Building a Hybrid Cloud Network Through Direct Connect and VPN Working in an Active/Standby Pair

Table 1 describes the overall process of building a hybrid cloud network using an enterprise router and Direct Connect and VPN connections that work in an active/standby pair.

**Table 1** Process description of constructing the hybrid cloud network
Procedure	Description
Step 1: Create Cloud Resources	Create an enterprise router for connecting VPCs in the same region. Create a service VPC with a subnet. Create an ECS in the service VPC subnet.
Step 2: Create a Virtual Gateway Attachment to the Enterprise Router	Create a Direct Connect connection. The connection is dedicated to connect an on-premises data center to Huawei Cloud over a line you lease from a carrier. Create a virtual gateway and attach it to the enterprise router. Create a virtual interface to associate the virtual gateway with the Direct Connect connection. Configure routes on the router in the on-premises data center.
Step 3: Create a VPC Attachment to the Enterprise Router	Attach the service VPC to the enterprise router. Add a route with the enterprise router as the next hop and the on-premises CIDR block as the destination to the VPC route table.
Step 4: Verify the Network Connectivity Over the Direct Connect Connection	Log in to the ECS and run the ping command to verify the network connectivity through the Direct Connect connection.
Step 5: Create a VPN Attachment to the Enterprise Router	Create a VPN gateway and attach it to the enterprise router. Create a customer gateway, that is the gateway of the on-premises data center. Create two VPN connections that connect the VPN gateway and the customer gateway and work in active/standby mode. Configure routes on the router in the on-premises data center.
Step 6: Verify the Network Connectivity Over the VPN Connection	Log in to the ECS and run the ping command to verify the network connectivity through the VPN connections. A VPN connection is a standby one. If you need to verify the network connectivity through a VPN connection, you need to simulate a fault on the active connection, that is the Direct Connect connection.