CreateCenRouteMap-阿里云帮助中心

Route policies let you filter routing information and customize your cloud network connectivity. You can call the CreateCenRouteMap API to create a route policy.

Operation description

Route maps are processed in order of priority. A lower value indicates a higher priority. Each route map consists of a set of match conditions and an action. The system evaluates a route against the match conditions of route maps in descending order of priority. If a route meets all match conditions in a route map, the system applies the corresponding action to either permit or deny the route. If a route is permitted, you can also modify its route attributes. If a route does not match any route map, the system permits it by default. For more information, see Route map overview.

The CreateCenRouteMap API is asynchronous. When you call this API, the system returns a route map ID while the route map is being created in the background. You can call the DescribeCenRouteMaps API to query the route map's status.

A status of Creating indicates that the route map is being created. In this state, you can only perform query operations.
A status of Active indicates that the route map has been created.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cen:CreateCenRouteMap

create

*CenInstance

acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}

None

Request parameters

Parameter	Type	Required	Description	Example
CenId	string	Yes	The ID of the Cloud Enterprise Network (CEN) instance.	cen-7qthudw0ll6jmc****
CenRegionId	string	Yes	The ID of the region where the route map is applied. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-hangzhou
TransmitDirection	string	Yes	The direction in which the route map is applied. Valid values: RegionIn: The inbound direction. The route map is applied to routes that are advertised to the region gateway. For example, routes are advertised from a network instance in the current region to the region gateway, or from another region to the region gateway in the current region. RegionOut: The outbound direction. The route map is applied to routes that are advertised from the region gateway. For example, routes are advertised from the region gateway in the current region to a network instance in the current region, or to a region gateway in another region.	RegionIn
Description	string	No	The description of the route map. The description can be empty or 1 to 256 characters long. It cannot start with `http://` or `https://`.	desctest
Priority	integer	Yes	The priority of the route map. The value can be an integer from 1 to 100. A smaller value indicates a higher priority. Note The priorities of route maps that are applied in the same region and direction must be unique. The system matches a route against these maps in ascending order of priority. Therefore, set priorities carefully to ensure the desired matching order.	3
MapResult	string	Yes	The action to take if a route matches all conditions. Valid values: Permit: Permits routes that match the conditions. Deny: Denies routes that match the conditions.	Permit
NextPriority	integer	No	The priority of the next associated route map. You can specify this parameter only when `MapResult` is set to `Permit`. Permitted routes proceed to the next associated route map for further matching. The next associated route map must be in the same region and have the same direction as the current route map. The priority of the next associated route map must be lower than that of the current route map.	20
CidrMatchMode	string	No	The match mode for the prefix list. Valid values: Include: fuzzy match. A route is matched if a prefix in the match conditions includes the prefix of the route. For example, a prefix of 10.10.0.0/16 in the match conditions matches the route 10.10.1.0/24. Complete: exact match. A route is matched only if the prefix of the route is the same as a prefix in the match conditions. For example, a prefix of 10.10.0.0/16 in the match conditions matches only the route 10.10.0.0/16.	Include
AsPathMatchMode	string	No	The match mode for the AS Path list. Valid values: Include: fuzzy match. A route is matched if its AS Path overlaps with the AS Path list in the match conditions. Complete: exact match. A route is matched only if its AS Path is identical to the sequence of AS numbers specified in the match conditions.	Include
CommunityMatchMode	string	No	The match mode for the community attribute. Valid values: Include: fuzzy match. A route is matched if its community attribute contains at least one of the communities specified in the match conditions. Complete: exact match. A route is matched only if its community attribute is identical to the community attribute in the match conditions.	Include
CommunityOperateMode	string	No	Specifies how to modify the community attribute of a matching route. Valid values: Additive: adds the specified communities to the route. Replace: replaces the original communities of the route with the specified communities.	Additive
Preference	integer	No	The new preference value to set for matching routes. The value can be an integer from 1 to 100. The default preference is 50. A smaller value indicates a higher preference.	50
SourceInstanceIdsReverseMatch	boolean	No	Specifies whether to perform a reverse match for the source instance IDs. Valid values: false (default): A route is matched if its source instance ID is in the `SourceInstanceIds` list. true: A route is matched if its source instance ID is not in the `SourceInstanceIds` list.	false
DestinationInstanceIdsReverseMatch	boolean	No	Specifies whether to perform a reverse match for the destination instance IDs. Valid values: false (default): A route is matched if its destination instance ID is in the `DestinationInstanceIds` list. true: A route is matched if its destination instance ID is not in the `DestinationInstanceIds` list.	false
MatchAddressType	string	No	The IP version of routes to match. Valid values: IPv4: Matches only IPv4 routes. IPv6: Matches only IPv6 routes. If you do not specify this parameter, the route map matches routes of all IP versions.	IPv4
TransitRouterRouteTableId	string	No	The ID of the route table of the Transit Router. If you do not specify a route table ID, the system automatically associates the route map with the default route table of the Transit Router.	vtb-gw8nx3515m1mbd1z1****
SourceInstanceIds	array	No	The source instance IDs to match. The following instance types are supported: VPC VBR CCN Smart Access Gateway (SAG) IPsec connection You can enter up to 64 instance IDs.	vpc-adeg3544fdf34vf****
	string	No	The source instance IDs to match. The following instance types are supported: VPC VBR CCN Smart Access Gateway (SAG) IPsec connection You can enter up to 64 instance IDs.	vpc-adeg3544fdf34vf****
DestinationInstanceIds	array	No	The destination instance IDs to match. The following instance types are supported: VPC VBR CCN Smart Access Gateway (SAG) IPsec connection You can enter up to 64 instance IDs. Note This condition is evaluated only when the route map is applied in the outbound direction and to destination instances in the same region as the route map.	vpc-afrfs434465fdf****
	string	No	The destination instance IDs to match. The following instance types are supported: VPC VBR CCN Smart Access Gateway (SAG) IPsec connection You can enter up to 64 instance IDs. Note This condition is evaluated only when the route map is applied in the outbound direction and to destination instances in the same region as the route map.	vpc-afrfs434465fdf****
