Use PrivateLink to resolve CIDR block conflicts in data centers

Step 1: Create an endpoint

1. Log on to the VPC console. On the Endpoints page, click Create Endpoint.

2. On the Create Endpoint page, configure the following parameters. For more information, see Create and manage endpoints.

   For Alibaba Cloud Service endpoints, you must submit a ticket to be added to the whitelist. By default, you can add an endpoint to up to five security groups. You can configure zones in the following ways: - Single zone: Select one zone of the endpoint service. Click the icon in the Zone and vSwitch section, and then click OK in the message that appears. - Multiple zones: By default, you must select at least two zones and one vSwitch in each zone. To add more zones, click Add vSwitch. - You can select multiple zones to ensure that if any zone fails, applications can quickly switch to others. This provides high service availability and stability, and prevents service interruptions or data loss. - When you create an endpoint for the first time, the system automatically creates a service-linked role for the endpoint. This role allows the endpoint to access other resources. For more information, see service-linked role.

   Parameter	Description
   Region	Select the region to which the endpoint belongs.
   Endpoint Name	Specify a name for the endpoint.
   Endpoint Type	Select Interface Endpoint.
   Endpoint Service	Select Alibaba Cloud Service, and then enter the name of the endpoint service.
   VPC	Select the VPC where you want to create the endpoint.
   Security Group	Select the security group to associate with the elastic network interface (ENI) of the endpoint. The security group controls data transfer from the VPC to the endpoint ENI. The endpoint ENI serves as the entry point for the endpoint VPC to access the endpoint service.
   Zone and vSwitch	Select the zone of the endpoint service and select a vSwitch in that zone. The system automatically creates an endpoint ENI in the vSwitch.
   Resource Group	Select the resource group to which the endpoint belongs.
   Tag	Configure the Tag Key and Tag Value.
   Description	Enter a description for the endpoint.
   Access Policies	Select an access policy: Default Policy uses the full access policy by default. Custom Policy allows you to enter a custom access policy.

3. After you complete the configuration, click OK.

Step 2: Verify the DNS resolution

After the endpoint is created, verify that DNS resolution is properly configured:

1. Log on to the Alibaba Cloud DNS console.

2. In the left navigation pane, click Private DNS (PrivateZone), and then click the Cloud Service Defined Zones tab to view the default resolved domain name.

   In the search bar, filter by Zone and enter vpc-vpc.cn-hangzhou.aliyuncs.com to view the built-in authoritative zone record, including the zone scope (Alibaba Cloud VPC: 1), the number of resolution records, the zone type (normal zone), and the cloud product (PrivateLink).

3. Click the domain name in the Built-in Authoritative Zone column to view the resolution records.

   On the resolution records page of Alibaba Cloud DNS PrivateZone, you can view the resolution records of the built-in authoritative zone, for example acc-vpc.cn-hangzhou.aliyuncs.com. A message at the top of the page states that the cloud product PrivateLink automatically created this internal private domain name. You cannot make any changes to the zone, and you can only view its resolution records. The resolution record list contains the following fields:

   • Host: for example, @

   • Type: for example, A

   • Resolution Request Source: default

   • Value: the corresponding internal IP address

   • TTL: for example, 15 seconds

   • Status: Enabled or Disabled