Enabling Mutual Access Between Servers in Overlapping Subnets on the Cloud

Scenarios

The existing network architecture of the on-premises data center needs to be migrated to the cloud without any changes. In addition, servers in two overlapping CIDR blocks in the on-premises data center can access each other.

Department A and department B in the same on-premises data center have an overlapping subnet. Workloads of the two departments need to be migrated to a cloud without changing CIDR blocks of their subnets. In addition, the overlapping subnets of the two departments should be able to communicate with each other after the migration.

Solution Architecture

• Department A and department B of two subsidiaries use the same CIDR block (192.168.0.0/24), so two VPCs with the same CIDR block are created on the cloud.
• The department A and B servers both used 192.168.0.3, so they were respectively assigned 10.1.0.11 and 10.2.0.22, as transit addresses. These transit addresses enabled the two servers to communicate with each other.

Figure 1 Logical topology

Manually configure the following routes to ensure traffic forwarding:

• VPC (department A) to the private NAT gateway A
• Transit VPC1 to the VPC peering connection
• Transit VPC2 to the VPC peering connection
• VPC (department B) to the private NAT gateway B

Solution Advantages

CIDR blocks of department A and department B are kept unchanged after on-premises workloads are migrated to the cloud.

Resource and Cost Planning

Prerequisites

• A Huawei Cloud account is available.
• Your account is not in arrears and the account balance is sufficient to pay for the resources involved in this best practice.
• A private NAT gateway is available.

Procedures

1. Creating VPCs
2. Creating ECSs
3. Assigning Transit IP Addresses
4. Buying a Private NAT Gateway and Adding Rules
5. Configuring a Route from a Server to a Private NAT Gateway
6. Configuring a VPC Peering Connection Between vpc-transit1 and vpc-transit2
7. Verifying Communication Between the Server in Departments A and that in Department B

Creating VPCs

1. Go to the Create VPC page.
2. On the Create VPC page, configure the VPC for department A based on Table 1 and click Create Now.
   • Region: Select CN-Hong Kong.
   • Name: Set it to vpc-departmentA.
   • IPv4 CIDR Block: Set it to 192.168.0.0/24.
   • Subnet Name: Set it to subnet-A.
   • IPv4 CIDR Block: Retain the default value.
   • For parameters not mentioned, retain their default values or configure them as prompted.
   Figure 2 Create VPC
   

3. Repeat the above steps to create all required VPCs in Table 1.
   • Region: Select CN-Hong Kong.
   • Name: Set it to vpc-departmentB.
   • IPv4 CIDR Block: Set it to 192.168.0.0/24.
   • Subnet Name: Set it to subnet-B.
   • IPv4 CIDR Block: Retain the default value.
   • For parameters not mentioned, retain their default values or configure them as prompted.
   Figure 3 Creating a VPC
   

Creating ECSs

1. Under Compute, select Elastic Cloud Server. On the Elastic Cloud Server page displayed, click Create ECS.
2. Based on Table 1, configure basic information about the ECS of department A and click Next: Configure Network.
   • Billing Mode: Select Pay-per-use.
   • Region: Select CN-Hong Kong.
   • Specifications: You can select ECS specifications based on your project requirements. This example uses c6.large.2 as an example.
   • Image: Select Public image. This example uses a CentOS 8.0 image.
   • For parameters not mentioned, retain their default values or configure them as prompted.

3. Configure network information for the ECS of department A.
   • Network: Select VPC vpc-departmentA, select Manually specify IP address, and set the IP address to 192.168.0.3 planned in Table 1.
   • Security Group: Select Sys-FullAccess. In this example, we will select a security group that allows all inbound and outbound traffic as the test security group, but you can select a different security group based on service requirements if needed.
   • EIP: Select Not required.
   • For parameters not mentioned, retain their default values or configure them as prompted.

4. Click Next: Configure Advanced Settings.
5. Configure the ECS name, password, and other information.
   • ECS Name: Set it to ecs-departmentA.
   • Login Mode: Select Password and enter a password.
   • For parameters not mentioned, retain their default values or configure them as prompted.

6. Click Next: Confirm.
7. Confirm the ECS information, read the agreement and select the Agreement option, and click Submit to finish the ECS creation for department A.
8. In the ECS list, locate the ECS for department A and click Remote Login in the Operation column. In the displayed dialog box, click Log In under Other Login Modes.
9. Log in to the ECS as user root and check whether the private IP address of the ECS is the one you planned.

   ifconfig

   

10. Repeat 1 through 9 to create other ECSs as planned.

Assigning Transit IP Addresses

1. On the management console, under Networking, select NAT Gateway. In the left navigation pane, choose Private NAT Gateways. Click the Transit IP Addresses tab.

