Consider scalability and availability in IP subnet planning
When you use Alibaba Cloud services, planning your virtual private clouds (VPCs), IP address spaces, and subnets is a fundamental part of building a highly available and scalable cloud network. Careful planning of VPC CIDR blocks, subnet divisions, and address allocation policies ensures that your network architecture is highly scalable and available. This approach also helps you avoid wasting address space and prevents business interruptions that can result from network reconfiguration.
Priority
Medium
What to avoid
Deploying multiple systems in a single VPC or on a single vSwitch. This prevents fine-grained security control between the systems.
Planning IP address ranges improperly. Reserving an insufficient number of IP addresses or allocating them inefficiently makes future scaling difficult, wastes address space, and can prevent you from adding new subnets or allocating IP addresses when your services need to scale out.
Ignoring zone redundancy. Deploying critical Alibaba Cloud services in a single zone creates a single point of failure, risking service interruption if that zone becomes unavailable.
Implementation guide
1. VPC design and planning
Design your VPCs based on your system requirements. Choose the right number and type of VPC deployments. Plan your vSwitches and security group policies to reduce security risks. A well-designed VPC structure also supports a high-availability architecture and allows for future growth.
1.1 Single VPC vs. multiple VPCs
Dimension | Multiple VPCs | Single VPC |
Security | High | Low |
Management complexity | High | Low |
Cost control | More granular | Extensive |
Scalability | Strong | Limited |
Communication efficiency | Depends on network interconnection | High internal efficiency |
For Enterprises | Medium to large enterprises | Small or startup enterprises |
1.2 VPC implementation guide
Choose regions and zones. Deploy different types of resources in different zones.
For resources of the same type, ensure redundant deployment across zones. Avoid single-zone deployments.
Plan vSwitches based on connectivity requirements. Deploy a public vSwitch for Internet access, a private vSwitch for internal network access, a VPN vSwitch for VPN access, and a network element vSwitch for network element deployments.
Design the IP address allocation for your VPCs based on your VPC and vSwitch design. Ensure address redundancy within each VPC and avoid IP address overlap.
Deploy appropriate security group and ACL rules for different resources.
For more information about the architecture design, see Single VPC network design in the same region.
2. IP address planning
Before you deploy a VPC, plan your IP address space. Reserve a sufficient number of IP addresses to support service expansion, failover, and redundant architectures. This includes maintaining an address pool for future subnets, elastic scaling, and high-availability deployments. This planning helps you avoid network reconfiguration that can result from IP address exhaustion.
2.1 IP address allocation policy
Subnet division policy:
Map each subnet to a single zone. Ensure that the subnet CIDR blocks do not overlap.
When you create subnets in a VPC, assign an address range to each subnet that is larger than its current needs. Reserve 10% to 20% of the address space for future expansion.
For scenarios that require many IP addresses, such as container clusters or temporary instances, enable IPv6.
IP address management
Use an IP Address Manager (IPAM) tool to automate address allocation. For more information, see IP Address Manager (IPAM).
Monitor address usage and set up alerts for potential address exhaustion. This ensures that your reserved space is managed effectively.