Enabling Mutual Access Between Servers in Overlapping Subnets on the Cloud

Scenarios

The existing network architecture of the on-premises data center needs to be migrated to the cloud without any changes. In addition, servers in two overlapping CIDR blocks in the on-premises data center can access each other.

Department A and department B in the same on-premises data center have an overlapping subnet. Workloads of the two departments need to be migrated to a cloud without changing CIDR blocks of their subnets. In addition, the overlapping subnets of the two departments should be able to communicate with each other after the migration.

Solution Architecture

• Department A and department B of two subsidiaries use the same CIDR block (192.168. 0.0/24), so two VPCs with the same CIDR block are created on the cloud.
• The department A and B servers both used 192.168.0.3, so they were respectively assigned 10.1.0.11 and 10.2.0.22, as transit addresses. These transit addresses enabled the two servers to communicate with each other.

Figure 1 Logical topology

Manually configure the following routes to ensure traffic forwarding:

• VPC (department A) to the private NAT gateway A
• Transit VPC1 to the VPC peering connection
• Transit VPC2 to the VPC peering connection
• VPC (department B) to the private NAT gateway B

Solution Advantages

CIDR blocks of department A and department B are kept unchanged after on-premises workloads are migrated to the cloud.

Resource and Cost Planning

Prerequisites

• You have registered a Huawei Cloud account.
• Your Huawei Cloud account is not in arrears and the account balance is sufficient to pay for the resources involved in this best practice.
• A private NAT gateway is available.
  

  • Private NAT gateways are free for a limited time in the following regions: CN East-Shanghai2, CN-Hong Kong, LA-Sao Paulo1, AF-Johannesburg, and LA-Mexico City2.
  • Private NAT gateways are billed in the following regions: CN South-Guangzhou, CN East-Shanghai1, CN North-Beijing4, AP-Bangkok, AP-Singapore, and CN Southwest-Guiyang1.

Procedures

1. Creating VPCs
2. Creating ECSs
3. Buying Private NAT Gateways
4. Configuring Routes and Peering Connections
5. Verifying Communication Between the Server in Departments A and that in Department B

Creating VPCs

1. Log in to the Huawei Cloud management console and select the CN-Hong Kong region.
2. Under Networking, select Virtual Private Cloud. On the Virtual Private Cloud page displayed, click Create VPC.
3. Configure a VPC for department A based on Table 1 and click Create Now.
   • Region: CN-Hong Kong
   • Name: Set it to vpc-departmentA.
   • IPv4 CIDR Block: Set it to 192.168. 0.0/24.
   • Name: Set it to subnet-A.
   • IPv4 CIDR Block: Retain the default value.
   • For parameters not mentioned, retain their default values or configure them as prompted.

4. Repeat 2 and 3 to create all required VPCs.
   Figure 2 Creating a VPC
   

Creating ECSs

1. Under Compute, select Elastic Cloud Server. On the Elastic Cloud Server page displayed, click Buy ECS.
2. Based on Table 1, configure basic information about the ECS of department A and click Next: Configure Network.
   • Billing Mode: Select Pay-per-use.
   • Region: Select CN North-Beijing4.
   • Specifications: You can select ECS specifications based on your project requirements. This example uses c6.large.2 as an example.
   • Image: Select Public image. This example uses a CentOS 8.0 image.
   • For parameters not mentioned, retain their default values or configure them as prompted.

3. Configure the network information of the ECS of department A and click Next: Configure Advanced Settings.
   • Network: Select VPC vpc-departmentA, select Manually specify IP address, and set the IP address to 192.168. 0.3 planned in Table 1.
   • Security Group: Select Sys-FullAccess. In this example, we will select a security group that allows all inbound and outbound traffic as the test security group, but you can select a different security group based on service requirements if needed.
   • EIP: Select Not required.
   • For parameters not mentioned, retain their default values or configure them as prompted.

4. Set the ECS name and password, and click Next: Confirm.
   • ECS Name: Set it to ecs-departmentA.
   • Login Mode: Select Password and enter a password.
   • For parameters not mentioned, retain their default values or configure them as prompted.

5. Confirm the ECS information, read the agreement and select the Agreement option, and click Submit to finish the ECS creation for department A.
6. In the ECS list, locate the row that contains the ECS for department A, and click Remote Login in the Operation column. In the displayed dialog box, click Log In under Other Login Modes.
7. Log in to the ECS as user root and check whether the private IP address of the ECS is the one you planned:

   ifconfig

   

8. Repeat 1 through 7 to create additional ECSs as needed.

Buying Private NAT Gateways

Assigning a transit IP address

1. On the management console, under Networking, select NAT Gateway. In the left navigation pane, choose Private NAT Gateways, and click the Transit IP Addresses tab.

