Help Center/ Enterprise Router/ Getting Started/ Selecting a Networking Scheme
Updated on 2025-04-08 GMT+08:00
View PDF
Share

Selecting a Networking Scheme

You can use enterprise routers to build a central network and to simplify the network architecture. There are two typical schemes to use Enterprise Router together with Direct Connect to allow an on-premises data center to access multiple VPCs. For details, see Table 1.
Figure 1 Networking for allowing an on-premises data center to access two service VPCs directly (scheme 1)
Figure 2 Networking for allowing an on-premises data center to access two service VPCs over a transit VPC (scheme 2)
Table 1 Comparison between the two schemes

Scheme

Networking Architecture

Network Path Description

Configuration Guide

Remarks

Scheme 1

Figure 1

Two service VPCs (VPC-A and VPC-B) and the Direct Connect virtual gateway are attached to an enterprise router.
  • The enterprise router enables the two VPCs to communicate with each other.
  • Direct Connect enables the on-premises data center to access the cloud, and the enterprise router connects the on-premises data center to both VPCs.

For details, see How Do I Select a Networking Scheme?

Scheme 2

Figure 2

The two service VPCs (VPC-A and VPC-B) are not attached to the enterprise router. Instead, a transit VPC (VPC-Transit) is used. The transit VPC and the Direct Connect virtual gateway are attached to the enterprise router.
  • Each service VPC is connected to the transit VPC over a VPC peering connection.
  • Direct Connect enables the on-premises data center to access the cloud, and the enterprise router connects the on-premises data center to the two service VPCs.

Using Enterprise Router and a Transit VPC to Allow an On-premises Data Center to Access Service VPCs

How Do I Select a Networking Scheme?

In scheme 1, the service VPCs are directly attached to the enterprise router. In scheme 2, a transit VPC is used and attached to the enterprise router. Each service VPC is connected to the transit VPC over a VPC peering connection. Compared with scheme 1, scheme 2 costs less and eliminates some constraints, as detailed below:
  • Scheme 2 uses less traffic and fewer attachments.
    • Traffic between service VPCs is routed through VPC peering connections instead of enterprise routers, reducing traffic costs.
    • Only the transit VPC is attached to the enterprise router. You can pay less for the attachments.
  • Scheme 2 frees you from the following constraints that scheme 1 has on attaching service VPCs to an enterprise router:
    • If a service VPC is used by a shared load balancer, VPC endpoint, private NAT gateway, or DCS resource, submit a service ticket to confirm the service compatibility and preferentially use a transit VPC for networking.

      If you attach a service VPC used by ELB, VPC Endpoint, or DCS to an enterprise router, persistent connections may be intermittently interrupted during service reliability assurance, such as DR switchovers, upgrades, or elastic scaling. Ensure that the clients can automatically reconnect in case of disconnections.

    • Traffic cannot be forwarded from a VPC to its attached enterprise router if the destination of a route with an enterprise router as the next hop is set to 0.0.0.0/0 in the VPC route table and if:
      • An ECS in the VPC has an EIP bound.
      • The VPC is being used by ELB (either dedicated or shared load balancers), NAT Gateway, VPC Endpoint, or DCS.
    • If a VPC attached to an enterprise router has a NAT gateway associated and Scenario of the SNAT or DNAT rules is set to Direct Connect/Cloud Connect, the network from the on-premises data center to the VPC is disconnected.

If you still want to use scheme 1 to attach service VPCs to an enterprise router, submit a service ticket to evaluate the feasibility.