Construction Procedure

Step 1: Create Cloud Resources

The following describes how to create an enterprise router, service VPC, and ECS. For details about these cloud resources, see Table 5.

1. Create an enterprise router.

   For details, see Creating an Enterprise Router.

2. Create a service VPC.

   For details, see Creating a VPC and Subnet.

3. Create an ECS.

   In this example, the ECS is used to verify the communication between the VPC and the data center. The ECS quantity and configuration are for reference only.

   For details, see Purchasing a Custom ECS.

Step 2: Attach the Global DC Gateway to the Enterprise Router

For details about Direct Connect resources, see Table 5.

1. Create a connection.

   For details, see Creating a Connection.

2. Create a global DC gateway and attach it to the enterprise router.
   1. On the Direct Connect console, create a global DC gateway.

      For details, see Creating a Global DC Gateway.

   2. On the enterprise router console, view the global DC gateway attachment created for the enterprise router.

      For details, see Viewing an Attachment.

      If the status of the global DC gateway attachment is Normal, the attachment has been successfully created.

      Default Route Table Association and Default Route Table Propagation are enabled when the enterprise router is created. After the global DC gateway is attached to the enterprise router, the system will automatically:

      • Associate the global DC gateway attachment with the default route table of the enterprise router.
      • Propagate the global DC gateway attachment to the default route table of the enterprise router, so that the routes to the on-premises data center are propagated to the route table.

        You can view routes to the data center in the route table of the enterprise router only after performing the following steps.

3. Create a virtual interface.

   Create a virtual interface to connect the global DC gateway to the on-premises data center. For details, see Step 3: Create a Virtual Interface.

4. Configure routes on the on-premises network device.

   The Direct Connect and VPN connections back up each other. Therefore, pay attention to the following when configuring routes:

   • The routing mode of the Direct Connect and VPN connections must be the same. In this example, BGP routing is used.
   • The route preference of the Direct Connect connection must be higher than that of the VPN connection.
   • The amount of time that the disconnection of Direct Connect and VPN connections is detected should be the same as that of the cloud network.

Step 3: Create a VPC Attachment to the Enterprise Router

1. Attach the service VPC to the enterprise router.

   When creating the VPC attachment, do not enable Auto Add Routes.

   NOTICE:

   If this function is enabled, the system automatically adds routes (with this enterprise router as the next hop and 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as the destinations) to all route tables of the VPC. In this example, you need to add a route to the VPC route table with destination set to the CIDR block of the on-premises data center and next hop set to enterprise router.

   For details, see Creating VPC Attachments for the Enterprise Router.

2. Check the route with destination set to the VPC CIDR block in the enterprise router route table.

   In this example, Default Route Table Association and Default Route Table Propagation are enabled for the enterprise router, and the system automatically adds routes pointing to VPC CIDR blocks when you attach the VPCs to the enterprise router.

   For details about the routes of the enterprise router, see Table 2 and Table 4.

   To view routes of the enterprise router, see Viewing Routes.

3. In the route table of the service VPC, add a route with next hop set to enterprise router.

   For details about VPC routes, see Table 3.

   For details about how to configure route information, see Adding Routes to VPC Route Tables.

Step 4: Verify the Network Connectivity Over the Direct Connect Connection

1. Log in to ecs-demo.

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   In this example, use VNC provided on the management console to log in to an ECS.

2. Check whether the service VPC can communicate with the data center through the enterprise router.

   ping Any IP address of the data center

   Example command:

   ping 192.168.3.10

   If information similar to the following is displayed, vpc-for-er can communicate with the data center through the enterprise router:

   [root@ecs-A02 ~]# ping 192.168.3.10
   PING 192.168.3.10 (192.168.3.102) 56(84) bytes of data.
   64 bytes from 192.168.3.102: icmp_seq=1 ttl=64 time=0.849 ms
   64 bytes from 192.168.3.102: icmp_seq=2 ttl=64 time=0.455 ms
   64 bytes from 192.168.3.102: icmp_seq=3 ttl=64 time=0.385 ms
   64 bytes from 192.168.3.102: icmp_seq=4 ttl=64 time=0.372 ms
   ...
   --- 192.168.3.102 ping statistics ---

Step 5: Create a VPN Attachment to the Enterprise Router

For details about the VPC used by VPN, see Table 5.

1. Create a VPC for the VPN gateway.

   For details, see Creating a VPC and Subnet.

   NOTICE:

   When creating a VPN gateway, you need to set VPC to this VPC and Interconnection Subnet to a subnet of this VPC. Ensure that the configured interconnection subnet has four or more assignable IP addresses.

2. Create a VPN gateway and attach it to the enterprise router.
   1. On the VPN management console, create a VPN gateway.

      For details, see Creating a VPN Gateway.

   2. On the enterprise router console, check whether the VPN gateway attachment has been added to the enterprise router.

      For details, see Viewing an Attachment.

      If the status of the VPN gateway attachment is Normal, the attachment has been added.

      Default Route Table Association and Default Route Table Propagation are enabled when you create the enterprise router. Therefore, after you add the VPN gateway attachment to the enterprise router, the system will automatically:

      • Associate the VPN gateway attachment with the default route table of the enterprise router.
      • Propagate the VPN gateway attachment to the default route table of the enterprise router. The routes to the on-premises data center are propagated to the route table.

        You can view routes to the data center in the route table of the enterprise router only after performing the following steps.

3. Create a customer gateway.

   For details, see Creating a Customer Gateway.

4. Create two VPN connections that will work in active/standby mode.
   1. Create the active VPN connection. For details, see Creating VPN Connection 1.
   2. Create the standby VPN connection. For details, see Creating VPN Connection 2.

5. Configure routes on the on-premises network device.

   The Direct Connect and VPN connections back up each other. Therefore, pay attention to the following when configuring routes:

   • The routing mode of the Direct Connect and VPN connections must be the same. In this example, BGP routing is used.
   • The route preference of the Direct Connect connection must be higher than that of the VPN connection.
   • The amount of time that the disconnection of Direct Connect and VPN connections is detected should be the same as that of the cloud network.

Step 6: Verify the Network Connectivity Over the VPN Connection

A VPN connection is a backup one. If you need to verify network connectivity of a VPN connection, you need to simulate a fault of the primary connection, that is, the Direct Connect connection.

1. Simulate a fault on the Direct Connect connection to ensure that the service VPC cannot communicate with the data center over the connection.
   NOTICE:

   Simulate a fault only when no service is running on the Direct Connect connection to prevent service interruptions.

2. Log in to ecs-demo.

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

   In this example, use VNC provided on the management console to log in to an ECS.

3. Check whether the service VPC can communicate with the data center through the enterprise router.

   ping Any IP address of the data center

   Example command:

   ping 192.168.3.10

   If information similar to the following is displayed, vpc-for-er can communicate with the data center through the enterprise router:

   [root@ecs-A02 ~]# ping 192.168.3.10
   PING 192.168.3.10 (192.168.3.102) 56(84) bytes of data.
   64 bytes from 192.168.3.102: icmp_seq=1 ttl=64 time=0.849 ms
   64 bytes from 192.168.3.102: icmp_seq=2 ttl=64 time=0.455 ms
   64 bytes from 192.168.3.102: icmp_seq=3 ttl=64 time=0.385 ms
   64 bytes from 192.168.3.102: icmp_seq=4 ttl=64 time=0.372 ms
   ...
   --- 192.168.3.102 ping statistics ---