Procedure for Communications Between an On-Premises Data Center and the Cloud Through Direct Connect and VPN
Step 1: Create Cloud Resources
This step describes how to create the service VPC, ECS, and enterprise router. For details about these resources, see Table 5.
- Create an enterprise router.
For details, see Creating an Enterprise Router.
- Create a service VPC.
For details, see Creating a VPC.
- Create an ECS.
In this example, the ECS is used to verify the communications between the VPC and the on-premises data center. The ECS quantity and configuration are for reference only.
For details, see Methods of Purchasing ECSs.
Step 2: Create a Virtual Gateway Attachment to the Enterprise Router
For details about Direct Connect resources, see Table 5.
- Create a connection.
For details, see Creating a Connection.
- Create a virtual gateway and attach it to the enterprise router.
- On the Direct Connect console, create a virtual gateway.
For details, see Step 2: Create a Virtual Gateway.
- On the enterprise router console, check whether the virtual gateway attachment has been added to the enterprise router.
If the status of the virtual gateway attachment is Normal, the attachment has been added.
Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. After the virtual gateway is attached to the enterprise router, the system will automatically:- Associate the virtual gateway attachment with the default route table of the enterprise router.
- Propagate the virtual gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.
You can view routes to the on-premises data center in the route table of the enterprise router only after performing the following steps.
- On the Direct Connect console, create a virtual gateway.
- Create a virtual interface.
Create a virtual interface to connect the virtual gateway with the on-premises data center. For details, see Step 3: Create a Virtual Interface.
- Configure routes on the on-premises network device.
Direct Connect and VPN connections back up each other. Note the following when configuring routes:
- The route type of the Direct Connect connection must be the same as that of the VPN connection. BGP routes must be configured for dual-link mutual backup.
- The route priority of the Direct Connect connection must be higher than that of the VPN connection.
- The amount of time that the disconnection of Direct Connect and VPN connections is detected should be the same as that of the cloud network.
Step 3: Create a VPC Attachment to the Enterprise Router
- Attach the service VPC to the enterprise router.
When creating the VPC attachment, do not enable Auto Add Routes.
If this option is enabled, Enterprise Router automatically adds routes (with this enterprise router as the next hop and 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the destinations) to all route tables of the VPC. In this example, you need to add a route to the VPC route table with destination set to the on-premises CIDR block and next hop set to enterprise router.
For details, see Creating VPC Attachments to the Enterprise Router.
- Check the route with destination set to the VPC CIDR block in the enterprise router route table.
In this example, Default Route Table Association and Default Route Table Propagation are enabled for the enterprise router, and routes with destinations set to VPC CIDR blocks are automatically added when you attach the VPCs to the enterprise router.
For VPC route details, see Table 2 and Table 4.
To view enterprise routes, see Viewing Routes.
- In the route table of the service VPC, add a route with the next hop set to the enterprise router.
For VPC route details, see Table 3.
For details, see Adding Routes to VPC Route Tables.
Step 4: Verify the Network Connectivity Over the Direct Connect Connection
- Log in to ecs-demo.
Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.
In this example, use VNC provided on the management console to log in to the ECS.
- Check whether the service VPC can communicate with the on-premises data center through the enterprise router.
ping IP address of the on-premises data center
Example command:
ping 192.168.3.10
If information similar to the following is displayed, vpc-for-er can communicate with the on-premises data center through the enterprise router.[root@ecs-demo ~]# ping 192.168.3.10 PING 192.168.3.10 (192.168.3.10) 56(84) bytes of data. 64 bytes from 192.168.3.10: icmp_seq=1 ttl=64 time=0.849 ms 64 bytes from 192.168.3.10: icmp_seq=2 ttl=64 time=0.455 ms 64 bytes from 192.168.3.10: icmp_seq=3 ttl=64 time=0.385 ms 64 bytes from 192.168.3.10: icmp_seq=4 ttl=64 time=0.372 ms ... --- 192.168.3.10 ping statistics ---
Step 5: Create a VPN Attachment to the Enterprise Router
For details about the VPC used by VPN, see Table 5.
- Create a VPC for the VPN gateway.
For details, see Creating a VPC.
When you create a VPN gateway, you need to select the VPC and set Interconnection Subnet to a subnet that is not used by any resource in the VPC. The subnet CIDR block cannot overlap with existing subnet CIDR blocks in the VPC. In this example, the CIDR block of the interconnection subnet cannot be the same as that of the default subnet subnet-01.
- Create a VPN gateway and attach it to the enterprise router.
- On the VPN management console, create a VPN gateway.
For details, see Creating a VPN Gateway.
- On the enterprise router console, check whether the VPN gateway attachment has been added to the enterprise router.
If the status of the VPN gateway attachment is Normal, the attachment has been added.
Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. After the VPN gateway is attached to the enterprise router, the system will automatically:- Associate the VPN gateway attachment with the default route table of the enterprise router.
- Propagate the VPN gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.
You can view routes to the on-premises data center in the route table of the enterprise router only after performing the following steps.
- On the VPN management console, create a VPN gateway.
- Create a customer gateway.
For details, see Creating a Customer Gateway.
- Create two VPN connections that will work in active/standby mode.
- Configure routes on the on-premises network device.
Direct Connect and VPN connections back up each other. Note the following when configuring routes:
- The route type of the Direct Connect connection must be the same as that of the VPN connection. BGP routes must be configured for dual-link mutual backup.
- The route priority of the Direct Connect connection must be higher than that of the VPN connection.
- The amount of time that the disconnection of Direct Connect and VPN connections is detected should be the same as that of the cloud network.
Step 6: Verify the Network Connectivity Over the VPN Connection
A VPN connection is a standby one. If you need to verify the network connectivity through a VPN connection, you need to simulate a fault on the active connection, that is the Direct Connect connection.
- Simulate a fault on the Direct Connect connection to ensure that the service VPC cannot communicate with the on-premises data center over the connection.
Simulate a fault only when no packets are transmitted over the Direct Connect connection to prevent service interruptions.
- Log in to ecs-demo.
Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.
In this example, use VNC provided on the management console to log in to the ECS.
- Check whether the service VPC can communicate with the on-premises data center through the enterprise router.
ping IP address of the on-premises data center
Example command:
ping 192.168.3.10
If information similar to the following is displayed, vpc-for-er can communicate with the on-premises data center through the enterprise router.[root@ecs-demo ~]# ping 192.168.3.10 PING 192.168.3.10 (192.168.3.10) 56(84) bytes of data. 64 bytes from 192.168.3.10: icmp_seq=1 ttl=64 time=0.849 ms 64 bytes from 192.168.3.10: icmp_seq=2 ttl=64 time=0.455 ms 64 bytes from 192.168.3.10: icmp_seq=3 ttl=64 time=0.385 ms 64 bytes from 192.168.3.10: icmp_seq=4 ttl=64 time=0.372 ms ... --- 192.168.3.10 ping statistics ---
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.