Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive

Common Practices

Updated on 2024-09-02 GMT+08:00

After creating a VPC, you can deploy different environments, websites, or applications in it.

This section describes common practices for using VPCs.

Network Planning

Practice

Description

VPC and Subnet Planning

Describes how many VPCs, the number of subnets and what CIDR blocks you will need before creating your VPCs, and illustrates common configurations of VPC networking.

VPC Network Connectivity

Huawei Cloud provides a wide range of network services to help you set up secure, scalable cloud networks and establish high-speed, reliable connections between on-premises data centers and the cloud. With these services, you can connect VPCs, enable instances (such as ECSs and RDS instances) in VPCs to access the public network, and enable on-premises servers to access cloud resources in VPCs.

Connecting VPCs

Huawei Cloud provides various services to connect VPCs for different size deployments and for different scenarios. You can use VPC peering connections, enterprise routers, cloud connections, VPN connections, and direct connections to connect VPCs in the same region, VPCs in different regions, or VPCs of different accounts.

Connecting VPCs to the Public Network

By default, cloud resources in a VPC cannot access the public network. You can use EIP, NAT Gateway, or ELB to allow the resources in VPCs to access or be accessed by the public network.

Connecting VPCs to On-Premises Data Centers

If you have services deployed in both on-premises data centers and on the cloud, you can use VPN connections, cloud connections, and direct connections to connect VPCs and on-premises data centers.

Network Configurations

Practice

Description

Deploying Containers that Can Communicate with Each Other on Huawei Cloud ECSs

You can deploy containers that are not provided by Huawei Cloud container services on Huawei Cloud ECSs and enable the containers on different ECSs but in the same subnet to communicate with each other.

Using a Virtual IP Address and Keepalived to Set Up a High-Availability Web Cluster

You can build highly available web server clusters by using virtual IP addresses. Virtual IP addresses are used for active and standby switchover of ECSs to achieve high availability. This way if one ECS goes down for some reason, the other one can take over and services continue uninterrupted.

Configuring Policy-based Routes for an ECS with Multiple NICs

If an ECS has multiple NICs, the primary NIC can communicate with external networks by default, but the extension NICs cannot. To enable extension NICs to communicate with external works either, you need to configure policy-based routes for these NICs.

VPC Peering Configurations

VPCs are isolated from each other. To connect two VPCs in the same region, you can use a VPC peering connection to route traffic between them using private IP addresses.

This practice describes how to connect VPCs (IPv4 and IPv6) with VPC peering connections.

Routing Traffic to Backend Servers in Different VPCs from the Load Balancer

You can use a dedicated load balancer to route traffic to backend servers in different VPCs connected over a VPC peering connection.

Network Security Control

Practice

Description

Security Group Configuration Examples

This section describes some examples on how security groups can be configured. When you create instances, such as cloud servers, containers, and databases, in a VPC subnet, you can use the default security group or create a security group. You can add inbound and outbound rules to the default or custom security groups to control traffic from and to the instances in the security group.

Network ACL Configuration Examples

The section provides some examples on how network ACLs can be configured. A network ACL controls traffic in and out of a subnet. If both security group and network ACL rules are configured, traffic is matched against network ACL rules first and then security group rules. You can add security group rules as required and use network ACLs as an additional layer of protection for your subnets.

Using IP Address Groups to Reduce the Number of Security Group Rules

An IP address group is a collection of one or more IP addresses. You can use an IP address group when configuring security group rules. If you change the IP addresses in an IP address group, the security group rules are directly changed. You do not need to modify the security group rules one by one.

Using Third-Party Firewalls When Connecting VPCs

This practice describes how to use a firewall to scrub traffic across VPCs that are connected using VPC peering connections.

Using Third-Party Firewalls When Connecting an On-premises Data Center to the Cloud

This practice describes how to use a third-party virtual firewall when connecting your on-premises data center to multiple VPCs. Your on-premises data center communicates with Huawei Cloud through Direct Connect or VPN. A third-party virtual firewall is deployed on Huawei Cloud to filter traffic.

Network Cost Management

Practice

Description

Lower Network Costs

You can select a proper product and billing mode based on your service requirements.

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback