Configure redundant connectivity for private networks between on-premises data centers and cloud environments
When migrating from an on-premises data center (IDC) to Alibaba Cloud, ensuring highly available network connectivity between the IDC and an Alibaba Cloud VPC is critical for business continuity and system reliability. To achieve this, deploy redundant network connections, use dual-tunnel IPsec-VPN, and configure Express Connect and IPsec-VPN active/standby links. These measures ensure high availability of network connectivity between your IDC and Alibaba Cloud VPC, improving overall system reliability and fault tolerance.
Priority
High
Not recommended
Run production workloads and offline big data workloads over a single leased line or group of leased lines without traffic separation. A sudden spike in offline data transfer can saturate the leased line bandwidth, causing packet loss and degrading the performance of real-time workloads.
Use only one leased line or one IPsec-VPN connection. This creates a single point of failure, and a network interruption can make your applications unavailable.
Deploy all connections in the same zone or with a single carrier. This offers no protection against zone-level or carrier-level device failures.
Ignore bandwidth limits and performance bottlenecks. This leads to insufficient leased line tunnel capacity and impacts data transmission performance.
Implementation guide
1. Split leased line bandwidth
When multiple workloads share leased line bandwidth, they compete for traffic. A sudden surge in one workload can make other workloads perform poorly or become unavailable. You can split the leased line bandwidth.
Solution 1: Assign a dedicated leased line to each workload tier.
Solution 2: When multiple workloads share a leased line, assign each workload a separate CIDR block. Then, use leased line Quality of Service (QoS) to split bandwidth. For more information, see QoS policies.
Solution 3: On the same leased line, use different virtual border routers (VBRs) for different workloads. Configure VBR bandwidth to split leased line bandwidth. For instructions, see Create and manage virtual border routers.
2. Leased line redundancy
Leased line redundancy involves using multiple independent or standby links. If the primary link fails, traffic automatically switches to a standby link. This ensures continuous, highly available communication between the cloud and your on-premises IDC.
Multiple access points: You can connect your IDC to at least two distinct Alibaba Cloud access points using at least two independent Express Connect circuits. This provides physical link redundancy and enables load distribution. Choose different carriers when possible.
Multiple leased lines per access point: You can add more leased lines at each access point. You can use different carriers, routing paths, and campus lines.
Equal-cost multi-path (ECMP) routing with multiple leased lines: Compared to active/standby routing, ECMP routing offers faster failover, improved horizontal scalability, and higher resource utilization for bursty traffic. You can use ECMP routing for multi-leased-line deployments when your workloads do not require symmetric routing.
Use VPN as a leased line backup: In Enterprise Edition TR scenarios, VPN supports leased line backup functionality. You can use a VPN Gateway to back up your leased lines. This ensures hybrid cloud connectivity remains available even if all leased lines fail.
For architecture guidance, see the Express Connect best practice: Connect your on-premises IDC to Alibaba Cloud using ECR with active/standby leased lines.
3. IPsec connection redundancy protection
IPsec-VPN redundancy involves configuring multiple independent IPsec tunnels or links. If the primary link fails, traffic automatically switches to a standby link. This ensures continuous and encrypted communication between cloud and on-premises environments.
Dual-tunnel mode: Alibaba Cloud VPN Gateways deploy across dual zones with dual public endpoints. TR deploys across multiple zones in a clustered configuration. VPN Gateways support active/standby dual tunnels, while TR supports active/active dual tunnels. If one IPsec-VPN tunnel fails due to a network interruption or device failure, traffic automatically switches to the other tunnel. This maintains business continuity.
ECMP mode: You can set up multiple IPsec-VPN connections between your on-premises IDC and Alibaba Cloud. Then, use Cloud Enterprise Network (CEN) to connect those IPsec-VPN connections to VPC-connected instances. After joining CEN, the IPsec-VPN connections automatically form an ECMP path. This enables bidirectional communication and provides traffic load balancing between your IDC and VPC-connected instances. For deployment details, see IPsec-VPN tutorials.