Connect VPCs across different regions

Use case

Assume that you have created two VPCs in different regions:

You can use the scenario-based networking tool to create a CEN instance, transit routers, VPC connections, an inter-region connection, and route configurations with one click to quickly establish private connectivity between the two VPCs across regions.

The scenario-based networking tool can automatically complete CEN configurations in batches, including creating a CEN instance, transit routers, VPC connections, and an inter-region connection, configuring associated forwarding, and enabling route learning. For details about the routes that are automatically configured, and how to add routes manually if your VPC CIDR blocks fall outside the three private CIDR blocks, see below.

Prerequisites

• Two VPCs in different regions have been created, and each VPC contains at least two vSwitches in different zones. If not, see VPCs and vSwitches.

• At least one ECS instance has been created in each VPC to verify network connectivity. If not, see Custom Launch.

• The security groups of the ECS instances allow the ICMP protocol for ping verification. For more information, see Security groups.

Configure the network

ping 172.16.0.1

Routing notes

In this example, the scenario-based networking tool automatically configures Associated forwarding and Route propagation to enable routing between the VPCs:

• CEN automatically adds three custom route entries, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, to the system route tables of VPC1 and VPC2. The next hop for each entry is the VPC connection. The two VPCs use these route entries to send traffic to the transit routers.

• The two transit routers automatically learn route entry information from the system route tables of VPC1 and VPC2 and forward traffic that arrives at the transit routers to the corresponding VPCs.

The following sections show route entries for the transit routers, VPC1, and VPC2 in this example to help you understand the routing. You can view route entries for the corresponding resources in the console:

• To view route entries for a transit router, see View route entries (Enterprise Edition).

• To view VPC route entries, see VPC route tables.

More operations

• Connect networks across more regions: If you need network connectivity across more regions, add more region tabs in the scenario-based networking tool and configure the corresponding VPCs. You can also manually create transit routers and inter-region connections in an existing CEN instance to expand the network. Before you begin, make sure that the VPC CIDR blocks do not overlap.

• Cross-region QoS traffic scheduling: For cross-region traffic, you can classify different types of service traffic by marking them and allocate bandwidth. CEN provides two scheduling modes: the basic rate-limiting mode is suitable for standard service isolation and rate limiting. For more information, see Basic rate limiting QoS. The priority scheduling mode uses a strict-priority preemption mechanism to ensure low-latency forwarding for critical services, such as financial transactions and real-time audio and video. For more information, see Priority-based QoS.

• Cross-region traffic analysis: Transit routers can capture traffic information transmitted over inter-region connections and generate flow logs. You can query and analyze the flow logs to understand cross-region traffic transmission.

• Network topology visualization: CEN can generate a topology based on your actual resources. On the CEN instance details page, click the Network Topology tab to view the topology for this example.

Cross-border scenario notes

If you need to create an inter-region connection between the Chinese mainland and an overseas region, such as Malaysia or Singapore, it is a cross-border network communication scenario. Note the following compliance requirements:

• Cross-border data transfer compliance commitment: After you select an overseas region as the peer region, the system displays the cross-border data transfer compliance commitment. Carefully read the commitment and select the agreement. You can continue to create the connection only after the OK button becomes available. Before you select the agreement, the OK button is disabled and you cannot create the connection.

• Cross-border bandwidth plan limitations: Since November 15, 2018, only customers who have submitted enterprise information can continue to use and purchase CEN cross-border bandwidth plans.

• For more compliance requirements, see [Cross-border compliance] Cloud Enterprise Network (CEN).

FAQ

• How are inter-region connections billed?

  For inter-region connections, you can choose pay-by-data-transfer or subscription billing by purchasing a bandwidth plan. For more information, see Billing overview.

• What bandwidth can a single inter-region connection provide for cross-region network connectivity?

  When you create an inter-region connection, if the bandwidth allocation method is pay-by-data-transfer, the maximum bandwidth for inter-region connectivity is subject to quota limits. For more information, see Quotas.

  If you allocate bandwidth from a bandwidth plan, the maximum bandwidth is the bandwidth value of the plan. For more information, see Purchase a bandwidth package.

• How do I release the resources created in this example?

  If you no longer need the resources created in this example, release them in the following order: delete the VPC connections, delete the inter-region connection, delete the transit routers, and then delete the CEN instance.

• After VPCs are connected across regions, can ECS instances access cloud services in other regions, such as ApsaraDB for Redis and MongoDB?

  Yes. You can use CEN to access cloud products, such as ApsaraDB services in other regions, over a private network if all of the following conditions are met:

  • The VPC where the ApsaraDB instance, such as Redis or MongoDB, resides and the VPC where the ECS instance resides have both been added to the same CEN instance, and an inter-region connection has been configured.

  • The security group of the ECS instance allows the IP address ranges of the VPC where the ApsaraDB instance in the destination region resides. The ApsaraDB whitelist, either an IP address whitelist or security group whitelist, contains the IP address range of the VPC where the ECS instance resides, and routes are configured correctly.

• Why do I need to agree to a compliance commitment when I create an inter-region connection?

  When an inter-region connection involves data transfer between the Chinese mainland and an overseas region, the system displays the cross-border data transfer compliance commitment in accordance with applicable laws and regulations. Carefully read the commitment and select the agreement before you create the connection. For more information, see [Cross-border compliance] Cloud Enterprise Network (CEN).

• What are the requirements for purchasing a cross-border bandwidth plan?

  Since November 15, 2018, only customers who have submitted enterprise information can continue to use and purchase CEN cross-border bandwidth plans. Complete enterprise information submission before you make a purchase.

• What should I note about cross-border data transfer?

  After you create a cross-border connection, business data in the cloud is transmitted to the selected overseas region, which may involve cross-border data transfer. Make sure that cross-border data transfers comply with applicable laws and regulations.