Instance groups
5G Express Cloud Connect supports instance groups. You can use instance groups to manage instances and authorization rules. This topic describes how to manage instance groups.
Procedure
Log on to the 5G Express Cloud Connect console.
In the navigation pane on the left, choose Instance Groups > Create Instance Group.
Enter a name for the instance group.
Click OK.
Click an instance group to open its details page. Choose Instance Management > Add Instance.
Select the 5G Express Cloud Connect instances that you want to add to the group.
NoteInstances that you add to an instance group must have empty custom authorization rules.
On the instance group details page, configure authorization rules. Choose Authorization Rules > Authorization Rules > Add Rule.
Configuration
Description
Rule Name
Enter a name for the authorization rule.
The name must be 2 to 128 characters in length. It must start with a letter and can contain digits, periods (.), underscores (_), and hyphens (-).
Purpose
Configure the destination address to access.
Select a destination type. Valid values are Domain Name or CIDR Block.
Enter the destination address. This can be a domain name or a CIDR block, depending on the selected destination type.
Protocol Type
Configure the protocol type for the access policy.
icmp: Internet Control Message Protocol.
tcp: Transmission Control Protocol.
udp: User Datagram Protocol.
all: Applies to all protocols.
Port Range
The destination port range. The value range is:
For TCP and UDP protocols: 1 to 65535. Use a forward slash (/) to separate the start and end ports. For example: 1/200.
For the ICMP protocol: -1/-1.
For ALL protocols: -1/-1.
Action
Select an action for the access policy. Valid values are Allow and Deny.
Allow: Allows IoT devices to access the configured address.
Deny: Prevents IoT devices from accessing the configured address.
NoteYou can configure a wildcard domain name. The destination address then automatically matches the subdomains of the wildcard domain name.
If both a wildcard domain name (such as *.example.com) and an exact-match domain name (such as www.example.com) are configured, the rule for the exact-match domain name takes precedence.
After you configure a domain name or a wildcard domain name, the rule takes about 5 seconds to take effect the first time an IoT device accesses the domain name.
On the instance group details page, configure DNS rules. Choose Authorization Rules > DNS Rules > Add Rule.
Configuration
Description
Rule Name
Enter a name for the DNS authorization rule.
The name must be 2 to 128 characters in length. It must start with a letter and can contain digits, periods (.), underscores (_), and hyphens (-).
Source DNS
Enter the IP address for the source DNS authorization rule. The IP address can be, but is not limited to, one of the following:
100.100.2.136
100.100.2.137
100.100.2.138
114.114.114.114
8.8.8.8
223.5.5.5
223.6.6.6
119.29.29.29
If you receive the IllegalParam.SourceNotDNSIP error code when you enter the IP address for the source DNS authorization rule, submit a ticket. In the ticket, include the IP address of the DNS authorization rule that you want to request.
Destination DNS
Enter the IP address of the destination DNS to redirect requests from an old DNS address to a new one. This is useful when the DNS address for a domain that your IoT device accesses has changed.
Note: After a DNS is configured as a destination DNS, it cannot be configured as a source DNS.
Note5G Express Cloud Connect allows IoT devices to connect to the cloud over a dedicated Access Point Name (APN) network. You must configure authorization rules for the IoT SIM cards that use this network. IoT SIM cards that are associated with an instance group can access only the addresses that are configured in the authorization rules. The authorization rules for 5G Express Cloud Connect support IP addresses and domain names. If you configure an authorization rule for a domain name, you must also configure the DNS server address. 5G Express Cloud Connect also supports DNS redirection.