Cloud Enterprise Network：Create a VPC connection

Prerequisites

• An Enterprise Edition transit router is created in the region where the VPC resides. For more information, see Create a transit router.

• The VPC in a zone supported by the Enterprise Edition transit router has sufficient vSwitches. Each vSwitch has at least one idle IP address. For more information about how to create a vSwitch, see Create a vSwitch.

  • If the Enterprise Edition transit router is deployed in a region that supports only one zone, for example, China (Nanjing - Local Region), the VPC must have at least one vSwitch in the zone.

  • If the Enterprise Edition transit router is deployed in a region that supports multiple zones, for example, China (Shanghai), the VPC must have at least two vSwitches in the zones. The vSwitches must be in different zones.

• You can connect an Enterprise Edition transit router to a VPC that belongs to the same or a different Alibaba Cloud account. If the VPC and the transit router that you want to connect belong to different Alibaba Cloud accounts, the transit router must acquire the required permissions from the Alibaba Cloud account to which the VPC belongs. For more information, see Acquire permissions to connect to a network instance that belongs to another account.

• If you want to realize IPv6 network communication through the Enterprise Edition transit router, ensure that the IPv6 feature is enabled for the VPC. For more information, see Enable IPv6 for a VPC.

Procedures

1. Log on to the CEN console.

2. On the Instances page, click the ID of the CEN instance that you want to manage.

3. On the Basic Information > Transit Router tab, find the transit router that you want to manage and click Create Connection in the Actions column.

4. On the Connection with Peer Network Instance page, set the parameters and click OK. The following table describes the parameters.

   Note

   When you perform this operation, the system automatically creates the service-linked role AliyunServiceRoleForCEN. The service-linked role allows the Enterprise Edition transit router to create an ENI in a vSwitch of the VPC. The ENI is used to forward data between the VPC and the transit router. For more information about service-linked roles, see AliyunServiceRoleForCEN.

   Parameter	Description
   Network Type	Select VPC.
   Region	Select the region where the network instance is deployed.
   Transit Router	The transit router in the selected region is displayed.
   IPv6	Enabling the IPv6 feature for VPC connections is optional. The feature is disabled by default. Make sure you turn it on if VPCs need to communicate over an IPv6 network through an Enterprise Edition transit router. Note IPv6 can be enabled for existing VPC connections. For more information see, Enable IPv6 for VPC.
   Resource Owner ID	Select the Alibaba Cloud account to which the network instance belongs. You can connect a VPC to a transit router that belongs to the same Alibaba Cloud account or a different Alibaba Cloud account. If the network instance and the transit router that you want to connect belong to the same Alibaba Cloud account, select Current Account. If the network instance and the transit router that you want to connect belong to different Alibaba Cloud accounts, select Different Account, and enter the ID of the Alibaba Cloud account to which the network instance belongs.
   Billing Method	By default, transit routers use the pay-as-you-go billing method. For more information, see Billing rules.
   Attachment Name	Enter a name for the network connection.
   Tag	Add a tag to the VPC connection. Tag Key: The tag key cannot be an empty string. The tag key can be up to 64 characters in length. The key cannot start with acs: or aliyun or contain http:// or https://. Tag Value: The tag value can be an empty string. The tag value can be up to 128 characters in length. The tag value cannot start with acs: or aliyun or contain http:// or https://. You can add one or multiple tags to a VPC connection. For more information about tags, see Manage tags.
   Network Instance	Select the VPC.
   vSwitch	Select vSwitches that are deployed in zones supported by the transit router. If the Enterprise Edition transit router is deployed in a region that supports only one zone, select a vSwitch in the zone. If the Enterprise Edition transit router is deployed in a region that supports multiple zones, select at least two vSwitches. The two vSwitches must be in different zones. The two vSwitches support zone-disaster recovery to ensure uninterrupted data transmission between the VPC and the transit router. We recommend that you select a vSwitch in each zone to reduce network latency and improve network performance because data can be transmitted over a shorter distance.
   Advanced Settings	When you create a VPC connection, the system enables the following features in the advanced settings by default: Associate with Default Route Table of Transit Router After this feature is enabled, the VPC connection is automatically associated with the default route table of the transit router. The transit router forwards the traffic of the VPC based on the default route table. Propagate System Routes to Default Route Table of Transit Router After this feature is enabled, the system routes of the VPC are advertised to the default route table of the transit router. This way, the VPC can communicate with other network instances that are connected to the transit router. Automatically Creates Route That Points to Transit Router and Adds to All Route Tables of Current VPC After this feature is enabled, the system automatically adds the following three routes to all route tables of the VPC: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The next hops of the routes point to the VPC. The routes are used to forward IPv4 traffic from the VPC to the transit router. By default, transit routers do not advertise routes to VPCs. Important If such a route is already in the route table of the VPC, the system cannot advertise this route. You must manually add a route that points to the VPC connection to the route table of the VPC. Otherwise, network communication cannot be established between the VPC and the transit router. To check whether such routes exist, click Check Route below Advanced Settings. In order for the VPC to have IPv6 traffic enter and be forwarded, it is necessary to enable route synchronization for the VPC connection or manually add IPv6 route entries pointing to the VPC connection in the route table after creating the connection. You can disable the advanced features by clearing the check boxes. If you want to enable the VBR to communicate with other network instances, you can configure associated forwarding and route learning on the transit router. For more information, see Manage routes.

   After the VPC connection is created, you can view the details about the connection on the Intra-region Connections tab. For more information, see View network instance connections.