Smart Access Gateway:Connect Microsoft Azure resources to Alibaba Cloud resources through SAG vCPE

Scenario

The following figure shows how to establish network communication between cloud resources deployed on Alibaba Cloud and Azure. An enterprise deployed cloud resources on Azure in the Azure Middle Europe region and on Alibaba Cloud in the China (Hangzhou) region. The enterprise wants to establish network communication between cloud resources deployed on Alibaba Cloud and Azure.

You can deploy the SAG vCPE image on an Azure virtual machine (VM) in an Azure virtual network (VNet). Then, the VM can serve as an SAG vCPE device and can be connected to Alibaba Cloud. After the SAG vCPE device is connected to Alibaba Cloud, resources in the Alibaba Cloud VPC and Azure VNets can communicate with each other through Cloud Connect Network (CCN) and Cloud Enterprise Network (CEN).

Procedure

Step 1: Create an SAG vCPE instance

Create an SAG vCPE instance in the SAG console. Then, you can use the SAG vCPE instance to manage the SAG vCPE device.

1. Log on to the SAG console.
2. On the SAG page, choose Purchase SAG > Create SAG (vCPE).

3. On the Smart Access Gateway-vCPE page, set the following parameters and click Buy Now.

   Parameter	Description
   Area	Select the region in which you want to deploy the SAG vCPE instance. In this example, Germany (Frankfurt) is selected.
   Instance Name	Enter a name for the SAG vCPE instance. The name must be 2 to 128 characters in length, and can contain letters, digits, periods (.), underscores (_), and hyphens (-). It must start with a letter.
   Instance Type	By default, SAG-vCPE is selected.
   Edition	Basic Edition is selected by default.
   Deployment Mode	Select a deployment mode. By default, Active-Active is selected. In Active-Standby mode, one SAG vCPE instance can be associated with two SAG vCPE devices by default. You can deploy two SAG vCPE devices in active-standby mode and connect on-premises networks to Alibaba Cloud. This improves network availability. In this example, only one device is used.
   Peak Bandwidth	Select a maximum bandwidth value for network communication. Unit: Mbit/s.
   Quantity	Specify the number of SAG vCPE instances that you want to create. In this example, 1 is selected.
   Duration	Select a subscription duration.

4. Return to the SAG console. In the top navigation bar, select the region where the SAG vCPE instance is deployed.

5. In the left-side navigation pane, click Smart Access Gateway.

6. On the SAG page, click the ID of the SAG vCPE instance.

7. On the instance details page, click the Device Management tab, view and record the serial number and key of the active SAG vCPE device. The serial number and key are used to associate the SAG vCPE instance with the SAG vCPE device.

Step 2: Deploy the SAG vCPE image

To connect Azure resources to Alibaba Cloud resources, you must create an Azure VM in an Azure VNet and deploy the SAG vCPE image on the Azure VM. After you deploy the SAG vCPE image, the Azure VM can serve as an SAG vCPE device to connect Azure resources to Alibaba Cloud resources.

1. Create an Azure VM in an Azure VNet.

   For more information about how to create an Azure VM, see the relevant documentation provided by Azure. Make sure that the Azure VM meets the following requirements:

   • One of the following operating systems is installed on the Azure VM:

     • 64-bit CentOS, version 7.6 or later (recommended).

     • 64-bit Ubuntu, version 18.04 or 20.04.

       If you use Ubuntu, we recommend that you use version 18.04.

   • The kernel version of the Azure VM is 3.10.0-957.21.3.el7.x86_64 or later.

   • The Azure VM has an independent network interface controller (NIC) that allows the Azure VM to connect to the Internet.

   • The Azure VM allows remote logons.

   • No business system is running on the Azure VM.

   • The Azure VM must have at least one vCPU core and at least 2 GB of memory.

     We recommend that you select a 2-core vCPU and 4 GB memory for the Azure VM. In this case, the bandwidth for encrypted connections in private networks can reach 350 Mbit/s and higher (the packet length in the performance test is 1,024 bytes).

2. Log on to the Azure VM and download the following script to the /root directory. For more information, see relevant documentation provided by Azure.

   Important

   • You can also specify a custom path and download the script to the corresponding directory. In this case, select the custom path when you run the script.

   • After you download the script, do not modify its content or name.

