If your on-premises network needs to access cloud services, you must connect the Virtual Border Router (VBR) instance, IPsec connection, or Cloud Connect Network (CCN) instance associated with your on-premises network to a transit router. You must also connect a Virtual Private Cloud (VPC) instance from the same region as the cloud service to the transit router. After the connections are established, your on-premises network can access the VPC via the transit router and then access the cloud service through that VPC. A VPC instance can directly access cloud services in the same region without being connected to a transit router. If a VPC instance needs to access cross-region cloud services, it must also be connected to a transit router.
Background information
Cloud services are Alibaba Cloud products that operate on the 100.64.0.0/10 CIDR block, such as Object Storage Service (OSS), Log Service (SLS), and Data Transmission Service (DTS).
Limitations
-
A VPC can access a cloud service in a different region only through an Enterprise Edition transit router.
-
An on-premises network connected by an ipsec-vpn connection can access a cloud service only through an Enterprise Edition transit router.
-
If a Virtual Border Router (VBR) instance is connected to a Basic Edition transit router, the associated on-premises network can access only cloud services in the same region as the VBR.
For example, if a VBR instance is in the China (Beijing) region, the associated on-premises network can access only cloud services also deployed in the China (Beijing) region.
Prerequisites
-
Obtain the IP addresses or CIDR blocks of the cloud services that you want to access. For more information, see the documentation of the relevant cloud service.
For example, to obtain the IP addresses or CIDR blocks of OSS, see Access OSS by using endpoints and bucket domain names.
-
If you want to access a cloud service from an on-premises network:
-
Your on-premises network's Virtual Border Router (VBR) instance, ipsec-vpn connection, or Cloud Connect Network (CCN) instance is connected to a transit router. For more information, see Create a VBR connection, Create an ipsec-vpn connection, or Create a CCN connection.
-
A Virtual Private Cloud (VPC) in the same region as the cloud service is connected to the transit router. For more information, see Create a VPC connection.
-
If your on-premises network needs to access a cloud service in a different region, create an inter-region connection between the transit routers. For more information, see Inter-region connections.
-
-
To access a cloud service in a different region from a VPC:
-
The VPC used to access the cloud service is connected to a transit router.
-
A VPC in the same region as the cloud service is connected to a transit router. For more information, see Create a VPC connection.
-
An inter-region connection is created between the transit routers to which the VPCs are connected. For more information, see Inter-region connections.
-
Procedure
Enterprise Edition
Add an access configuration
Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
-
On the tab, click the transit router ID in the region where the cloud service is deployed.
-
On the details page of the transit router, click the Route Table tab.
-
In the left-side pane of the Route Table tab, select the target route table. On the Route Entry tab of the Route Table Details section, click Add Route Entry.
-
In the Add Route Entry dialog box, configure the parameters and click OK.
Parameter
Description
Route Table
The current route table is selected by default.
Transit Router ID
The current transit router instance is selected by default.
Name
Enter a name for the route entry.
Destination CIDR
Enter the IP address or CIDR block of the cloud service.
For example, enter the CIDR block
100.118.28.0/24, which is used by OSS in the China (Hangzhou) region.Blackhole Route
Specifies whether to configure a blackhole route. Valid values:
-
Yes: The route is a blackhole route. All traffic destined for this route is dropped.
-
No: The route is not a blackhole route. You must specify a next hop for the route.
For this topic, select No.
Next Hop
Select the next hop of the route entry.
Select the connection ID of the VPC connected to the transit router.
Description
Enter a description for the route entry.
ImportantIf the cloud service uses multiple IP addresses or CIDR blocks, repeat this procedure to add a configuration for each.
-
Delete an access configuration
Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
-
On the tab, click the transit router ID in the region where the cloud service is deployed.
-
On the details page of the transit router, click the Route Table tab.
-
On the Route Table tab, select the target route table in the left pane, and then in the Route Table Details section, on the Route Entry tab, find the route entry for the cloud service.
-
In the Actions column of the target route entry, click Delete. In the Delete Route Entry dialog box, click OK.
Configure access by using APIs
You can use tools such as Alibaba Cloud SDK (recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS) to call API operations to manage routes for cloud services in the route table of an Enterprise Edition transit router. For more information about the API operations, see the following topics:
-
CreateTransitRouterRouteEntry: adds a route entry to the route table of an Enterprise Edition transit router.
-
DeleteTransitRouterRouteEntry: deletes a static route entry from the route table of an Enterprise Edition transit router.
Related documents
Enable ECS instances to access OSS across regions over a private network
Basic Edition
Add an access configuration
Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
-
On the tab, click the ID of the transit router in the region where the cloud service is deployed.
-
On the details page of the transit router, click the Cloud Services tab.
-
On the Cloud Services tab, click Configure AnyTunnel.
-
In the Configure AnyTunnel dialog box, configure the parameters and click OK.
Parameter
Description
Service IP Address
Enter the IP address or CIDR block of the cloud service. For example, enter 100.118.28.0/24.
Service Domain Name (IP)
Select the region where the cloud service is deployed.
Host VPC
Select the VPC connected to the transit router.
Access Region
Select the region where the VBR or CCN instance used to access the cloud service is deployed.
Description
Enter a description for the cloud service.
ImportantIf the cloud service uses multiple IP addresses or CIDR blocks, repeat this procedure to add a configuration for each.
Delete an access configuration
Log on to the CEN console.
On the CEN Instance page, click the ID of the CEN instance that you want to manage.
-
On the tab, click the ID of the transit router in the region where the cloud service is deployed.
-
On the details page of the transit router, click the Cloud Services tab.
-
On the Cloud Services tab, find the target cloud service and click Delete in the Actions column.
-
In the Delete Route Service dialog box, click OK.
Configure access by using APIs
You can use tools such as Alibaba Cloud SDK (recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service (ROS) to call API operations to configure access to cloud services on a Basic Edition transit router. For more information about the API operations, see the following topics:
-
ResolveAndRouteServiceInCen: configures access to a cloud service on a Basic Edition transit router.
-
DescribeRouteServicesInCen: queries the cloud service configurations of a Basic Edition transit router.
-
DeleteRouteServiceInCen: deletes the cloud service configurations of a Basic Edition transit router.
FAQ
On-premises network cannot access cloud service
After you configure access on Alibaba Cloud, ensure that corresponding routes to the cloud service are also configured in your on-premises network. The method for adding these routes depends on your on-premises network environment.