Create an ECR connection

Background information

After you connect an on-premises data center to Alibaba Cloud by using a physical connection, you can use an ECR to establish low-latency communication with a Virtual Private Cloud (VPC). However, an ECR instance alone cannot enable the on-premises data center to communicate with networks connected by other methods, such as an IPsec-VPN connection. An ECR instance also does not enable communication between cloud networks. For example, VPC instances cannot communicate with each other through an ECR. To enable full-mesh communication between your on-premises data center and multiple cloud networks, you can connect both the ECR and VPC instances to a transit router. The transit router provides comprehensive connectivity between your on-premises and cloud networks.

Limits

• Only an Enterprise Edition transit router supports connections to ECR instances.

• If you connect a VPC instance to both a transit router and an ECR instance, you cannot enable route synchronization for the VPC connection on the transit router.

• You can connect an ECR instance to only one transit router in each region.

  For example, if you create two Cloud Enterprise Network (CEN) instances, each with its own transit router in the China (Hangzhou) region, an ECR instance can connect to only one of those transit routers, not both.

• For information about ECR quotas, see ECR quotas.

Route propagation limits

• If you connect an ECR instance to both a VPC instance and a transit router, routes cannot propagate between them through the ECR instance. As a result, the two instances cannot communicate with each other through the ECR instance.

• After you add a static route that points to an ECR instance or add a route prefix that points to an ECR instance to the route table of a transit router:

  • These routes do not propagate to the route table of the peer transit router over an inter-region connection. You can manually add a route to the ECR instance in the peer transit router's route table.

  • If you connect the transit router to a VPC instance and an IPsec-VPN connection and enable route synchronization for both connections, these routes can propagate to the route tables of the VPC instance and the IPsec-VPN connection.

• After you create an ECR connection, the system automatically adds a default route policy to all route tables of the transit router in the RegionOut direction. The policy has a Policy Priority of 5000 and an Policy Action of Deny. This route policy prevents routes from being propagated among IPsec-VPN connections, ECR instances, Virtual Border Router (VBR) instances, and Cloud Connect Network (CCN) instances.

  You can create a custom route policy with a higher priority to allow route propagation among IPsec-VPN connections, ECR instances, VBR instances, and CCN instances. This enables communication between these network instances. For more information, see Route policies.

Billing

After you connect a transit router to an ECR instance, you are charged a connection fee and a data processing fee for each ECR connection. For more information, see Billing.

Prerequisites

Before you connect a transit router to an ECR instance, make sure that the following requirements are met:

• You have created an ECR instance. For more information, see Create and manage an Express Connect Router (ECR).

• You have created a transit router instance. For more information, see Transit routers.

• A transit router supports connecting to ECR instances from the same account and from different accounts. Before connecting to an ECR instance from a different account, the transit router must first obtain authorization. For more information, see Cross-account network instance authorization.

Procedure

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, find the transit router instance in the target region. In the Actions column, click Create Connection.

4. On the Connection with Peer Network Instance page, configure the ECR instance and click OK.

   Parameter	Description
   Network Type	Select Express Connect Router (ECR).
   Region	Select the region of the transit router instance.
   Transit Router	The system automatically displays the ID of the transit router instance in the current region.
   Account	Select the account that owns the ECR instance. If the network instance and the transit router instance belong to the same Alibaba Cloud account, select My Account. If the network instance and the transit router instance belong to different Alibaba Cloud accounts, select Another Account and enter the ID of the Alibaba Cloud account (root account) that owns the network instance.
   Attachment Name	Enter a name for the ECR connection.
   Networks	Select the ECR instance that you want to connect.
   Route Prefix	Route prefixes are the routes that you allow a transit router to propagate to an ECR instance. You must specify route prefixes in the Express Connect console. After you specify a route prefix, the transit router no longer propagates the detailed routes from its route table to the ECR instance. Instead, the transit router propagates only the specified route prefix to the ECR instance. You can manage route prefixes only in the Express Connect console. For more information, see Create and manage VBR ECRs.
   Advanced Settings	When you create an ECR connection, the system enables the following advanced features by default: Associate with Default Route Table of Transit Router If you enable this feature, the system automatically associates the ECR connection with the default route table of the transit router. The transit router then forwards traffic from the ECR instance by looking up this route table. Propagate system routes to transit router route table The ECR instance advertises routes from your on-premises data center to the default route table of the transit router. Automatically Advertise Routes to ECR If this feature is enabled, the system automatically advertises routes from the route table associated with the ECR connection to the route table of the ECR instance. Important The Automatically Advertise Routes to ECR feature is enabled by default and you cannot disable it. If you have configured route prefixes for the transit router instance in the Express Connect console, the system advertises only the route prefixes to the ECR instance, not the routes from the route table of the transit router. You can clear the selected advanced features and then customize connectivity for the ECR instance by using routing features of the transit router, such as route association and route learning. For more information, see Route management.

Change an ECR connection's associated route table

After you create an ECR connection, you can change its associated transit router route table.

1. Log on to the CEN console.

2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

3. On the Basic Settings > Transit Router tab, click the ID of the transit router instance in the target region.

4. On the Intra-Region Connections tab, find the ECR connection and click the ECR connection ID.

5. In the Attachment Details pane, in the Basic Information section, click Associated Route Table next to Modify.

6. In the Modify Route Table dialog box, select the target transit router route table and click OK.