, China (Nanjing - Local Region), the VPC must have at least one vSwitch in the zone.

  • If the Enterprise Edition transit router is deployed in a region that supports multiple zones, for example, China (Shanghai), the VPC must have at least two vSwitches in the zones. The vSwitches must be in different zones.

• You can connect an Enterprise Edition transit router to a VPC that belongs to either the same account or different accounts. If the VPC and the transit router belong to different Alibaba Cloud accounts, the transit router must acquire the required permissions from the account to which the VPC belongs. For more information, see Acquire permissions to connect to a network instance that belongs to another account.

• To realize IPv6 network communication through the Enterprise Edition transit router, ensure that the IPv6 feature is enabled for the VPC. For more information, see Enable IPv6 for a VPC.

Procedure

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Information > Transit Router tab, find the transit router that you want to manage and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, set the parameters and click OK. The following table outlines the parameters:

   Note

   When you perform this operation, the system automatically creates the service-linked role AliyunServiceRoleForCEN, which allows the transit router to create an ENI in a vSwitch to forward data between the VPC and the transit router. For more information about service-linked roles, see AliyunServiceRoleForCEN.

   Parameter	Description
   Instance Type	Select Virtual Private Cloud (VPC).
   Region	Select the region where the network instance to be connected is located.
   IPv6	Specify whether to enable IPv6 for the VPC connection. This feature is disabled by default. If the VPC instance requires IPv6 communication through the Enterprise Edition transit router, you must enable this feature. Note You can enable IPv6 for existing VPC connections. For more details, see Enable IPv6 for a VPC Connection.
   Transit Router	The system automatically displays the transit routers created in the current region.
   Resource Owner ID	Select the Alibaba Cloud account type to which the network instance belongs. Transit routers support connections to network instances in the same or different accounts: If the network instance and the transit router instance belong to the same Alibaba Cloud account, select Same Account. If they belong to different accounts, select Cross-account, and enter the account ID (primary account) of the network instance.
   Billing Method	The billing method for the transit router is set to Pay-as-you-go by default. For details about the pay-as-you-go billing rules, see Billing Description.
   Attachment Name	Enter a name for the VPC connection.
   Tag	Add tags to the VPC connection. Tag Key: The tag key can be up to 64 characters in length. It cannot be an empty string or start with acs: or aliyun or contain http:// or https://. Tag Value: The tag value can be an empty string with a maximum length of 128 characters. It cannot start with acs: or aliyun or contain http:// or https://. You can add multiple tags to a VPC connection. For more information about tags, see Tags.
   Network Instance	Select the VPC instance to be connected.
   VSwitch	Select vSwitch instances in zones supported by the transit router. If the Enterprise Edition transit router is deployed in a region that supports only one zone, select a vSwitch in the zone. If it is deployed in a region that supports multiple zones, select at least two vSwitches that are in different zones for zone-disaster recovery. This ensures uninterrupted data transmission between the VPC and the transit router. We recommend that you select a vSwitch in each zone to reduce latency and improve network performance because data can be transmitted over a shorter distance.
   Advanced Settings	When you create a VPC connection, the system enables the following features in the advanced settings by default: Associate with Default Route Table of Transit Router When enabled, the VPC connection is automatically associated with the default route table of the transit router. The transit router forwards traffic based on the default route table. Propagate System Routes to Default Route Table of Transit Router After this feature is enabled, the system routes of the VPC are advertised to the default route table of the transit router. This way, the VPC can communicate with other network instances that are connected to the transit router. Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC After this feature is enabled, the system automatically adds the following three routes to all route tables of the VPC: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The next hops of the routes point to the VPC. The routes are used to forward IPv4 traffic from the VPC to the transit router. By default, transit routers do not advertise routes to VPCs. Important If the route table of the VPC already contains routes with destination CIDR blocks 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, the system cannot automatically advertise these routes. You must manually add routes pointing to the VPC connection to enable communication between the VPC and the transit router. You can click Initiate Route Check to check whether the above routes exist in the network instance. If the VPC instance requires IPv6 communication, after creating the VPC connection, you must enable the route synchronization feature for the VPC connection or manually add an IPv6 route entry pointing to the VPC connection in the VPC. Only then can the IPv6 traffic enter the transit router. You can disable these advanced features by clearing the checkboxes. If you want to customize the connectivity of the VPC instance, you can configure associated forwarding and route learning on the transit router. For specific steps, see Route Management.

   After the VPC connection is created, you can view the details about the connection on the Intra-region Connections tab. For more information, see View network instance connections.

Related operations

Use a Basic Edition transit router

The Basic Edition transit router supports connecting VPCs that belong to either the same or different accounts. Before you create a cross-account VPC connection, make sure that you acquire the permissions from the peer VPC account. For more information, see cross-account instance authorization.

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Information > Transit Router tab, find the transit router that you want to manage and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, configure the network instance information as follows, and then click OK To Create.

   Parameter	Description
   Instance Type	Select Virtual Private Cloud (VPC).
   Region	Select the region where the network instance is deployed.
   Transit Router	The transit router instance in the selected region is displayed.
   Resource Owner UID	Select the Alibaba Cloud account type to which the network instance belongs. Transit routers support connections to network instances in the same or different accounts: If the network instance and the transit router instance belong to the same Alibaba Cloud account, select Same Account. If they belong to different accounts, select Cross-account, and enter the account ID (primary account) of the network instance.
   Network Instance	Select the network instance that you want to connect.

   After the VPC connection is created, you can view the information about the VPC connection on the Intra-region Connections tab of the transit router instance product page. For more information, see view network instance connections.