SourceRouteTableIds	array	No	The source route table IDs to match. You can enter up to 64 route table IDs.	vtb-adfr233vf34rvd4****
	string	No	The source route table IDs to match. You can enter up to 64 route table IDs.	vtb-adfr233vf34rvd4****
DestinationRouteTableIds	array	No	The destination route table IDs to match. You can enter up to 64 route table IDs. Note This parameter takes effect only when the route map is applied in the outbound direction and the destination route table belongs to a network instance in the same region as the route map.	vtb-adefrgtr144vf****
	string	No	The destination route table IDs to match. You can enter up to 64 route table IDs. Note This parameter takes effect only when the route map is applied in the outbound direction and the destination route table belongs to a network instance in the same region as the route map.	vtb-adefrgtr144vf****
SourceRegionIds	array	No	The source region IDs to match. You can enter up to 64 region IDs. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-beijing
	string	No	The source region IDs to match. You can enter up to 64 region IDs. You can call the DescribeChildInstanceRegions operation to query region IDs.	cn-beijing
SourceChildInstanceTypes	array	No	The source instance types to match. The following instance types are supported: VPC VBR CCN VPN: VPN gateway or IPsec connection. This value applies when an IPsec connection or an SSL server is bound to a VPN gateway that uses BGP routing and whose associated VPC is attached to a Transit Router. This parameter also takes effect if an IPsec connection is directly attached to a Transit Router. You can enter multiple instance types.	VPC
	string	No	The source instance types to match. The following instance types are supported: VPC VBR CCN VPN: VPN gateway or IPsec connection. This value applies when an IPsec connection or an SSL server is bound to a VPN gateway that uses BGP routing and whose associated VPC is attached to a Transit Router. This parameter also takes effect if an IPsec connection is directly attached to a Transit Router. You can enter multiple instance types.	VPC
DestinationChildInstanceTypes	array	No	The destination instance types to match. The following instance types are supported: VPC VBR CCN VPN: IPsec connection. Note For the VPN type, this condition applies only to IPsec connections that are directly attached to the Transit Router. It does not apply to IPsec connections or SSL servers that are bound to a VPN gateway. You can enter multiple instance types. Note The list of destination instance types takes effect only when the route map is applied in the outbound direction and the destination instance is in the same region as the route map.	VPC
	string	No	The destination instance types to match. The following instance types are supported: VPC VBR CCN VPN: IPsec connection. Note For the VPN type, this condition applies only to IPsec connections that are directly attached to the Transit Router. It does not apply to IPsec connections or SSL servers that are bound to a VPN gateway. You can enter multiple instance types. Note The list of destination instance types takes effect only when the route map is applied in the outbound direction and the destination instance is in the same region as the route map.	VPC
DestinationCidrBlocks	array	No	A list of destination prefixes to match. Specify up to 64 prefixes in CIDR notation. Both IPv4 and IPv6 prefixes are supported.	10.10.10.0/24
	string	No	A list of destination prefixes to match. Specify up to 64 prefixes in CIDR notation. Both IPv4 and IPv6 prefixes are supported.	10.10.10.0/24
RouteTypes	array	No	The route types to match. The following route types are supported: System: system routes that are automatically generated by the system. Custom: custom routes that are manually added by users. BGP: Routes learned from BGP peers. You can enter multiple route types.	System
	string	No	The route types to match. The following route types are supported: System: system routes that are automatically generated by the system. Custom: custom routes that are manually added by users. BGP: Routes learned from BGP peers. You can enter multiple route types.	System
MatchAsns	array	No	The AS Path to match. You can enter up to 64 AS numbers. Note You must specify the path as a sequence of AS numbers. Other formats, such as AS_SET, AS_CONFED_SEQUENCE, and AS_CONFED_SET, are not supported.	65501
	integer	No	The AS Path to match. You can enter up to 64 AS numbers. Note You must specify the path as a sequence of AS numbers. Other formats, such as AS_SET, AS_CONFED_SEQUENCE, and AS_CONFED_SET, are not supported.	65501
MatchCommunitySet	array	No	The community set to match. Each community must be in the `n:m` format, where n and m are integers from 1 to 65535. The community must comply with RFC 1997. Large Community (RFC 8092) is not supported. You can enter up to 64 communities. Note Incorrectly configuring the community can prevent routes from being advertised to your on-premises data center.	65501:1
	string	No	The community set to match. Each community must be in the `n:m` format, where n and m are integers from 1 to 65535. The community must comply with RFC 1997. Large Community (RFC 8092) is not supported. You can enter up to 64 communities. Note Incorrectly configuring the community can prevent routes from being advertised to your on-premises data center.	65501:1
OperateCommunitySet	array	No	The community set to apply. Each community must be in the `n:m` format, where n and m are integers from 1 to 65535. The community must comply with RFC 1997. Large Community (RFC 8092) is not supported. You can enter up to 32 communities. Note Incorrectly configuring the community can prevent routes from being advertised to your on-premises data center.	65501:1
	string	No	The community set to apply. Each community must be in the `n:m` format, where n and m are integers from 1 to 65535. The community must comply with RFC 1997. Large Community (RFC 8092) is not supported. You can enter up to 32 communities. Note Incorrectly configuring the community can prevent routes from being advertised to your on-premises data center.	65501:1
PrependAsPath	array	No	The AS Path to prepend when the region gateway receives or advertises a route. The requirements for prepending an AS Path vary based on the direction in which the route map is applied: If the route map is applied in the inbound direction, you must specify the source instance IDs and source region in the match conditions, and the source region must be the same as the region where the route map is applied. If the route map is applied in the outbound direction, you must specify the destination instance IDs in the match conditions. This action is applied to matching routes. You can enter up to 32 AS numbers.	65501
	integer	No	The AS Path to prepend when the region gateway receives or advertises a route. The requirements for prepending an AS Path vary based on the direction in which the route map is applied: If the route map is applied in the inbound direction, you must specify the source instance IDs and source region in the match conditions, and the source region must be the same as the region where the route map is applied. If the route map is applied in the outbound direction, you must specify the destination instance IDs in the match conditions. This action is applied to matching routes. You can enter up to 32 AS numbers.	65501
DestinationRegionIds	array	No	The destination region IDs to match. You can enter up to 64 region IDs.
	string	No	The destination region IDs to match. You can enter up to 64 region IDs.	cn-beijing

