Cloud Enterprise Network (CEN) is a highly available network service that runs on the Alibaba Cloud private global network. CEN uses a Transit Router (TR) to establish private communication channels between your Virtual Private Clouds (VPCs) across different regions and between your VPCs and on-premises data centers. This allows you to build a flexible, reliable, and scalable enterprise-grade cloud network.
Prerequisites
Before you begin, you should have a basic understanding of the following concepts:
Components
|
Diagram |
Component |
Description |
|
|
CEN instance |
A CEN instance is the fundamental resource for creating and managing an integrated, intelligent cloud network. It acts as a container for one or more transit routers. Within a CEN instance, you can use an inter-region connection to connect multiple transit routers and flexibly build an interconnected cloud network. |
|
|
Transit Router (TR) |
A Transit Router (TR) is a core regional network hub. It forwards traffic within the same region or across regions and supports flexible routing policies. You can create one transit router per region within a CEN instance. |
|
|
Network instance |
A network instance is a key building block of a cloud or on-premises network architecture. Common network instances include Virtual Private Cloud (VPC), Express Connect Router (ECR), Cloud Connect Network (CCN), IPsec-VPN connection, Virtual Border Router (VBR), and Transit Router (TR). A transit router connects to these network instances to enable traffic forwarding and communication between different network environments. |
|
|
Network instance connection |
Attaching a network instance to a transit router creates a network instance connection. These connections allow you to interconnect resources within the same region, across different regions, and between cloud and on-premises environments. To connect different types of network instances, you create the corresponding connection on the transit router: VPC connection, ECR connection, CCN connection, VPN connection, VBR connection, or inter-region connection. |
|
|
TR route table |
After a network instance is connected to a TR, the TR forwards traffic from the instance by looking up a route table. By default, each TR has a system route table and supports the creation of custom route tables. You can use features such as route association and route learning to define policies for communication, isolation, and traffic steering to meet your diverse networking requirements. |
Use cases
Typical interconnection scenarios for CEN include:
-
Intra-region VPC communication: Connect multiple VPCs in the same region.
-
Inter-region VPC communication: Connect VPCs in different regions.
-
Hybrid cloud communication: Connect multiple VPCs in the cloud to an on-premises data center.
Other use cases:
-
Filter traffic between VPCs
Use the route management capabilities of the transit router to direct traffic to a security appliance for inspection. This ensures that only filtered traffic is exchanged between VPCs, enhancing network security. For more information, see Use an Enterprise Edition transit router to implement secure traffic forwarding.
-
Allow isolated VPCs to access shared services
Use the route management capabilities of the transit router to allow multiple, isolated VPCs to access a shared service without enabling direct communication between the VPCs. For more information, see Allow isolated VPCs to access a shared service.
-
Inter-region QoS
The traffic scheduling feature allows you to mark different types of inter-region traffic and apply bandwidth limits based on these marks. This guarantees sufficient bandwidth for business-critical services and improves overall network efficiency. For more information, see Basic rate-limiting QoS.
-
Inter-region traffic analysis
The transit router provides the flow log feature. Flow logs help you capture traffic information for the transit router instance and for network instance connections, including inter-region, VPC, VPN, ECR, and VBR connections. For more information, see Flow logs.
-
Cloud multicast
After you connect network instances to a TR, you can create and manage a multicast network. The TR acts as a multicast router to forward multicast traffic between the connected network instances. For more information, see Multicast management.
CEN vs. Premium Bandwidth
Cloud Enterprise Network and Premium Bandwidth serve different networking scenarios. They have distinct functions, billing methods, and use cases.
|
Aspect |
Cloud Enterprise Network (CEN) |
Premium Bandwidth |
|
Function |
Enables private communication between VPCs across regions and between VPCs and on-premises data centers. |
Provides dedicated bandwidth for cloud instances such as Wuying Cloud Computer to guarantee network quality for a single instance. |
|
Billing |
Billed based on the number of network instance connections, traffic processed by the transit router, and inter-region bandwidth. |
Billed based on peak bandwidth or data transfer. |
|
Typical scenarios |
Connecting multiple VPCs, connecting VPCs to on-premises data centers, and enabling private network communication between ECS and Wuying Cloud Computer instances. |
Providing dedicated bandwidth for instances such as Wuying Cloud Computer to improve the network experience for a single instance. |
Premium Bandwidth does not support private network communication between different cloud product instances. To connect ECS instances and Wuying Cloud Computer instances over a private network, you must use Cloud Enterprise Network.
Benefits
|
Global interconnection |
Low latency and high throughput |
High reliability and quality |
|
A transit router can quickly connect VPCs and on-premises networks across multiple regions for global resource communication. An Enterprise Edition transit router supports up to 1,000 VPC connections in a single region to support growing enterprise networks. |
Transit routers provide low-latency, high-throughput network transmission. Intra-region communication can reach the port forwarding rate of network devices. Inter-region latency is significantly lower than that over the public internet. |
Forwarding nodes are deployed across multiple availability zones to forward traffic to the nearest node. If a node fails, traffic automatically fails over to another availability zone to ensure service continuity. Redundant, high-quality links connect all nodes on the network. If an underlying link fails, the network automatically reconverges without disrupting your services. |
|
Secure and flexible enterprise networking |
Pay-as-you-go and rapid delivery |
Centralized O&M |
|
A transit router supports custom routing policies to meet complex enterprise networking requirements. For example, you can implement complex network architectures such as isolated security domains, a unified Demilitarized Zone (DMZ) for outbound traffic, and service chaining. |
Transit routers support pay-as-you-go billing. For intra-region communication, you are charged only for connected network instances and traffic processed by the transit router. Inter-region links can be provisioned and modified on demand, eliminating upfront capital expenditure on equipment and circuits. |
The console provides visual management interfaces with geographic and resource-based views, allowing you to quickly visualize intra-region and inter-region network topologies. This helps you monitor the status of your entire network and improves O&M efficiency. |
Supported regions and zones for Transit Router
For more information, see Supported regions and availability zones for Transit Router.
Get started with CEN
-
Use the console: See the Connect VPCs in the same region quick start.