   • If the Azure VM is deployed in the Chinese mainland, run the following commands to download the script:

     wget -O /root/sag_vcpe_v2.3.0_deployment.sh https://sdwan-oss-shanghai.oss-cn-shanghai.aliyuncs.com/vcpe_vm/sag_vcpe_v2.3.0_deployment.sh

   • If the Azure VM is deployed outside the Chinese mainland, run the following commands to download the script:

     wget -O /root/sag_vcpe_v2.3.0_deployment.sh https://sdwan-oss-shanghai.oss-accelerate.aliyuncs.com/vcpe_vm/sag_vcpe_v2.3.0_deployment.sh

3. Run the following command to make the script executable:

   chmod +x /root/sag_vcpe_v2.3.0_deployment.sh

4. Run the script.

   /root/sag_vcpe_v2.3.0_deployment.sh -n sage6nniq3**** -k **** -t azure  -w eth0

   The following table describes the parameters of the script. For more information about the script, see Descriptions of the script parameters.

   Parameter	Description
   -n	The serial number of the SAG vCPE device.
   -k	The key of the SAG vCPE device.
   -t	The service provider of the host on which you want to install the SAG vCPE image. Valid value: aliyun (default): deploys the SAG vCPE image on an Alibaba Cloud Elastic Compute Service (ECS) instance. aws: deploys the SAG vCPE image on an Amazon Elastic Compute Cloud (EC2) instance. azure: deploys the SAG vCPE image on a Microsoft Azure virtual machine (VM). If you want to deploy the SAG vCPE image on an on-premises server, set the value to a string of letters other than aliyun, ens, aws, or azure.
   -w	The name of the network interface controller (NIC) for the WAN port. You can run the ifconfig or ip -br address command to view the NIC name of the host.

5. When you run the script, the system automatically checks whether the deployment environment meets the requirements. If the deployment environment requires more components, the following prompt appears. In this case, enter yes and the system will automatically install the required components.

   

6. If the deployment environment meets the requirements, the system automatically starts to deploy the SAG vCPE image. After the image is deployed, the following prompt appears.

   

7. Query the deployment result.

   After you deploy the SAG vCPE image, run the docker ps command to check whether the following containers are installed on the system:

   If the system contains the vsag-core container and the vsag-manager-base container, the SAG vCPE image is deployed.

Step 3: Configure networks on the Alibaba Cloud side

After the SAG vCPE image is deployed, you must configure networks for the SAG vCPE device in the SAG console to allow the SAG vCPE device to connect to Alibaba Cloud.

1. Select a method to advertise routes to Alibaba Cloud.

   1. Log on to the SAG console.

   2. In the top navigation bar, select the region where the SAG vCPE instance is deployed.

   3. On the Smart Access Gateway page, find the SAG vCPE instance and click Network Configuration in the Actions column.

   4. Choose Network Configuration > Method to Synchronize with On-premises Routes and click Add Static Route.

   5. In the Add Static Route dialog box, enter the private CIDR block of the Azure service and click OK.

      

2. Associate the SAG vCPE instance with a CCN instance.

   CCN is an important component of SAG. SAG connects your on-premises networks to Alibaba Cloud through CCN.

   1. Create a CCN instance. For more information, see Create a CCN instance.

      The SAG vCPE instance and CCN instance must be deployed in the same region.

   2. In the left-side navigation pane, click Smart Access Gateway.

   3. On the Smart Access Gateway page, find the SAG vCPE instance and click Network Configuration in the Actions column.

   4. On the instance details page, choose Network Configuration > Network Instance Details.

   5. In the Associated Instances Under Current Account section, click Attach Network, select a CCN instance, and then click OK.

   6. After you associate the CCN instance, click the Device Management tab. If the VPN Status and Controller Status of the SAG vCPE device are Normal, it indicates that the SAG vCPE device is connected to Alibaba Cloud.

      

3. Create and configure a Cloud Enterprise Network (CEN) instance.

   You must perform the following operations to connect the SAG vCPE instance to a CEN instance and attach the Alibaba Cloud VPC to the CEN instance. Then, the SAG vCPE instance and the Alibaba Cloud VPC can learn routes from each other. The SAG vCPE device can communicate with the resources in the Alibaba Cloud VPC.

   1. In the left-side navigation pane, click CCN.

   2. On the CCN page, find the CCN instance and click Bind CEN Instance in the Actions column.

   3. In the CEN Instance panel, select a CEN instance and click OK.

      You can use one of the following methods to select a CEN instance. Create CEN is selected in this example.

