Procedure for Setting Up a Hybrid Cloud Network Using Enterprise Router, VPN, and Direct Connect (Virtual Gateway)

Step 1: Create Cloud Resources

Create an enterprise router, a service VPC, and an ECS, as described in Table 5.

1. Create an enterprise router.

   For details, see Creating an Enterprise Router.

2. Create a service VPC.

   For details, see Creating a VPC.

3. Create an ECS in the service VPC.

   In this example, the ECS is used to verify the communications between the VPC and the on-premises data center. The ECS quantity and configuration are for reference only.

   For details, see Overview.

Step 2: Create a Virtual Gateway Attachment to the Enterprise Router

For details about Direct Connect resources, see Table 5.

1. Create a connection.

   For details, see Creating a Connection.

2. Create a virtual gateway and attach it to the enterprise router.
   1. On the Direct Connect console, create a virtual gateway.

      For details, see Step 2: Create a Virtual Gateway.

   2. On the Enterprise Router console, view the virtual gateway attachment created for the enterprise router.

      For details, see Viewing Details About an Attachment.

      If the status of the virtual gateway attachment is Normal, the attachment has been added.

      Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. After the virtual gateway is attached to the enterprise router, the system will automatically:

      • Associate the virtual gateway attachment with the default route table of the enterprise router.
      • Propagate the virtual gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.

        You can view routes to the on-premises data center in the route table of the enterprise router only after taking the following steps.

3. Create a virtual interface.

   Create a virtual interface to connect the virtual gateway with the on-premises data center. For details, see Step 3: Create a Virtual Interface.

4. Configure routes on the on-premises network device.

   Direct Connect and VPN back up each other. Note the following when configuring routes:

   • The route type of the Direct Connect connection must be the same as that of the VPN connection. BGP routes must be configured for dual-link mutual backup.
   • The route priority of the Direct Connect connection must be higher than that of the VPN connection.
   • The amount of time that disconnected Direct Connect and VPN connections are detected should be the same as that of the cloud network.

Step 3: Create a VPC Attachment for the Enterprise Router

1. Attach the service VPC to the enterprise router.

   When creating the VPC attachment, do not enable Auto Add Routes.

   

   If this option is enabled, Enterprise Router automatically adds routes (with this enterprise router as the next hop and 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the destinations) to all route tables of the VPC. In this example, you need to add a route in the VPC route table with destination set to the on-premises network CIDR block and next hop set to the enterprise router.

   For details, see Creating VPC Attachments for the Enterprise Router.

2. In the enterprise router route table, check the route with the destination set to the VPC CIDR block.

   In this example, Default Route Table Association and Default Route Table Propagation are enabled for the enterprise router, and routes with destinations set to VPC CIDR blocks are automatically added when you attach the VPCs to the enterprise router.

   For VPC route details, see Table 2 and Table 4.

   To view enterprise routes, see Viewing Routes.

3. In the route table of the service VPC, add a route with the next hop set to the enterprise router.

   For VPC route details, see Table 3.

   For details, see Adding Routes to VPC Route Tables.

Step 4: Verify the Network Connectivity Over the Direct Connect Connection

1. Log in to the ECS (ecs-demo).

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   In this example, use VNC provided on the management console to log in to the ECS.

2. Check whether the service VPC can communicate with the on-premises data center over the connection and the enterprise router.

   ping IP address used in the on-premises data center

   Example command:

   ping 192.168.3.10

   If information similar to the following is displayed, the VPC can communicate with the on-premises data center over the connection and the enterprise router.

   [root@ecs-demo ~]# ping 192.168.3.10
   PING 192.168.3.10 (192.168.3.10) 56(84) bytes of data.
   64 bytes from 192.168.3.10: icmp_seq=1 ttl=64 time=0.849 ms
   64 bytes from 192.168.3.10: icmp_seq=2 ttl=64 time=0.455 ms
   64 bytes from 192.168.3.10: icmp_seq=3 ttl=64 time=0.385 ms
   64 bytes from 192.168.3.10: icmp_seq=4 ttl=64 time=0.372 ms
   ...
   --- 192.168.3.10 ping statistics ---

Step 5: Create a VPN Gateway Attachment for the Enterprise Router

For details about VPN resources, see Table 5.

1. Create a VPC for the VPN gateway.

   For details, see Creating a VPC.

   

   When you create a VPN gateway, you need to select this VPC and set Interconnection Subnet to a subnet that is not used by any resource and whose CIDR block does not overlap with existing subnet CIDR blocks in the VPC. In this example, the CIDR block of the interconnection subnet cannot be the same as that of the default subnet subnet-01.

2. Create a VPN gateway and attach it to the enterprise router.
   1. On the VPN management console, create a VPN gateway.

      For details, see Creating a VPN Gateway.

   2. On the Enterprise Router console, view the VPN gateway attachment created for the enterprise router.

      For details, see Viewing Details About an Attachment.

      If the status of the VPN gateway attachment is Normal, the attachment has been added.

      Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. After the VPN gateway is attached to the enterprise router, the system will automatically:

      • Associate the VPN gateway attachment with the default route table of the enterprise router.
      • Propagate the VPN gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.

        You can view routes to the on-premises data center in the route table of the enterprise router only after taking the following steps.

3. Create a customer gateway.

   For details, see Creating a Customer Gateway.

4. Create two VPN connections that will work in active/standby mode.
   1. Create VPN connection 1.
   2. Create VPN connection 2.

5. Configure routes on the on-premises network device.

   Direct Connect and VPN back up each other. Note the following when configuring routes:

   • The route type of the Direct Connect connection must be the same as that of the VPN connection. BGP routes must be configured for dual-link mutual backup.
   • The route priority of the Direct Connect connection must be higher than that of the VPN connection.
   • The amount of time that disconnected Direct Connect and VPN connections are detected should be the same as that of the cloud network.

Step 6: Verify the Network Connectivity Over the VPN Connection

VPN works as an alternative to Direct Connect. If you need to verify the network connectivity over a VPN connection, you need to simulate a fault on the Direct Connect connection.

1. Simulate a fault on the Direct Connect connection to prevent communications between the service VPC and the on-premises data center over the connection.
   

   Simulate a fault only when no packets are transmitted over the Direct Connect connection to prevent service interruptions.

2. Log in to the ECS (ecs-demo).

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   In this example, use VNC provided on the management console to log in to the ECS.

3. Check whether the service VPC can communicate with the on-premises data center over the connection and the enterprise router.

   ping IP address used in the on-premises data center

   Example command:

   ping 192.168.3.10

   If information similar to the following is displayed, the VPC can communicate with the on-premises data center over the connection and the enterprise router.

   [root@ecs-demo ~]# ping 192.168.3.10
   PING 192.168.3.10 (192.168.3.10) 56(84) bytes of data.
   64 bytes from 192.168.3.10: icmp_seq=1 ttl=64 time=0.849 ms
   64 bytes from 192.168.3.10: icmp_seq=2 ttl=64 time=0.455 ms
   64 bytes from 192.168.3.10: icmp_seq=3 ttl=64 time=0.385 ms
   64 bytes from 192.168.3.10: icmp_seq=4 ttl=64 time=0.372 ms
   ...
   --- 192.168.3.10 ping statistics ---