Create a VPC connection-Cloud Enterprise Network(CEN)-阿里云帮助中心

Connect a virtual private cloud (VPC) to a transit router to enable traffic exchange with other VPCs and data centers through Cloud Enterprise Network (CEN). Once connected, the VPC can communicate with any network instance attached to the same transit router — including VPCs in the same region, VPCs in other regions, and on-premises data centers.

Limitations

Before you start, check whether any of the following constraints apply to your setup:

Zone coverage: Resources in zones that have no associated vSwitch on the transit router cannot reach the transit router over the shortest path. Traffic is routed to the default elastic network interface (ENI) instead, which may increase latency.
vSwitch IP requirements when IPv6 is enabled: The transit router occupies one IPv4 address and one IPv6 address per vSwitch. Make sure each vSwitch has at least one idle address for both protocols.

How it works

When you attach a VPC to an Enterprise Edition transit router, the transit router creates one ENI per vSwitch. Each ENI occupies one IP address and forwards traffic between the VPC and the transit router.

The number of vSwitches required depends on the region:

Region type	Example	vSwitch requirement
Single-zone region	China (Nanjing - Local Region)	At least 1 vSwitch in the zone
Multi-zone region	China (Shanghai)	At least 2 vSwitches in different zones

In multi-zone regions, two vSwitches in different zones provide zone-disaster recovery, keeping traffic flowing if one zone goes down. To minimize latency, select one vSwitch per zone so that traffic uses the shortest path between the VPC and the transit router.

Route selection

Traffic from the initiator to the acceptor goes through three routing steps:

VPC to transit router: The initiator's vSwitch route table forwards the request to an ENI. If the initiator's zone is associated with the transit router, the request goes to the ENI in that zone. Otherwise, it goes to the default ENI, which the transit router selects randomly when the VPC connection is created.
Transit router to acceptor: The transit router queries its route table and forwards the request to the acceptor-side ENI using the same zone-matching logic. If the source ENI's zone is associated with the acceptor's VPC connection, the request goes to the ENI in that zone; otherwise it goes to the acceptor's default ENI.
ENI to acceptor: The request reaches the acceptor vSwitch and is routed to the destination based on the vSwitch route table.

Create a VPC connection using an Enterprise Edition transit router

Note

This section covers the upgraded Enterprise Edition transit router. For the unoptimized version, see How do I use an unoptimized Enterprise Edition transit router to create a VPC connection? For upgrade details, see Announcement: Optimization on VPC-connected Enterprise Edition transit routers.

Before you begin

A transit router exists in the region where the VPC resides. See Create a transit router.
The VPC has sufficient vSwitches with idle IP addresses in zones supported by the transit router. Each vSwitch needs at least one idle IP address. See Create a vSwitch.
Cross-account connections only: The transit router has the required permissions from the account that owns the VPC. See Acquire permissions to connect to a network instance that belongs to another account.
IPv6 traffic only: IPv6 is enabled on the VPC. See Enable IPv6 for a VPC.

Procedure

Log on to the CEN console.
On the Instances page, click the ID of the CEN instance.
On the Basic Information > Transit Router tab, find the transit router and click Create Connection in the Actions column.

On the Connection with Peer Network Instance page, configure the following parameters and click OK.

Note

The system automatically creates the service-linked role AliyunServiceRoleForCEN, which allows the transit router to create ENIs in vSwitches to forward data. See AliyunServiceRoleForCEN.

Parameter	Description
Instance type	Select Virtual Private Cloud (VPC).
Region	Select the region where the VPC resides.
Transit router	Automatically populated with the transit router in the selected region.
Resource owner ID	Select Current Account if the VPC belongs to the same Alibaba Cloud account. Select Different Account and enter the primary account ID if the VPC belongs to a different account.
Billing method	Set to Pay-as-you-go by default. See Billing description.
Attachment name	Enter a name for the VPC connection.
Network instance	Select the VPC to connect. Click Check route to check whether the VPC route tables contain entries for 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. If they do and the Automatically create route that points to transit router and add to all route tables of current VPC option in Advanced settings is enabled, the system stops automatically advertising those routes — you may need to add route entries manually.
IPv6	Disabled by default. Enable if the VPC needs IPv6 communication through the transit router. You can also enable IPv6 for existing VPC connections after creation.
vSwitch	Select vSwitches in zones supported by the transit router. For single-zone regions, select one vSwitch. For multi-zone regions, select at least two vSwitches in different zones. To reduce latency, select one vSwitch per zone.
Advanced settings	Three options are enabled by default: Associate with default route table of transit router (associates the VPC connection with the transit router's default route table), Propagate system routes to default route table of transit router (advertises VPC system routes to the transit router, enabling communication with other attached network instances), and Automatically create route that points to transit router and add to all route tables of current VPC (adds three routes — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — to all VPC route tables, with next hops pointing to the transit router; by default, transit routers do not advertise routes to VPCs). To customize routing, clear these checkboxes and configure route associations and propagation manually. See Route management. Note For IPv6 traffic, after creating the VPC connection, enable route synchronization or manually add IPv6 route entries pointing to the VPC connection in the VPC.
Tag	(Optional) Add tags to the VPC connection. Tag keys can be up to 64 characters; tag values can be blank or up to 128 characters. Neither can start with `acs:` or `aliyun`, or contain `http://` or `https://`. See Tags.