      • Existing CEN: If you have already created a CEN instance, you can select an existing CEN instance from the drop-down list.

      • Create CEN: If you have not created a CEN instance, enter an instance name. The system then creates a CEN instance and automatically associates it with the CCN instance.

        The instance name must be 2 to 100 characters in length, and can contain letters, digits, underscores (_), and hyphens (-). It must start with a letter.

   4. Attach the Alibaba Cloud VPC to the CEN instance. For more information, see Create a VPC connection.

Step 4: Configure networks on the Azure side

To establish communication between Azure resources and Alibaba Cloud resources, you must configure networks on the Azure side. For more information about specific commands or operations, see the relevant documentation provided by Azure.

1. Create a route table in Azure.

   

2. Associate the route table with the subnet in which the Azure service is deployed.

   

3. Add a route that points to Alibaba Cloud to the Azure route table.

   • Address prefix: Enter the private CIDR block in which the Alibaba Cloud service is deployed.

   • Next hop type: Select Virtual appliance.

   • Next hop address: Enter the private IP address of the Azure VM on which the SAG vCPE image is deployed.

   

4. Find the private network interface of the Azure VM on which the SAG vCPE image is deployed, and enable the IP forwarding feature of the network interface.

   

Step 5: Establish network communication

1. Purchase a bandwidth plan.

   1. Log on to the CEN console.

   2. On the Instances page, find the CEN instance that you want to manage and click its ID.

   3. On the details page of the CEN instance, choose Basic Settings > Bandwidth Plans, and click Purchase Bandwidth Plan (Subscription).

   4. On the buy page, set the following parameters, click Buy Now, and then complete the payment.

      Parameter	Description
      Product Type	Select the type of bandwidth plan that you want to purchase. In this example, Cross-border is selected.
      CEN ID	Select the CEN instance for which you want to purchase a bandwidth plan. In this example, the CEN instance created in Step 3 is selected.
      Area A	Select an area where you want to enable inter-region communication. In this example, Mainland China is selected.
      Area B	Select the other area where you want to enable inter-region communication. In this example, Europe is selected.
      Billing Method	The metering method of the bandwidth plan is displayed. By default, Pay-By-Bandwidth is selected.
      Bandwidth	Select a maximum bandwidth value for the bandwidth plan. Unit: Mbit/s.
      Bandwidth Package Name	Enter a name for the bandwidth plan.
      Order time	Select a subscription period for the bandwidth plan. In this example, 1 Month is selected. You can select Auto-renewal to allow the system to automatically renew the bandwidth plan.

2. Create an inter-region connection.

   1. On the Instances page, find the CEN instance that you want to manage and click its ID.

   2. On the details page of the CEN instance, choose Basic Settings > Bandwidth Plans, and click Purchase Bandwidth Plan (Subscription).

   3. On the Connection with Peer Network Instance page, configure the following parameters and click OK.

      Parameter	Description
      Instance Type	Select an instance type. In this example, Cross-region is selected.
      Region	Select one of the regions to be connected. In this example, China (Hangzhou) is selected.
      Transit Router	The ID of the transit router in the selected region is displayed.
      Attachment Name	Enter a name for the inter-region connection.
      Peer Region	Select the other region to be connected. In this example, Germany (Frankfurt) is selected.
      Transit Router	The ID of the transit router in the selected region is displayed.
      Bandwidth Allocation Mode	Inter-region connections support Allocate from Bandwidth Plan and Pay-By-Data-Transfer. In this example, Allocate from Bandwidth Plan is selected.
      Bandwidth Plan	Select the bandwidth plan that is associated with the CEN instance. In this example, the bandwidth plan created in the preceding step is selected.
      Bandwidth	Specify a maximum bandwidth value for the inter-region connection. Unit: Mbit/s.
      Advanced Settings	Use the default settings. All advanced features are enabled.

Step 6: Test network connectivity

After you complete the preceding steps, the Alibaba Cloud VPC resources can communicate with the Azure resources. The following section describes how to test the network connectivity.

1. Log on to an ECS instance in the VPC. For more information, see Connection methods.

2. Run the ping command to ping an Azure VM in the Azure VNet to test whether the Alibaba Cloud VPC is connected to the Azure VNet.

   The following figure shows that the resources in the Alibaba Cloud VPC and Azure VNet can communicate with each other.

References

• What is CEN?

• Introduction to CCN