Common Practices

VPC and Subnet Planning

Describes how many VPCs, the number of subnets and what CIDR blocks you will need before creating your VPCs, and illustrates common configurations of VPC networking.

VPC Network Connectivity

Huawei Cloud provides a wide range of network services to help you set up secure, scalable cloud networks and establish high-speed, reliable connections between on-premises data centers and the cloud. With these services, you can connect VPCs, enable instances (such as ECSs and RDS instances) in VPCs to access the public network, and enable on-premises servers to access cloud resources in VPCs.

Connecting VPCs

Huawei Cloud provides various services to connect VPCs for different size deployments and for different scenarios. You can use VPC peering connections, enterprise routers, cloud connections, VPN connections, and direct connections to connect VPCs in the same region, VPCs in different regions, or VPCs of different accounts.

Connecting VPCs to the Public Network

By default, cloud resources in a VPC cannot access the public network. You can use EIP, NAT Gateway, or ELB to allow the resources in VPCs to access or be accessed by the public network.

Connecting VPCs to On-Premises Data Centers

If you have services deployed in both on-premises data centers and on the cloud, you can use VPN connections, cloud connections, and direct connections to connect VPCs and on-premises data centers.

Deploying Containers that Can Communicate with Each Other on Huawei Cloud ECSs

You can deploy containers that are not provided by Huawei Cloud container services on Huawei Cloud ECSs and enable the containers on different ECSs but in the same subnet to communicate with each other.

Using a Virtual IP Address and Keepalived to Set Up a High-Availability Web Cluster

You can build highly available web server clusters by using virtual IP addresses. Virtual IP addresses are used for active and standby switchover of ECSs to achieve high availability. This way if one ECS goes down for some reason, the other one can take over and services continue uninterrupted.

Configuring Policy-based Routes for an ECS with Multiple NICs

If an ECS has multiple NICs, the primary NIC can communicate with external networks by default, but the extension NICs cannot. To enable extension NICs to communicate with external works either, you need to configure policy-based routes for these NICs.

VPC Peering Configurations

VPCs are isolated from each other. To connect two VPCs in the same region, you can use a VPC peering connection to route traffic between them using private IP addresses.

This practice describes how to connect VPCs (IPv4 and IPv6) with VPC peering connections.

Routing Traffic to Backend Servers in Different VPCs from the Load Balancer

You can use a dedicated load balancer to route traffic to backend servers in different VPCs connected over a VPC peering connection.

Security Group Configuration Examples

This section describes some examples on how security groups can be configured. When you create instances, such as cloud servers, containers, and databases, in a VPC subnet, you can use the default security group or create a security group. You can add inbound and outbound rules to the default or custom security groups to control traffic from and to the instances in the security group.

Network ACL Configuration Examples

The section provides some examples on how network ACLs can be configured. A network ACL controls traffic in and out of a subnet. If both security group and network ACL rules are configured, traffic is matched against network ACL rules first and then security group rules. You can add security group rules as required and use network ACLs as an additional layer of protection for your subnets.

Using IP Address Groups to Reduce the Number of Security Group Rules

An IP address group is a collection of one or more IP addresses. You can use an IP address group when configuring security group rules. If you change the IP addresses in an IP address group, the security group rules are directly changed. You do not need to modify the security group rules one by one.

Using Third-Party Firewalls When Connecting VPCs

This practice describes how to use a firewall to scrub traffic across VPCs that are connected using VPC peering connections.

Using Third-Party Firewalls When Connecting an On-premises Data Center to the Cloud

This practice describes how to use a third-party virtual firewall when connecting your on-premises data center to multiple VPCs. Your on-premises data center communicates with Huawei Cloud through Direct Connect or VPN. A third-party virtual firewall is deployed on Huawei Cloud to filter traffic.

Lower Network Costs

You can select a proper product and billing mode based on your service requirements.