Response elements

Element	Type	Description	Example
	object	The response data.
RouteMapId	string	The ID of the route map.	cenrmap-w4yf7toozfol3q****
RequestId	string	The request ID.	62172DD5-6BAC-45DF-8D44-56SDF467BAC

Examples

Success response

JSON format

{
  "RouteMapId": "cenrmap-w4yf7toozfol3q****",
  "RequestId": "62172DD5-6BAC-45DF-8D44-56SDF467BAC"
}

Error codes

HTTP status code	Error code	Error message	Description
400	Forbidden.CenRouteMapExist	The specified CEN route map ID already exists.	The specified CEN route map ID already exists.
400	Invid.Parameter	When using PrependAsPath in the RegionIn, SourceRegionId must be local region Id.
400	InvalidOperation.NoEffictiveAction	No effective action be configured.	The error message returned because the specified action is invalid.
400	IncorrectStatus.TransitRouterInstance	The status of TransitRouter is incorrect.	The error message returned because the transit router is in an invalid state.
400	InvalidDescription	Description is invalid.	The error message returned because the description is invalid.
400	IllegalParam.ZoneId	The specified ZoneId is illegal.	The error message returned because the specified zone is invalid.
400	Forbidden.NoMedAuthorized	Med operation is unauthorized.	Unable to operate on the specified Med routing policy.
400	InvalidOperation.MedRouteMapExist	Operation is invalid because the default med route map already exist.	The operation is invalid because there is already a med routeMap with the next hop destination for this Ecr instance.
400	InvalidOperation.MedRouteMapNotAllowedOtherAction	Operation is invalid because the default med not allowed other action.	the med policy does not allow to configure other policies.
400	InvalidOperation.MedRouteMapActionMustPermit	Operation is invalid because the default med map result must be permit.	Operation is invalid because the default med map result must be permit.
400	InvalidParameter.MedRouteMapDestInstanceIds	Param DestInstanceIds must be ecr instance id.	The destination instance list of med routeMap must be ECR instance.
400	InvalidParameter.MedRouteMapDestInstanceType	Param DestChildInstanceTypes must be ecr.	The destination instance type of the med routeMap must be ECR.
400	InvalidParameter	Invalid parameter.	The error message returned because the parameter is set to an invalid value.
400	Unauthorized	The AccessKeyId is unauthorized.	The error message returned because you do not have the permissions to perform this operation.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.