This topic describes how to use Express Connect circuits and an Express Connect router (ECR) to establish active/standby connections between a data center and a virtual private cloud (VPC).
Scenario
The following figure shows the scenario in this example. A company has a data center in Shanghai and creates a VPC in the China (Shanghai) region. Business-critical systems such as database clusters are deployed in the data center, and cloud resources such as Elastic Compute Service (ECS) instances that host specific business systems are deployed in the VPC. To ensure stable connections between the cloud and on-premises networks, the company needs to lease two Express Connect circuits to connect the customer-premises equipment (CPE) and virtual border routers (VBRs) and use an ECR to connect the data center and VPC. The data center is connected to the VPC by using an active Express Connect circuit and a standby Express Connect circuit. The Border Gateway Protocol (BGP) dynamic routing and Bidirectional Forwarding Detection (BFD) features are used to accelerate route convergence between the data center and VPC. This improves network availability.
The following table describes how CIDR blocks are allocated in this example. You can allocate CIDR blocks based on your business requirements. Make sure that the CIDR blocks do not overlap with each other.
Entity | CIDR block | Server or client IP address |
Data center | 10.1.1.0/24 | Client IP address: 10.1.1.1 |
VPC | 192.168.20.0/24 | Server IP address: 192.168.20.161 |
VBR1 |
| N/A |
VBR2 |
| N/A |
Prerequisites
Before you start, make sure that the following prerequisites are met:
A VPC is created in the China (Shanghai) region, and cloud resources such as ECS instances that host your business systems are deployed in the VPC. For more information, see Create a VPC with an IPv4 CIDR block.
You understand the security group rules of the Elastic Compute Service (ECS) instances in the virtual private cloud (VPC). Make sure that the rules allow the ECS instances to communicate with the data center. For more information, see View security group rules and Add a security group rule.
An ECR is created. For more information, see Create and manage ECRs.
Procedure
Step 1: Create two connections over Express Connect circuits
In this example, two dedicated connections over Express Connect circuits are created to provide powerful disaster recovery capabilities in high-reliability mode. For more information, see Powerful disaster recovery.
Step 2: Create VBRs
Create a VBR for each Express Connect circuit. The VBRs serve as bridges for data exchange between the data center and VPC.
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, click Virtual Border Routers (VBRs).
On the Virtual Border Routers (VBRs) page, click Create VBR. In the Create VBR panel, configure the parameters that are described in the following table and click OK.
Parameter
Description
Account
The Alibaba Cloud account to which the VBR belongs.
In this example, Current Account is selected.
Name
The name of the VBR.
In this example, VBR1 is used.
Express Connect Circuit
The type of the connection over the Express Connect circuit. In this example, Dedicated Physical Connection and Express Connect Circuit 1 are selected.
VLAN ID
The VLAN ID of the VBR.
In this example, 110 is used.
Set VBR Bandwidth Value
The bandwidth of the VBR.
In this example, 200Mb is selected.
IPv4 Address (Alibaba Cloud Gateway)
The IPv4 address for the VBR to route network traffic between the VPC and data center.
In this example, 172.16.1.2 is used.
IPv4 Address (Data Center Gateway)
The IPv4 address for the gateway device in the data center to route network traffic between the data center and VPC.
In this example, 172.16.1.1 is used.
Subnet Mask (IPv4)
The subnet mask of the specified IPv4 addresses.
In this example, 255.255.255.252 is used.
Repeat the preceding steps to create VBR2 for the other Express Connect circuit.
The following table describes the parameters.
Parameter
Description
Account
The Alibaba Cloud account to which the VBR belongs.
In this example, Current Account is selected.
Name
The name of the VBR.
In this example, VBR2 is used.
Express Connect Circuit
The type of the connection over the Express Connect circuit. In this example, Dedicated Physical Connection and Express Connect Circuit 2 are selected.
VLAN ID
The VLAN ID of the VBR.
In this example, 120 is used.
Set VBR Bandwidth Value
The bandwidth of the VBR.
In this example, 200Mb is selected.
IPv4 Address (Alibaba Cloud Gateway)
The IPv4 address for the VBR to route network traffic between the VPC and data center.
In this example, 172.16.2.2 is used.
IPv4 Address (Data Center Gateway)
The IPv4 address for the gateway device in the data center to route network traffic between the data center and VPC.
In this example, 172.16.2.1 is used.
Subnet Mask (IPv4)
The subnet mask of the specified IPv4 addresses.
In this example, 255.255.255.252 is used.
Step 3: Enable BFD for the VBRs
Enable BFD for the VBRs to accelerate route convergence.
Log on to the Express Connect console.
In the top navigation bar, select a region. In the left-side navigation pane, click Virtual Border Routers (VBRs).
On the Virtual Border Routers (VBRs) page, find the VBR that you want to manage and click Edit in the Actions column.
In the Edit VBR panel, configure the parameters and click OK.
The following table describes the parameters related to BFD. Use default values for other parameters.
Parameter
Description
Submission Interval
The time interval at which BFD packets are sent. Unit: millisecond.
Default value: 1000. In this example, the default value is used.
Reception Interval
The time interval at which BFD packets are received. Unit: millisecond.
Default value: 1000. In this example, the default value is used.
Detection Time Multiplier
The detection time multiplier that is used to determine the maximum number of lost packets.
Default value: 3. In this example, the default value is used.
On the Virtual Border Routers (VBRs) page, click the ID of the VBR for which you want to configure BGP routing.
On the details page of the VBR, click the BGP Peers tab.
Find the BGP peer that you want to manage and click Edit in the Actions column.
In the Modify BGP Peer panel, select Enable BFD, configure the BFD Hop Count parameter, and then click OK.
NoteBFD supports single-hop and multi-hop authentication. You can specify hops based on your network configurations.
