Elastic Compute Service:Migrate ECS instances from the classic network to a VPC

Background information

• The classic network type is an early traditional network type supported by Elastic Compute Service (ECS) instances in Alibaba Cloud. In 2014, Alibaba Cloud released the Virtual Private Cloud (VPC) network type. Over several years, the VPC network type increasingly became the default choice for Alibaba Cloud users. Compared with the classic network type, the VPC network type provides a higher level of security from multiple aspects. The VPC network type is suitable for enterprises and organizations that require a high level of data security.

  For information about VPCs and the classic network, see Network types.

• As an increasing number of users successfully migrate business to VPCs and VPC features are continuously improved, Alibaba Cloud gradually reduces the support for the classic network.

  • Starting July 2024, Alibaba Cloud restricts operations related to renewal and purchase of ECS instances of the classic network type. For more information, see EOL notice for Alibaba Cloud ECS instances in the classic network.

  • On February 28, 2025, ECS instances in the classic network are expected to reach the end of life (EOL). We recommend that you migrate ECS instances in the classic network to VPCs by following the procedure in this topic.

Understand the impacts of the classic network-to-VPC migration

Preparations

1. Create snapshots for the disks on the ECS instances to be migrated to back up data.

   For more information, see Create a snapshot.

   Note

   You are charged for the snapshots. For more information, see Snapshots.

2. If an ECS instance that you want to migrate is associated with an ApsaraDB service and requests access to the private IP address of the ApsaraDB service, use one of the following methods to allow the instance to access the ApsaraDB service after the migration.

   Note

   If the ECS instance accesses the ApsaraDB service by using the public IP address of the ApsaraDB service, the access is not affected by the instance migration.

   • Temporarily access the ApsaraDB service in hybrid mode:

     Before you migrate the ECS instance, set the ApsaraDB service to the hybrid access mode to allow simultaneous access from ECS instances in the classic network and VPCs. For more information, see Hybrid access to ApsaraDB services and Configure the hybrid access solution.

   • Perform the following follow-up operations after instance migration:

     After you migrate the ECS instance, migrate the ApsaraDB service to the same VPC to which the ECS instance is migrated. During this process, a 30-second disconnection occurs and you cannot access an ApsaraDB RDS instance until the migration is complete. For more information, see the Migrate an ApsaraDB RDS instance from the classic network to a VPC section of this topic.

3. If an ECS instance that you want to migrate is associated with an ApsaraDB service (such as ApsaraDB RDS) that provides the whitelist feature, you must add the CIDR block of the destination vSwitch to a whitelist of the database service before you migrate the instance.

   For more information, see Configure a whitelist.

4. (Optional) To ensure that services can be rapidly restored after migration, we recommend that you configure application services to run on instance startup and monitor service availability.

5. Disable or uninstall server security software on the ECS instances to be migrated.

   Note

   The device drivers of ECS instances are updated when the instances are migrated. You must disable or uninstall security software such as Safedog, Huweishen, and Yunsuo on the instances before you migrate the instances.

6. Reserve at least 500 MiB of free space on the system disk of each ECS instance that you want to migrate. If less than 500 MiB of free space is available on the system disk of each ECS instance that you want to migrate, virtualization drivers may fail to be installed and the instances may be unable to start.

7. Make sure that the destination vSwitch has sufficient internal IP addresses available. The number of available internal IP addresses must be greater than the number of ECS instances to be migrated.

8. If an ECS instance that you want to migrate has a public IP address and a public bandwidth of 0 Mbit/s, you must increase the public bandwidth to a value more than 0 Mbit/s before you migrate the instance. A public bandwidth of 0 Mbit/s results in the loss of the public IP address after you migrate the instance. For more information, see the Modify the maximum public bandwidth section of the "Overview of instance configuration changes" topic.

Step 1: Create a migration plan

1. Log on to the ECS console.

2. In the left-side navigation pane, choose Maintenance & Monitoring > > Migration Plans.

   

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. Click Create Migration Plan.

5. In the Precautions dialog box, select I have read and understood the precautions and click Create Migration Plan.

   

6. In the Configure Migration Plan step, configure the destination zone and VPC, network properties, and network connectivity settings, and click Next.

