How Enterprise Switches Work

Figure 1 illustrates how an enterprise switch works. Table 1 describes the working principles in more detail.

Figure 1 Networking

**Table 1** Working principles
No.	Action	Description
1	Enable the local and remote tunnel subnets to communicate at Layer 3.	Plan resources on and off the cloud. For details, see Table 2. Use VPN to enable the local (Subnet-tunnel-L01) and remote (Subnet-tunnel-R01) tunnel subnets to communicate at Layer 3.
2	Create an enterprise switch and specify a tunnel subnet.	Create an enterprise switch, set the local tunnel subnet to Subnet-tunnel-L01, and the local tunnel IP address to 192.168.100.101.
3	Create a Layer 2 connection.	Create a Layer 2 connection to enable the local Layer 2 connection subnet (Subnet-layer-L01) and the remote VXLAN switch to communicate at Layer 2. Configure the following parameters: Active and standby interface IP addresses: They can be automatically assigned or manually specified. Remote tunnel IP address (200.51.51.100) and tunnel VNI (10001)
4	Configure a tunnel gateway in the on-premises data center.	Configure a tunnel gateway on the remote VXLAN switch to establish a VXLAN tunnel for the remote Layer 2 connection subnet (Subnet-layer-R01).

**Table 2** Resource details
Resource	Cloud (Local)		On Premises (Remote)
Layer 2 connection subnet	VPC subnet	Subnet-layer-L01: 192.168.0.0/24	On-premises subnet	Subnet-layer-R01: 192.168.0.0/24
	ECS	ECS-layer-L01-A: 192.168.0.50 ECS-layer-L01-B: 192.168.0.51	On-premises server	VM-layer-R01-A: 192.168.0.60 VM-layer-R01-B: 192.168.0.61
	Active and standby interface IP addresses	Active interface IP address: 192.168.0.7 Standby interface IP address: 192.168.0.8	-	-
Tunnel subnet	VPC subnet	Subnet-tunnel-L01: 192.168.100.0/24	On-premises subnet	Subnet-tunnel-R01: 200.51.51.0/24
Tunnel subnet	Tunnel IP address	192.168.100.101	Tunnel IP address	200.51.51.100
Tunnel VNI	10001

Layer 2 Connection Subnets

A local Layer 2 connection subnet is on the cloud and a remote one is in an on-premises data center. They are used to communicate at Layer 2.

Local Layer 2 connection subnet: a VPC subnet, for example, Subnet-layer-L01
Remote Layer 2 connection subnet: an on-premises subnet, for example, Subnet-layer-R01

Constraints

The local and remote Layer 2 connection subnets can overlap, but the IP addresses of the servers that need to communicate in the local and remote subnets must be different. Otherwise, the communication fails.
A VPC subnet that has been used a Layer 2 connection cannot be used by any other Layer 2 connections or enterprise switches.

Tunnel Subnets

Local and remote tunnel subnets communicate with each other at Layer 3 over VPN. Enterprise switches allow communications between cloud and on-premises networks at Layer 2 based on the Layer 3 network between tunnel subnets.

Local tunnel subnet: a VPC subnet, for example, Subnet-tunnel-L01
Remote tunnel subnet: an on-premises subnet, for example, Subnet-tunnel-R01

Constraints

Ensure that the local and remote tunnel subnets can communicate at Layer 3 over VPN before you use an enterprise switch to allow communication at Layer 2.
The switch in an on-premises data center must support VXLAN because the enterprise switch needs to establish a VXLAN tunnel to the data center at Layer 2.
The local tunnel subnet must have three IP addresses reserved for the enterprise switch.

Layer 2 Connections

After an enterprise switch is created, you need to create a Layer 2 connection to enable the local Layer 2 connection subnet and the remote VXLAN switch to communicate at Layer 2.

Constraints

Each Layer 2 connection connects a local and a remote Layer 2 connection subnet. Each enterprise switch supports a maximum of six Layer 2 connections.
The Layer 2 connections of an enterprise switch can share a tunnel IP address, but their tunnel VNIs must be unique. A tunnel VNI is the identifier of a tunnel.
If a Layer 2 connection connects a local Layer 2 connection subnet to an enterprise switch, the local Layer 2 connection subnet must have two IP addresses reserved as active and standby interface IP addresses. The two IP addresses cannot be used by any local resources and must be different from the IP addresses in the remote Layer 2 connection subnet.

Active and Standby Interface IP Addresses

If a Layer 2 connection connects a local Layer 2 connection subnet to an enterprise switch, the local Layer 2 connection subnet must have two IP addresses reserved as active and standby interface IP addresses.

Tunnel IP Addresses

If an enterprise switch establishes a VXLAN tunnel with an on-premises data center at Layer 2, each end of the VXLAN tunnel requires a tunnel IP address (the local and remote tunnel IP addresses). The two IP addresses must be different.

Local tunnel IP address: in the local tunnel subnet. In this example, the local tunnel subnet is Subnet-tunnel-L01, and the tunnel IP address is 192.168.100.101.
Remote tunnel IP address: in the remote tunnel subnet. In this example, the remote tunnel subnet is Subnet-tunnel-R01, and the tunnel IP address is 200.51.51.100.