Step 4: Configure BGP routing
Configure BGP routing between the data center and VBRs. You can use the autonomous system (AS) path attribute to configure route priorities in the data center to establish active/standby connections.
Set the data center and VBRs as BGP peers and advertise routes. For more information, see Configure and manage BGP.
The default autonomous system number (ASN) of Alibaba Cloud is 45104. The data center can use 2-byte or 4-byte ASNs.
When you configure BGP routing in the data center, you must specify the destination CIDR block of the BGP routes that you want to advertise to Alibaba Cloud. In this example, the destination CIDR block is 10.1.1.0/24. To establish active/standby connections from Alibaba Cloud to the data center, specify the AS path length to determine route priorities.
The active Express Connect circuit is connected to CPE1, and the standby Express Connect circuit is connected to CPE2. The active or standby connection is selected based on the ASN. You can specify the AS path length to configure route priorities. A shorter AS path indicates a higher priority. The following table describes how BGP routing is configured on the CPE in the data center. For more information about the commands, contact the service provider of the CPE.
Parameter | CPE1 | CPE2 |
Vlan Tag | 110 | 120 |
Network | 10.1.1.0/24 | 10.1.1.0/24 |
BGP ASN | 6***3 | 6***4 |
Interface IP | 172.16.1.1/24 | 172.16.2.1/24 |
AS-Path | B, A | C, B, A |
An ECR automatically learns and advertises routes. After you configure BGP routing, the ECR automatically learns routes based on routing rules such as route weights. The following tables describe the route learning details.
The following table describes the BGP routing information about the VBRs.
Item
VBR1
VBR2
Destination CIDR block
10.1.1.0/24
10.1.1.0/24
Next hop
172.16.1.1
172.16.2.1
The VBRs learn the routing rules from BGP peers. After a VBR is associated with an ECR, the VBR advertises the BGP routing information learned from the data center to the ECR, including AS paths.
The following table describes the global route configurations.
Route configurations of the CPE
Parameter
CPE1
CPE2
Vlan Tag
110
120
Network
10.1.1.0/24
10.1.1.0/24
BGP ASN
6***3
6***4
Interface IP
172.16.1.1/24
172.16.2.1/24
AS-Path
B, A
C, B, A
Route configurations of the VBRs
Item
VBR1
VBR2
Destination CIDR block
10.1.1.0/24
10.1.1.0/24
Next hop
172.16.1.1
172.16.2.1
Route configurations in the data center
Destination CIDR block
192.168.20.0/24
Next hop
172.16.1.2
172.16.2.2
Step 5: Associate the VBRs and VPC with the ECR
After the connections over Express Connect circuits are established, you must associate the VBRs and VPC with the ECR to connect the data center and VPC.
Log on to the Express Connect console.
In the left-side navigation pane, click Express Connect Router (ECR). On the Express Connect Router (ECR) page, find the ECR that you want to manage and click the name of the ECR. The details page of the ECR appears.
Click the VBR tab. On the VBR tab, click Associate VBR.
In the Associate VBR dialog box, configure the parameters that are described in the following table and click OK.
Parameter
Description
Resource Owner
The type of the account to which the VBR belongs. Valid values:
Current Account: The VBR and the ECR belong to the same account.
Another Account: If you want to associate a VBR with the ECR across accounts, you must authorize the ECR that belongs to the current Alibaba Cloud account to access the VBR that belongs to another Alibaba Cloud account. For more information, see the Authorize an ECR to access a VBR across accounts section of the "Authorize an ECR to access resources across accounts" topic.
Region
The region in which the VBR resides.
Peer Account UID
The ID of the Alibaba Cloud account to which the VBR belongs.
NoteThis parameter is required if you set the Resource Owner parameter to Another Account.
Network Instance
The name or ID of the VBR.
Allow Business Access Between Data Centers
Specifies whether to allow data centers to access each other.
NoteBy default, this feature is disabled. If you want to use the feature, contact your Alibaba Cloud account manager to apply for enabling the feature.
Click the VPC tab. On the VPC tab, click Associate VPC.
In the Associate VPC dialog box, configure the parameters that are described in the following table and click OK.
Parameter
Description
Resource Owner
The type of the account to which the VPC belongs. Valid values:
Current Account: The VPC and the ECR belong to the same account.
Another Account: If you want to associate a VPC with the ECR across accounts, you must authorize the ECR that belongs to the current Alibaba Cloud account to access the VPC that belongs to another Alibaba Cloud account For more information, see the Authorize an ECR to access a VPC across accounts section of the "Authorize an ECR to access resources across accounts" topic.
Region
The region in which the VPC resides.
Peer Account UID
The ID of the Alibaba Cloud account to which the VPC belongs.
NoteThis parameter is required if you set the Resource Owner parameter to Another Account.
VPC ID
The ID of the VPC.
Allowed Route Prefixes
The route prefixes that you want to advertise to the local network by using the ECR. After you specify a CIDR block, the route of the VPC is not advertised to the local network.
NoteYou can advertise the allowed route prefixes by using Border Gateway Protocol (BGP).
Step 6: Test the network connectivity
Perform the following steps to test the network connectivity of the active/standby connections over Express Connect circuits:
Before you test the network connectivity, make sure that the security group rules of the ECS instances in the VPC allow network traffic from the data center. For more information, see View security group rules.
Open the CLI on a computer of the data center.
Run the
pingcommand to test the connectivity between the data center and an ECS instance in the VPC. The CIDR block of the VPC is 192.168.20.0/24. If echo reply packets are returned, the destination is reachable.You can use the failure drill feature of Express Connect to simulate scenarios in which the active route is disconnected. This feature allows you to check whether the network traffic can be automatically switched to the standby route under this circumstance. For more information, see Use the failure drill feature.