   1. In the Destination Zone and VPC section, configure the parameters. The following table describes the parameters.

      

      Parameter	Description
      Plan Name	Enter a name for the migration plan.
      Select a destination zone	Select a destination zone from the drop-down list. The available zones are automatically planned and displayed based on the resource availability. If ECS resources in a zone are sold out, the zone is not displayed. Select one of the available zones from the drop-down list. You can also submit a ticket. Note Only one zone can be specified in each migration plan. If you want to migrate multiple ECS instances to different zones, you must create multiple migration plans.
      Destination VPC or Create a VPC	Select a destination VPC from the drop-down list. The CIDR block of the selected VPC determines whether the internal IP addresses of the ECS instances from the classic network can be retained. If you want to retain the internal IP addresses of the ECS instances, you must select a VPC that is associated with the 10.0.0.0/8 CIDR block. You can select the default option or a VPC that you created. If you have not created VPCs that are associated with the 10.0.0.0/8 CIDR block, select (Default) Automatically create a VPC, CIDR block: 10.0.0.0/8. Then, a VPC that is associated with the 10.0.0.0/8 CIDR block is automatically created. If you already created a VPC that is associated with the 10.0.0.0/8 CIDR block, select the VPC. If you do not need to retain the private IP addresses of the ECS instances, select a VPC that is associated with a CIDR block other than 10.0.0.0/8.

   2. In the Instance Network Properties section, configure the parameters. The following table describes the parameters.

      

      Parameter	Description
      Destination Security Group	Specify destination security groups. Valid values: (Default) Clone Security Groups of Classic Network-type Instances: The security groups of the ECS instances are automatically cloned from the classic network to the destination VPC. The rules of the new security groups (clone security groups) in the VPC are the same as the rules of the original security groups in the classic network. Important If the original security groups in the classic network are referenced by managed security groups or contain rules that reference a managed security group, the original security groups cannot be cloned to the destination VPC. If you set Destination VPC or Create a VPC to (Default) Automatically create a VPC, CIDR block: 10.0.0.0/8, Destination Security Group is automatically set to (Default) Clone Security Groups of Classic Network-type Instances and cannot be modified. Specify Security Groups: Select one or more existing security groups from the drop-down list. Important Improper security group settings affect the connectivity of ECS instances. Make sure that your security group rules meet your connectivity requirements.
      Mac Address Retention Policy	Select the media access control (MAC) address that you want to retain for each ECS instance from the classic network. In the classic network, an ECS instance that is assigned a public IP address has a public MAC address and a private MAC address. In a VPC, each ECS instance has only a private MAC address and can use a NAT device to map the internal IP address of the instance to a public IP address for Internet access. You can select (Default) Private Mac Address or Public Mac Address based on your business requirements. If your business system is associated with a MAC address, retain the MAC address. For example, this situation applies when your software is associated with a MAC address for registration. (Default) Private Mac Address: The private MAC addresses of the ECS instances are retained regardless of whether the instances have public MAC addresses. Public Mac Address: If the ECS instances have public MAC addresses, the public MAC addresses are retained. If the ECS instances do not have public MAC addresses, the private MAC addresses of the instances are retained. If your business system is not associated with a MAC address, select (Default) Private Mac Address or Public Mac Address.

   3. In the Instance Network Connectivity section, configure the parameters. Then, click Next. The following table describes the parameters.

      

      Parameter	Description
      Retain Internal IP Address	Specify whether to retain the internal IP addresses of the ECS instances from the classic network. If you want to retain the internal IP addresses of the ECS instances, you must specify how to create a vSwitch. If you do not want to retain the internal IP addresses of the ECS instances, you must select a vSwitch from the drop-down list. (Default) Yes: retains the internal IP addresses of the ECS instances from the classic network. If you select (Default) Yes, you must configure vSwitch Creation Policy. If you set vSwitch Creation Policy to Automatic, a vSwitch is automatically created and associated with a CIDR block based on the internal IP addresses of the ECS instances. Make sure that the CIDR block corresponding to the internal IP addresses of the ECS instances is not used by other vSwitches. If the CIDR block is used by other vSwitches, the vSwitch cannot be created. Note If you set Destination VPC or Create a VPC to (Default) Automatically create a VPC, CIDR block: 10.0.0.0/8, Retain Internal IP Address is automatically set to (Default) Yes, and vSwitch Creation Policy is automatically set to Automatic and cannot be modified. If you set vSwitch Creation Policy to Manual, you must create a vSwitch in the specified destination zone based on the internal IP addresses of the ECS instances. Note You can set vSwitch Creation Policy to Manual only when you select a user-created VPC that is associated with the 10.0.0.0/8 CIDR block for Destination VPC or Create a VPC. No: does not retain the internal IP addresses of the ECS instances from the classic network. You must select a vSwitch from the drop-down list. Note If you cannot find the vSwitches that you created in the drop-down list, the reason may be that the vSwitches do not reside in the specified destination zone. Create a vSwitch in the destination zone. For more information, see Create and manage a vSwitch.
      Ensure interconnections between the migrated instances and the classic network-type instances	Specify whether to allow mutual access over the internal network between migrated instances and unmigrated instances that are included in the migration plan. Configure this parameter based on the value of Retain Internal IP Address. Retain Internal IP Address set to (Default) Yes: If you do not want to allow mutual access over the internal network between migrated instances and unmigrated instances that are included in the migration plan, select (Default) No. If you want to allow mutual access over the internal network between migrated instances and unmigrated instances that are included in the migration plan, select Yes. Then, select all ECS instances in the classic network that require mutual access over the internal network in the Select Instances step. You can schedule different migration times for the instances to specify the order in which to migrate the instances. Note ECS instances in the classic network that are not included in the migration plan cannot communicate with the ECS instances that are migrated to the specified VPC over the internal network. After this migration plan is created, ECS instances cannot be added to the plan. Retain Internal IP Address set to No: If you do not want to allow mutual access over the internal network between migrated instances and unmigrated instances that are included in the migration plan, proceed to the Select Instances step. If you want to allow mutual access over the internal network between migrated instances and unmigrated instances that are included in the migration plan, configure ClassicLink to link the instances to the specified VPC before you migrate the instances. For more information, see Connect an instance in a classic network to a VPC.