   

2. Click Assign Transit IP Address and configure the parameters as follows:
   • Transit VPC: Select vpc-transit1.
   • Transit Subnet: Select ext_sub_T1.
   • Transit IP Address: Select Manual.
   • IP Address: Enter 10.1.0.11.

3. Click OK.
4. Repeat 1 through 3 to assign a transit IP address (10.2.0.22) for department B.
   • Transit VPC: Select vpc-transit2.
   • Transit Subnet: Select ext_sub_T2.
   • Transit IP Address: Select Manual.
   • IP Address: Enter 10.2.0.22.

   Buying a private NAT gateway and adding DNAT rules

5. Go back to the Private NAT Gateways page and click Buy Private NAT Gateway in the upper right corner.
6. Configure parameters to create a private NAT gateway for department A. Click Buy Now.
   • Region: Select CN-Hong Kong.
   • Name: Set it to private-nat-A.
   • VPC: Select vpc-departmentA.
   • For parameters not mentioned, retain their default values or configure them as prompted.

7. In the Private NAT gateway created dialog box that is displayed, click Add Rule, switch to the DNAT Rules tab page, and click Add DNAT Rule.
8. Configure the DNAT rule parameters and click OK.
   • Port Type: Select All ports.
   • Transit Subnet: Select ext_sub_T1.
   • Transit IP Address: Enter 10.1.0.11.
   • Instance Type: Select Server and the ECS of department A.

9. Go back to the Private NAT Gateway page and click Buy Private NAT Gateway in the upper right corner.
10. Configure parameters to create a private NAT gateway for department B. Click Buy Now.
    • Region: Select CN-Hong Kong.
    • Name: Set it to private-nat-B.
    • VPC: Select vpc-departmentB.
    • For parameters not mentioned, retain their default values or configure them as prompted.

11. In the Private NAT gateway created dialog box that is displayed, click Add Rule, switch to the DNAT Rules tab page, and click Add DNAT Rule.
12. Configure the DNAT rule parameters and click OK.
    • Port Type: Select All ports.
    • Transit Subnet: Select ext_sub_T2.
    • Transit IP Address: Select 10.2.0.22.
    • Instance Type: Select Server and the ECS of department B.

    

Configuring Routes and Peering Connections

To configure a route from a server to the private NAT gateway

1. Choose Networking > NAT Gateway. In the navigation pane on the left, choose Route Tables.
2. Click rtb-vpc-departmentA. On the Summary page, click Add Route.
3. Configure a route for the server in department A to access the private NAT gateway of department A and click OK.
   • Destination: Enter 0.0.0.0/0. (In actual operations, configure this parameter based on service requirements.)
   • Next Hop Type: Select NAT gateway.
   • Next Hop: The system automatically displays the private NAT gateway of department A.

   

4. Go back to the Route Tables page, click rtb-vpc-departmentB, and click Add Route.
5. Configure a route for the server in department B to access the private NAT gateway of department B and click OK.
   • Destination: Set it to 0.0.0.0/0.
   • Next Hop Type: Select NAT gateway.
   • Next Hop: The system automatically displays the private NAT gateway of department B.

   

   Configuring a VPC Peering Connection Between vpc-transit1 and vpc-transit2

6. In the navigation pane on the left of the Network Console page, choose VPC Peering, and click Create VPC Peering Connection.
7. Configure transit VPC1 as the local VPC and transit VPC2 as the peer VPC. Configure the following parameters and click OK.
   • Name: Set it to peering-TtoT.
   • Local VPC: Select vpc-transit1.
   • Peer VPC: Select vpc-transit2.
   • For parameters not mentioned, retain their default values or configure them as prompted.

   

8. Go back to the Network Console page and choose Route Tables in the navigation pane on the left.
9. Click rtb-vpc-transit1. On the Summary page, click Add Route.
10. Configure a route from vpc-transit1 to the VPC peering connection, and click OK.
    • Destination: Set it to 0.0.0.0/0.
    • Next Hop Type: Select VPC peering connection.
    • Next Hop: The system automatically displays the VPC peering connection.

    

11. Repeat 9 and 10, select rtb-vpc-transit2, configure the route from vpc-transit2 to the VPC peering connection, and click OK.

    

Verifying Communication Between the Server in Departments A and that in Department B

1. Under Compute, select Elastic Cloud Server. Log in to ecs-departmentA and ecs-departmentB using VNC, respectively.
2. On ecs-departmentA, verify that it can access the server in department B:

   ping 10.2.0.22

   

3. On ecs-departmentB, verify that it can access the server in department A:

   ping 10.1.0.11

   

   The servers in the overlapping subnets can now communicate with each other through the private NAT gateway.