   

2. Click Assign Transit IP Address.
3. In the Assign Transit IP Address dialog box, assign a transit IP address for department A based on Table 1.
   • Transit VPC: Select vpc-transit1.
   • Transit Subnet: Select ext_sub_T1.
   • Transit IP Address: Select Manual.
   • IP Address: Enter 10.1.0.11.

4. Click OK.
5. Repeat 1 through 4 to assign a transit IP address (10.2.0.22) for department B.
   • Transit VPC: Select vpc-transit2.
   • Transit Subnet: Select ext_sub_T2.
   • Transit IP Address: Select Manual.
   • IP Address: Enter 10.2.0.22.

Buying a Private NAT Gateway and Adding Rules

1. Go back to the Private NAT Gateways page and click Buy Private NAT Gateway in the upper right corner.
2. Configure parameters for creating a private NAT gateway for department A.
   • Region: Select CN-Hong Kong.
   • Name: Set it to private-nat-A.
   • VPC: Select vpc-departmentA.
   • For parameters not mentioned, retain their default values or configure them as prompted.

3. Click Buy Now.
4. On the Private NAT Gateways tab, click the name of the private NAT gateway on which you need to add a DNAT rule.
5. Switch to the DNAT Rules tab and click Add DNAT Rule.
6. Configure DNAT rule parameters and click OK.
   • Port Type: Select All ports.
   • Transit Subnet: Select ext_sub_T1.
   • Transit IP Address: Enter 10.1.0.11.
   • Instance Type: Select Server and the ECS of department A.

7. Go back to the Private NAT Gateways page and click Buy Private NAT Gateway in the upper right corner.
8. Configure parameters for creating a private NAT gateway for department B.
   • Region: Select CN-Hong Kong.
   • Name: Set it to private-nat-B.
   • VPC: Select vpc-departmentB.
   • For parameters not mentioned, retain their default values or configure them as prompted.

9. Click Buy Now.
10. On the Private NAT Gateways tab, click the name of the private NAT gateway on which you need to add a DNAT rule.
11. Switch to the DNAT Rules tab and click Add DNAT Rule.
12. Configure DNAT rule parameters and click OK.
    • Port Type: Select All ports.
    • Transit Subnet: Select ext_sub_T2.
    • Transit IP Address: Select 10.2.0.22.
    • Instance Type: Select Server and the ECS of department B.

    

Configuring a Route from a Server to a Private NAT Gateway

1. Choose Networking > Virtual Private Cloud. In the navigation pane on the left, choose Route Tables.
2. Click rtb-vpc-departmentA. On the Summary page, click Add Route.
3. Configure a route for the server in department A to access the private NAT gateway of department A and click OK.
   • Destination: Enter 0.0.0.0/0. (In actual operations, configure this parameter based on service requirements.)
   • Next Hop Type: Select NAT gateway.
   • Next Hop: The system automatically displays the private NAT gateway of department A.

   

4. Go back to the Route Tables page, click rtb-vpc-departmentB, and click Add Route.
5. Configure a route for the server in department B to access the private NAT gateway of department B and click OK.
   • Destination: Set it to 0.0.0.0/0.
   • Next Hop Type: Select NAT gateway.
   • Next Hop: The system automatically displays the private NAT gateway of department B.

   

Configuring a VPC Peering Connection Between vpc-transit1 and vpc-transit2

1. Under Networking, select Virtual Private Cloud. In the navigation pane on the left, choose VPC Peering Connections.
2. Click Create VPC Peering Connection.
3. Configure transit VPC1 as the local VPC and transit VPC2 as the peer VPC. Configure the following parameters and click OK.
   • Name: Set it to peering-TtoT.
   • Local VPC: Select vpc-transit1.
   • Peer VPC: Select vpc-transit2.
   • For parameters not mentioned, retain their default values or configure them as prompted.

   

4. Go back to the VPC Peering Connections page. In the navigation pane on the left, choose Route Tables.
5. Click rtb-vpc-transit1. On the Summary page, click Add Route.
6. Configure the route from vpc-transit1 to peering-TtoT and click OK.
   • Destination: Set it to 0.0.0.0/0.
   • Next Hop Type: Select VPC peering connection.
   • Next Hop: The system automatically displays the VPC peering connection.

   

7. Repeat 5 and 6 (selecting rtb-vpc-transit2) to configure the route from vpc-transit2 to the VPC peering connection.

   

Verifying Communication Between the Server in Departments A and that in Department B

1. Under Compute, select Elastic Cloud Server. Log in to ecs-departmentA and ecs-departmentB using VNC, respectively.
2. On ecs-departmentA, verify that it can access the server in department B:

   ping 10.2.0.22

   

3. On ecs-departmentB, verify that it can access the server in department A:

   ping 10.1.0.11

   

   The servers in the overlapping subnets can now communicate with each other through the private NAT gateway.