Cloud Enterprise Network:Allow only specified VPCs to communicate with each other

Deny-all-then-allow-specific pattern

This approach works like a firewall rule set:

1. Deny all -- Create low-priority routing policies (priority 100) on each transit router to reject all VPC-bound routes. This blocks communication between all attached VPCs.

2. Allow specific pairs -- Create higher-priority routing policies (priority 50) that allow routes between specific VPC pairs. Because these policies have a lower priority value (higher precedence), they override the deny-all policies for the specified VPCs.

To allow additional VPC pairs to communicate later, add more high-priority allow policies without modifying the existing deny-all policies.

Scenario

In this example, three VPCs are attached to the same CEN instance:

• VPC1 and VPC2 are in the China (Hong Kong) region.

• VPC3 is in the Germany (Frankfurt) region.

Goal: Allow only VPC1 and VPC3 to communicate. Block all other VPC-to-VPC communication, including VPC1-VPC2 and VPC2-VPC3.

Network topology

Prerequisites

Before you begin, make sure that you have:

• A CEN instance. For more information, see CEN instances

• Network instances that need to communicate attached to the same CEN instance. For more information, see Manage network instance connections

• A bandwidth plan with inter-region bandwidth allocated. For more information, see Use bandwidth plans and Manage inter-region connections

Network details

Step 1: Create deny-all routing policies

Create two routing policies -- one on each regional transit router -- to block all VPC-bound routes. Both policies use the same configuration but apply to different regions.

To add a routing policy:

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance.

3. On the instance details page, click the ID of the transit router in the target region.

4. On the transit router details page, click the Route Table tab, and then click Routing Policies.

5. On the Routing Policies tab, click Add Routing Policy.

Verify the deny-all policies

After you add both policies, click the Network Routes tab to confirm that VPC1, VPC2, and VPC3 all reject routes from the transit routers. The following screenshot shows VPC1 rejecting routes from the transit routers in the China (Hong Kong) and Germany (Frankfurt) regions.

Step 2: Create allow policies for VPC1 and VPC3

To enable bidirectional communication between VPC1 and VPC3, create two allow policies -- one on each regional transit router. These policies have a higher priority (lower value) than the deny-all policies, so they take precedence for the specified VPC pair.

Allow VPC1 to receive routes from VPC3

Navigate to the routing policies page for the China (Hong Kong) transit router. Click Add Routing Policy and configure the following settings:

Parameter	Value
Routing Policy Priority	50
Description	Allow VPC1 to accept routes from VPC3
Region	China (Hong Kong)
Policy Direction	Egress Regional Gateway
Match Conditions	Source Region: Germany (Frankfurt)
	Source Instance ID List: ID of VPC3
	Destination Instance ID List: ID of VPC1
Action Policy	Allow

After you add this policy, click the Network Routes tab to confirm that VPC1 now accepts routes from VPC3.

Allow VPC3 to receive routes from VPC1

Navigate to the routing policies page for the Germany (Frankfurt) transit router. Click Add Routing Policy and configure the following settings:

Parameter	Value
Routing Policy Priority	50
Description	Allow VPC3 to accept routes from VPC1
Region	Germany (Frankfurt)
Policy Direction	Egress Regional Gateway
Match Conditions	Source Region: China (Hong Kong)
	Source Instance ID List: ID of VPC1
	Destination Instance ID List: ID of VPC3
Action Policy	Allow

After you add this policy, click the Network Routes tab to confirm that VPC3 now accepts routes from VPC1.

Routing policy summary

The following table lists all routing policies created in this example:

Step 3: Test connectivity

Log on to the ECS instances and run ping commands to verify the routing policies work as expected.

Troubleshooting