7. In the Select Instances step, select ECS instances and click Next.

   If you set Retain Internal IP Address to (Default) Yes and want to allow mutual access over the internal network between migrated instances and unmigrated instances that are included in the migration plan, you must select all ECS instances in the classic network that require mutual access over the internal network. You can schedule different migration times for the instances to specify the order in which to migrate the instances. After the migration plan is created, you cannot add ECS instances to the plan.

   In the following figure, the section that is labeled ① indicates the instances that you want to migrate in the first batch, and the section that is labeled ② indicates the instances that you want to migrate in subsequent batches.

   

8. In the Scheduled Migration step, specify the migration time for the instances and click Verify.

   The instances are stopped and then started again during the migration process. We recommend that you schedule the migration task for your instances during off-peak hours. A unique migration time can be specified for each instance.

   • To specify a migration time for only a single instance, click Schedule Migration Time in the Actions column corresponding to the instance.

   • To specify a migration time for multiple instances that you want to migrate in a batch, select the instances and click Batch Schedule Migration Time.

   Important

   • For ECS instances that need to remain in the classic network and communicate with the ECS instances that are migrated by this migration plan, specify a later migration time. Before the migration time, you can reevaluate whether to migrate the ECS instances from the classic network.

   • The following limits apply to the migration time that can be specified for each instance:

     • The migration time cannot be earlier than the local time.

     • The migration time cannot be later than the expiration time of the instance.

     After the migration plan is created, the replicas of some disks are checked. The period of time that is required by the check is determined based on the disk size and the number of disks that are queued for the check. The migration starts after the check is complete. Set migration times as prompted.

9. In the Verify dialog box, read the migration considerations and verify whether your migration plan meets the specified requirements.

   • If your migration plan meets the specified requirements, select options and click Confirm and Create.

   • If your migration plan does not meet the requirements, error messages are displayed. You can troubleshoot the errors based on the error messages and modify the relevant parameters to create the migration plan again.

Step 2: Migrate the ECS instances

Step 3: Check the migration results

1. In the left-side navigation pane, choose Instances & Images > Instances.

2. Find the migrated ECS instances and click the ID of each of these instances.

3. On the Instance Details page, check whether the network type of the instance is VPC.

   If the instance is migrated to the specified VPC, the network type of the instance changes to VPC.

4. Check the internal network and business runtime environments.

   Scenario	Migration plan	What to do next
   Migrate all ECS instances from the classic network to a VPC	Set Destination VPC or Create a VPC to (Default) Automatically create a VPC, CIDR block: 10.0.0.0/8. Set Ensure interconnections between the migrated instances and the classic network-type instances to (Default) No.	Check whether your business system runs as expected.
   Migrate some ECS instances to a VPC and retain other ECS instances in the classic network	Set Destination VPC or Create a VPC to (Default) Automatically create a VPC, CIDR block: 10.0.0.0/8. Set Ensure interconnections between the migrated instances and the classic network-type instances to Yes.	Check whether your business system runs as expected.
   Other scenarios	Set Destination VPC or Create a VPC to a VPC that is associated with a CIDR block other than 10.0.0.0/8.	Check network connectivity. In this scenario, Retain Internal IP Address is unsupported. If your business is connected by using internal IP addresses, you must configure new internal IP addresses. Check whether your business system runs as expected.

