Construction Procedure

Step 1: Create Cloud Resources

This step describes how to create the service VPC, ECS, and enterprise router. For details about these resources, see Table 5.

1. Create an enterprise router.

   For details, see Creating an Enterprise Router.

2. Create a service VPC.

   For details, see Creating a VPC.

3. Create an ECS.

   In this example, the ECS is used to verify the communication between the VPC and the data center. The ECS quantity and configuration are for reference only.

   For details, see Overview.

Step 2: Create a Virtual Gateway Attachment to the Enterprise Router

For details about Direct Connect resources, see Table 5.

1. Create a connection.

   For details, see Creating a Connection.

2. Create a virtual gateway and attach it to the enterprise router.
   1. On the Direct Connect console, create a virtual gateway.

      For details, see Step 2: Create a Virtual Gateway.

   2. On the enterprise router console, check whether the virtual gateway attachment has been added to the enterprise router.

      For details, see Viewing Details About an Attachment.

      If the status of the virtual gateway attachment is Normal, the attachment has been added.

      Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. Therefore, after you add the virtual gateway attachment to the enterprise router, the system will automatically:

      • Associate the virtual gateway attachment with the default route table of the enterprise router.
      • Propagate the virtual gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.

        You can view routes to the data center in the route table of the enterprise router only after performing the following steps.

3. Create a virtual interface.

   Create a virtual interface to connect the virtual gateway with the on-premises data center. For details, see Step 3: Create a Virtual Interface.

4. Configure routes on the on-premises network device.

   The Direct Connect and VPN connections back up each other. Therefore, pay attention to the following when configuring routes:

   • The routing mode of the Direct Connect and VPN connections must be the same. In this example, BGP routing is used.
   • The route priority of the Direct Connect connection must be higher than that of the VPN connection.
   • The amount of time that the disconnection of Direct Connect and VPN connections is detected should be the same as that of the cloud network.

Step 3: Create a VPC Attachment to the Enterprise Router

1. Attach the service VPC to the enterprise router.

   When creating the VPC attachment, do not enable Auto Add Routes.

   

   If this function is enabled, the system automatically adds routes (with this enterprise router as the next hop and 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the destinations) to all route tables of the VPC. In this example, you need to add a route to the VPC route table with destination set to the CIDR block of the on-premises data center and next hop set to enterprise router.

   For details, see Creating VPC Attachments to the Enterprise Router.

2. Check the route with destination set to the VPC CIDR block in the enterprise router route table.

   In this example, Default Route Table Association and Default Route Table Propagation are enabled for the enterprise router, and the system automatically adds routes with destinations set to VPC CIDR blocks when you attach the VPCs to the enterprise router.

   For VPC route details, see Table 2 and Table 4.

   To view enterprise routes, see Viewing Routes.

3. In the route table of the service VPC, add a route with next hop set to enterprise router.

   For VPC route details, see Table 3.

   For details, see Adding Routes to VPC Route Tables.

Step 4: Verify the Network Connectivity Over the Direct Connect Connection

1. Log in to ecs-demo.

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   In this example, use VNC provided on the management console to log in to the ECS.

2. Check whether the service VPC can communicate with the data center through the enterprise router.

   ping IP address of the data center

   Example command:

   ping 192.168.3.10

   If information similar to the following is displayed, vpc-for-er can communicate with the data center through the enterprise router.

   [root@ecs-A02 ~]# ping 192.168.3.10
   PING 192.168.3.10 (192.168.3.102) 56(84) bytes of data.
   64 bytes from 192.168.3.102: icmp_seq=1 ttl=64 time=0.849 ms
   64 bytes from 192.168.3.102: icmp_seq=2 ttl=64 time=0.455 ms
   64 bytes from 192.168.3.102: icmp_seq=3 ttl=64 time=0.385 ms
   64 bytes from 192.168.3.102: icmp_seq=4 ttl=64 time=0.372 ms
   ...
   --- 192.168.3.102 ping statistics ---

Step 5: Create a VPN Attachment to the Enterprise Router

For details about the VPC used by VPN, see Table 5.

1. Create a VPC for the VPN gateway.

   For details, see Creating a VPC.

   

   When you create a VPN gateway, you need to select the VPC and set Interconnection Subnet to a subnet that is not used by any resource in the VPC. The subnet CIDR block cannot overlap with existing subnet CIDR blocks in the VPC. In this example, the CIDR block of the interconnection subnet cannot be the same as that of the default subnet subnet-01.

2. Create a VPN gateway and attach it to the enterprise router.
   1. On the VPN management console, create a VPN gateway.

      For details, see Creating a VPN Gateway.

   2. On the enterprise router console, check whether the VPN gateway attachment has been added to the enterprise router.

      For details, see Viewing Details About an Attachment.

      If the status of the VPN gateway attachment is Normal, the attachment has been added.

      Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. Therefore, after you add the VPN gateway attachment to the enterprise router, the system will automatically:

      • Associate the VPN gateway attachment with the default route table of the enterprise router.
      • Propagate the VPN gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.

        You can view routes to the data center in the route table of the enterprise router only after performing the following steps.

3. Create a customer gateway.

   For details, see Creating a Customer Gateway.

4. Create two VPN connections that will work in active/standby mode.
   1. Creating VPN Connection 1
   2. Creating VPN Connection 2

5. Configure routes on the on-premises network device.

   The Direct Connect and VPN connections back up each other. Therefore, pay attention to the following when configuring routes:

   • The routing mode of the Direct Connect and VPN connections must be the same. In this example, BGP routing is used.
   • The route priority of the Direct Connect connection must be higher than that of the VPN connection.
   • The amount of time that the disconnection of Direct Connect and VPN connections is detected should be the same as that of the cloud network.

Step 6: Verify the Network Connectivity Over the VPN Connection

A VPN connection is a standby one. If you need to verify the network connectivity through a VPN connection, you need to simulate a fault on the active connection, that is the Direct Connect connection.

1. Simulate a fault on the Direct Connect connection to ensure that the service VPC cannot communicate with the data center over the connection.
   

   Simulate a fault only when no service is running on the Direct Connect connection to prevent service interruptions.

2. Log in to ecs-demo.

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   In this example, use VNC provided on the management console to log in to the ECS.

3. Check whether the service VPC can communicate with the data center through the enterprise router.

   ping IP address of the data center

   Example command:

   ping 192.168.3.10

   If information similar to the following is displayed, vpc-for-er can communicate with the data center through the enterprise router.

   [root@ecs-A02 ~]# ping 192.168.3.10
   PING 192.168.3.10 (192.168.3.102) 56(84) bytes of data.
   64 bytes from 192.168.3.102: icmp_seq=1 ttl=64 time=0.849 ms
   64 bytes from 192.168.3.102: icmp_seq=2 ttl=64 time=0.455 ms
   64 bytes from 192.168.3.102: icmp_seq=3 ttl=64 time=0.385 ms
   64 bytes from 192.168.3.102: icmp_seq=4 ttl=64 time=0.372 ms
   ...
   --- 192.168.3.102 ping statistics ---