Each Cloud Box corresponds to one availability zone. You can create a VSwitch (which serves as a Cloud Box subnet) in the Cloud Box availability zone to extend a public cloud VPC to the Cloud Box. This topic describes how to configure a Cloud Box subnet.
Background
When your Cloud Box is delivered, Alibaba Cloud sets up network connectivity between your on-premises IDC and the Alibaba Cloud public cloud. This connection uses either Express Connect or Smart Access Gateway (SAG), based on the option you selected during purchase. After this initial setup, you can extend a public cloud VPC into your on-premises Cloud Box by creating a Cloud Box subnet in the Cloud Box availability zone. The VPC to which the subnet belongs must be in the same region as the Cloud Box. A single Cloud Box can support multiple subnets, which can belong to the same VPC or different VPCs, as shown in the following figure.
For more information about Cloud Box networking, see Networking solutions.
Prerequisites
Before you begin, plan your network based on your business requirements and network environment. This includes the number of VPCs and VSwitches, and their CIDR blocks. Consider the following points:
A VPC is a logically isolated private network in the public cloud. If your services do not require network isolation from each other, we recommend that you use a single VPC.
When you plan VPC CIDR blocks, ensure that the CIDR blocks do not overlap among different VPCs or between a VPC and your on--premises IDC.
When you plan the number and CIDR blocks of your Cloud Box subnets, remember that the size of a subnet's CIDR block determines the maximum number of ECS instances it can host. Plan your subnets based on the compute capacity of your Cloud Box and the number of ECS instances you intend to create.
The following is an example of a network plan:
VPC CIDR block: 192.168.0.0/16
On-premises IDC CIDR block: 192.168.1.0/24
Cloud Box subnet CIDR block: 192.168.2.0/24
Public cloud VSwitch CIDR block: 192.168.3.0/24
For more information, see VPCs and VSwitches and Network planning.
Procedure
Create a VPC.
Based on your network plan, create a VPC in your Cloud Box's region. For more information, see Create and manage a VPC.
Create a Cloud Box subnet in the VPC.
Go to the Cloud Box List tab.
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select a region.
- Click the Cloud Box List tab.
Find the target Cloud Box and click its ID.
In the upper-right corner of the page, click Create Subnet.
On the Create VSwitch page, configure the VPC, Name, and IPv4 CIDR Block parameters. Then, click OK.
NoteThis VSwitch belongs to the Cloud Box availability zone and functions as a Cloud Box subnet. You can create multiple subnets as needed.
After you create the Cloud Box subnet, you can create ECS instances within it. The system automatically assigns a private IP address from the subnet's CIDR block to each new ECS instance.
(Optional) Create a security group for the VPC.
A security group acts as a virtual firewall. You can create multiple security groups within a single VPC to control network access for different ECS instances. For example, you can add ECS instances in your Cloud Box to Security Group A and ECS instances in the public cloud to Security Group B. Without any security group rules, the instances in these two groups are isolated. For information about how to create a security group and add rules, see Create a security group and Add security group rules.
Test network connectivity
The following steps demonstrate how to test network connectivity between a Cloud Box subnet and the public cloud.
Create an ECS instance, Instance A, in the Cloud Box. For more information, see Procedure.
Create an ECS instance, Instance B, in the public cloud. For more information, see Create an instance by using the wizard.
Add both Instance A and Instance B to the same security group. For more information, see Add an instance to a security group.
On the Instances page, find and record the private IP addresses of Instance A and Instance B.
Remotely connect to Instance A and run the
pingcommand on the private IP address of Instance B to verify network connectivity.If the ping is successful, the network connection between the Cloud Box subnet and the public cloud is working correctly.
If the ping fails, check your VPC, VSwitch, and security group configurations, or contact Alibaba Cloud technical support.
Related topics
Once network connectivity is established between your Cloud Box and the public cloud, ECS instances in the Cloud Box and ECS instances in the public cloud can communicate over their private IP addresses without additional configuration, as long as they are in the same VPC. For more information, see Enable private communication between an ECS instance in a Cloud Box and an ECS instance in the public cloud.