Help Center> Enterprise Router> Best Practices> Enabling an On-Premises Data Center to Access Service VPCs Using an Enterprise Router and Transit VPC> Overview
Updated on 2024-06-27 GMT+08:00
View PDF

Overview

Scenario

You can use enterprise routers to build a central network and to simplify the network architecture. There are two typical networking schemes. One is to attach the service VPCs to the enterprise router. The other is to use a transit VPC to build a network, together with VPC Peering and Enterprise Router. Compared with scheme 1, scheme 2 costs less and eliminates some restrictions, as detailed below:
  • Scheme 2 uses less traffic and fewer attachments.
    • Traffic between service VPCs is routed through VPC peering connections instead of enterprise routers, reducing traffic costs.
    • Only the transit VPC is attached to the enterprise router. You can pay less for the attachments.
  • Scheme 2 frees you from the following constraints that scheme 1 has on attaching service VPCs to an enterprise router:
    • If a service VPC is used by ELB, VPC Endpoint, NAT Gateway (private NAT gateways), or DCS, submit a service ticket to confirm the service compatibility and preferentially use a transit VPC for networking.

      If you attach a service VPC to an enterprise router when Elastic Load Balance (ELB), VPC Endpoint, or DCS is being used together with Enterprise Router, persistent connections may be intermittently interrupted during service reliability assurance, such as a DR switchover, an upgrade, or elastic scaling. Ensure that the clients are capable of automatic reconnection in case of intermittent disconnection.

    • Traffic cannot be forwarded from a VPC to the enterprise router if you set the destination of a route in the VPC route table to 0.0.0.0/0 and:
      • An ECS in the VPC has an EIP bound.
      • The VPC is being used by ELB (either dedicated or shared load balancers), NAT Gateway, VPC Endpoint, and DCS.
    • If a VPC attached to an enterprise router has a NAT gateway associated and Scenario of the SNAT or DNAT rules is set to Direct Connect/Cloud Connect, the network from the on-premises data center to the VPC is disconnected.

Architecture

In scheme 2, service VPCs communicate with each other over VPC peering connections and with the on-premises data center using an enterprise router. Figure 1 shows the networking architecture.
  1. Create a VPC peering connection between VPC-A and VPC-Transit, and between VPC-B and VPC-Transit. Traffic between VPC-A and VPC-B is forwarded through VPC-Transit and the two VPC peering connections.
  2. VPC-Transit is connected to the enterprise router. Traffic from VPC-A and VPC-B to the on-premises data center is forwarded to the enterprise router through the transit VPC, and then to the on-premises data center over the Direct Connect connection.
Figure 1 Networking for allowing an on-premises data center to access two service VPCs over a transit VPC (scheme 2)