Virtual Private Cloud:Examples of VPC peering connections

Scenarios

Use VPC peering connections to enable communication among multiple VPCs

You can create VPC peering connections to connect two or more VPCs. You can also create a VPC peering connection between VPCs within different Alibaba Cloud accounts. This way, VPCs can communicate with each other and share resources.

Procedure

1. Create VPCs that you want to connect. For more information, see Create a VPC and vSwitches.

2. Create a VPC peering connection. For more information, see Create and manage a VPC peering connection.

3. Configure routes. For more information, see Configure routes.

Communication between two VPCs

As shown in the following figure, a peering connection pcc-aaabbb is created between VPC A and VPC B. The two VPCs can communicate with each other and share resources.

When both VPC A and VPC B are assigned an IPv6 CIDR block, you can add IPv4 or IPv6 routes of the peer VPC to the route table of each VPC. You can select IPv4 or IPv6 based on your business requirements.

If VPC A and VPC B use the same CIDR block, but the CIDR blocks of the vSwitches in VPC A and VPC B do not overlap, you can add vSwitch CIDR blocks of the peer VPC as the destination address to create peering connections.

Communication among three VPCs

As shown in the following figure, peering connections are established between VPC A and VPC B, between VPC B and VPC C, and between VPC A and VPC C. Each VPC can communicate with the other two VPCs and share resources.

If both VPC A and VPC B are assigned an IPv6 CIDR block, but VPC C is not assigned an IPv6 CIDR, the route tables of the VPCs are configured as described in the following table. VPC A and VPC B can communicate with each other over a peering connection in an IPv6 environment. VPC C cannot communicate with VPC A or VPC B over IPv6.

Communication among more than three VPCs

As shown in the following figure, peering connections are established among VPC A, VPC B, VPC C, VPC D, and VPC E. Each VPC can communicate with the other VPCs and share resources. In this scenario, five VPCs need to communicate with each other.

As shown in the preceding figure, a peering connection is established between each two of the five VPCs. The number of VPC peering connections is N × (N-1)/2. When N is 5, a total of 10 peering connections are established. Routes that point to each VPC peering connection are configured for each VPC. This way, each VPC can communicate with the other VPCs. Each VPC is assigned an IPv6 CIDR block. The following table describes how routes are configured.

Use VPC peering connections to enable communication between multiple VPCs and a central VPC

Procedure

1. Create VPCs that you want to connect. For more information, see Create a VPC and vSwitches.

2. Create a VPC peering connection. For more information, see Create and manage a VPC peering connection.

3. Configure routes. For more information, see Configure routes.

The preceding figure shows that an enterprise has four branches and one central department, and services are deployed in the central department. The enterprise wants to allow each branch to access the services in the central department but to be independent of each other. You can create VPC peering connections and configure routes that point to the VPC peering connections for the branch VPCs, as shown in the preceding figure. This way, each branch can access the services in the central department but cannot communicate with each other. The following table describes how routes are configured.

Use VPC peering connections and transit routers to enable communication among multiple VPCs

The following table describes the differences between VPC peering connections and transit routers.

If you want to create VPC peering connections for a large number of VPCs, the configuration becomes more complex because of the connection mode of VPC peering connections and the requirements for point-to-point route configuration. VPC peering connections are not suitable for scenarios in which a large number of VPCs must be fully connected. However, VPC peering connections support low latency and are free of charge if the requester and accepter VPCs are in the same region.

The hub-spoke connection mode of transit routers allows you to connect VPCs to transit routers over VPC connections. Then, the transit routers automatically synchronize the routes of the VPCs. Transit routers require simple configurations and support various routing policies and quality of service (QoS) mechanisms. This helps you build complex networks and implement access control. However, transit routers support limited bandwidth and charge data processing fees. Compared with VPC peering connections, transit routers require a higher cost.

You cannot use only VPC peering connections or only transit routers to build complex networks that require both high bandwidth and cost-effectiveness. You can use VPC peering connections together with transit routers to meet your requirements.

Procedure

1. Create a CEN instance and a transit router in each region. For more information, see Create a CEN instance and Create a transit router.

2. Connect the VPCs to the transit router in the region. For more information, see Create a VPC connection.

3. Create an inter-region VPC peering connection. For more information, see Create a VPC peering connection.

4. Configure routes. For more information, see Configure routes.