After the VPC connection is created, view it on the Intra-region Connections tab. See View network instance connections.

Create a VPC connection using a Basic Edition transit router

The Basic Edition transit router supports VPC connections within the same account or across accounts. For cross-account connections, obtain permissions from the peer VPC account first. See Cross-account instance authorization.

Log on to the CEN console.
On the Instances page, click the ID of the CEN instance.
On the Basic Information > Transit Router tab, find the transit router and click Create Connection in the Actions column.

On the Connection with Peer Network Instance page, configure the following parameters and click OK To Create.

Parameter	Description
Instance type	Select Virtual Private Cloud (VPC).
Region	Select the region where the VPC resides.
Transit router	Automatically populated with the transit router in the selected region.
Resource owner UID	Select Current Account if the VPC belongs to the same Alibaba Cloud account. Select Different Account and enter the primary account ID if the VPC belongs to a different account.
Network instance	Select the VPC to connect.

After the VPC connection is created, view it on the Intra-region Connections tab. See View network instance connections.

More operations

Edit zones and vSwitches of a VPC connection

Change the zones and vSwitches associated with a VPC connection after it is created. Before you begin, make sure no VPC routes point to the ENI of the Enterprise Edition transit router. See Create and manage a route table.

Warning

Changing the vSwitch of a VPC connection may interrupt the connection for up to 15 seconds.

Log on to the CEN console.
On the Instances page, click the ID of the CEN instance.
On the Basic Information > Transit Router tab, click the transit router ID.
On the Intra-region Connections tab, find the VPC connection and click its ID.
In the Attachment details panel, click Change zone/subnet in the Associated instances section.
In the Change zone/subnet dialog box, select the target zone and vSwitch, then click OK.

The selected zone and vSwitch are associated with the VPC connection. The previous vSwitch is automatically disassociated and its ENI is deleted.

Example: A VPC connection is currently associated with Zone A and vSwitch A1.

Select Zone A and vSwitch A2 → the connection associates with Zone A and vSwitch A2; vSwitch A1 is disassociated.
Select Zone B with vSwitch B1 and Zone C with vSwitch C1 → the connection associates with Zone B/B1 and Zone C/C1; Zone A and vSwitch A1 are disassociated.
Select Zone A with vSwitch A1 and Zone C with vSwitch C1 → Zone C and vSwitch C1 are added; Zone A and vSwitch A1 are retained.

Modify the route table associated with a VPC connection

Change the transit router route table associated with a VPC connection.

Warning

If route synchronization is enabled on the VPC connection, routes synchronized to the VPC are withdrawn when the route table changes. The routes in the new route table are then synchronized to all VPC route tables. See Route synchronization.

Log on to the CEN console.
On the Instances page, click the ID of the CEN instance.
On the Basic Information > Transit Router tab, click the transit router ID in the target region.
On the Intra-region Connections tab, find the VPC connection and click its ID.
In the Attachment details panel, under Basic information, click Modify next to Associated route table.
In the Modify route table dialog box, select the target route table and click OK.

Enable IPv6 for an existing VPC connection

Enable IPv6 on a VPC connection so that the VPC can communicate over IPv6 through the transit router. Before enabling IPv6 on the connection, make sure IPv6 is enabled on the VPC. See Enable IPv6 for a VPC.

Log on to the CEN console.
On the Instances page, click the ID of the CEN instance.
On the Basic Information > Transit Router tab, click the transit router ID in the target region.
On the Intra-region Connections tab, find the VPC connection and click Enable in the IPv6 column.
Click OK to confirm.

Disable IPv6 for a VPC connection

Before disabling IPv6, remove all IPv6 route entries that reference the VPC connection:

The VPC route table must not have IPv6 route entries pointing to the VPC connection or its ENI. See Add and delete routes.
The transit router route table must not have IPv6 route entries pointing to the VPC connection. See Delete a custom route from an Enterprise Edition transit router.
The transit router route table must not have an IPv6 prefix list pointing to the VPC connection. See Disassociate a prefix list from a transit router route table.

Log on to the CEN console.
On the Instances page, click the ID of the CEN instance.
On the Basic Information > Transit Router tab, click the transit router ID in the target region.
On the Intra-region Connections tab, find the VPC connection and click Disable in the IPv6 column.
Click OK to confirm.

API reference

Use the following APIs to manage VPC connections programmatically. Supported tools include Alibaba Cloud SDK (recommended), Alibaba Cloud CLI, Terraform, and Resource Orchestration Service.

API	Description
CreateTransitRouterVpcAttachment	Create a VPC connection on an Enterprise Edition transit router
UpdateTransitRouterVpcAttachmentAttribute	Update the name and description of a VPC connection
UpdateTransitRouterVpcAttachmentZones	Modify the zones and vSwitches of a VPC connection
ListTransitRouterVpcAttachments	List VPC connections on an Enterprise Edition transit router
AttachCenChildInstance	Create a VPC connection on a Basic Edition transit router