(Conditionally required) Handle post-migration issues

• If you do not retain the internal IP addresses of ECS instances, but the associated services use domain names that were bound to the original internal IP addresses, modify the /etc/hosts file on the corresponding instances and change the original internal IP addresses to the new internal IP addresses.

• If you have set Retain Internal IP Address to No in the migration plan, remove the internal IP addresses that are no longer used from the whitelists of other cloud services after the migration.

  The cloud services include AparaDB RDS, SLB, and Object Storage Service (OSS).

• If an ECS instance is migrated across zones, its connectivity with other Alibaba Cloud services, such as ApsaraDB RDS, Tair (Redis OSS-compatible), and ApsaraDB for MongoDB, may be affected. Adjust application configurations at the earliest opportunity. For example, you can migrate the corresponding RDS instances to the same zone as the ECS instance to ensure connectivity. For more information, see Migrate an ApsaraDB RDS for MySQL instance across zones.

• If you have not restarted an ECS instance or upgraded its kernel for an extended period of time, issues may occur after the instance is migrated. For example, a file system check (fsck) may be performed, configuration changes may become invalid, or the instance may be unable to start.

• If you have not restarted an ECS instance for an extended period of time or after the kernel is upgraded, the system checks the file systems of the instance and updates the configurations of the instance when the instance is restarted. If your ECS instance cannot be started, submit a ticket at the earliest opportunity to contact Alibaba Cloud.

• If a NAS file system is mounted on an ECS instance, you must replace classic network mount targets with VPC mount targets. For more information, see Replace a classic network mount target with a VPC mount target for a NAS file system.

• If your ECS instance is associated with an ApsaraDB RDS instance, you must perform the following operations to migrate the ApsaraDB RDS instance to the destination VPC of the ECS instance by using the Switch Network Type feature. For more information, see Change the network type of an ApsaraDB RDS for MySQL instance.

  Migrate an ApsaraDB RDS instance from the classic network to a VPC

  1. Obtain the VPC information of the ECS instance that you migrated.

     1. In the left-side navigation pane of the ECS console, choose Instances & Images > Instances.

     2. Click the ID of the ECS instance that you migrated.

     3. On the Instance Details tab, record the VPC ID and vSwitch ID. Then, click the vSwitch ID to obtain information about the zone in which the vSwitch resides.

        Parameter	Example
        VPC ID	vpc-wz9avqy2c3fw8w4******
        vSwitch ID	vsw-wz98loggfq88msu******
        Zone	Shenzhen Zone B

  2. Obtain the network information of the RDS instance in the classic network.

     1. Log on to the ApsaraDB RDS console.

     2. In the left-side navigation pane, click Instances.

     3. In the upper-left corner of the top navigation bar, select the region where the RDS instance resides.

     4. Click the ID of the RDS instance.

     5. View the region and zone of the RDS instance.

        • If the zone of the RDS instance is the same as that of the vSwitch obtained in the previous step, proceed to the next step.

        • If the zone of the RDS instance is different from that of the vSwitch obtained in the previous step, create a vSwitch in the zone of the RDS instance and then proceed to the next step. For information about how to create a vSwitch, see Create and manage a vSwitch.

        Note

        In this example, the vSwitch and the RDS instance both reside in Shenzhen Zone B. You do not need to create a vSwitch.

  3. In the left-side navigation pane of the page that appears, click Database Connection.

  4. Click Switch to VPC.

  5. In the dialog box that appears, select the VPC and vSwitch that you obtained and enable the Reserve Original Classic Network Endpoint feature. Then, click OK.

     Parameter	Description
     Select a VPC	Select the VPC ID that you obtained in Step 1. Example: vpc-wz9avqy2c3fw8w4******.
     Select a vSwitch	Select the vSwitch ID that you obtained in Step 1. Example: vsw-wz98loggfq88msu******. Note If you created a vSwitch because the RDS instance does not reside in the same zone as the vSwitch that you obtained, select the ID of the vSwitch that you created.
     Specify whether to select Retain Classic Network	Clear the option. The classic network endpoint is not retained and changes to a VPC endpoint. Note When you change the network type from classic network to VPC, a transient connection that lasts approximately 30 seconds occurs and ECS instances that reside in the classic network are immediately disconnected from the RDS instance.

  6. Check whether the RDS instance is migrated to the VPC.

     After the RDS instance is migrated, you can click Database Connection in the left-side navigation pane. On the Database Connection page of the RDS instance, the network type changes to VPC and the internal endpoint also changes.

  7. (Conditionally required) If the internal IP address of the ECS instance changes, you must add the CIDR block of the new vSwitch to which the ECS instance connects to the whitelist of the RDS instance.

References

• Switch the network type from classic network to VPC

• Change the network type

• Configure the hybrid access solution