Configure zone IP

Applicability

This document applies to users who have already requested and activated a Model Studio secure storage workspace. Contact your sales representative to learn how to activate a Model Studio secure storage workspace.

Prerequisites

You have configured an endpoint and initiated a connection. For more information, see Configure an endpoint and initiate a connection.

Step 1: Create a gateway

If you already have a cloud-native gateway instance in the region where your private cloud VPC resides that meets the following configuration, skip this step.

1. Log on to the MSE Gateway Management Console.

2. In the navigation pane on the left, choose Cloud-Native Gateway > Gateway List.

3. In the top menu bar, select the region China (Beijing).

4. On the Gateway List page, click Create Gateway in the upper-left corner.

5. On the cloud-native gateway purchase page, configure the following gateway settings. Keep all other parameters at their default values.

   Configuration item	Description
   Product type	Supports subscription and Pay-as-you-go billing methods. For pricing details, see Billing overview for standard instances.
   Region	Select the region where Alibaba Cloud Model Studio is deployed: China (Beijing).
   Gateway name	Enter a custom name. Use a consistent naming convention to clearly identify the gateway's purpose.
   Gateway instance type	Select 2 vCPUs, 4 GiB memory.
   Number of gateway nodes	Select 2.
   Hardware acceleration	Select Enable TLS hardware acceleration.
   Resource group	Select a resource group.
   VPC	Select the same VPC as the reverse endpoint.
   Zone location	Manual Selection.
   Zones and Switches	Select zones and vSwitches that match your VPC. Select at least two zones.
   Network access type	Select Private Network.

   For more information about cloud-native gateways, see Create an MSE cloud-native gateway.

6. Click Buy Now > Enable Now to create the gateway.

   Gateway creation takes 2–3 minutes. Wait until the status changes to Running, which means the gateway is ready.

Step 2: Get zone VIPs and vSwitch CIDR blocks

1. Go back to the Gateway List page in the console and click the name of the gateway you just created.

2. On the Gateway Entry tab, click the instance ID of the NLB-type instance.

3. Get the VIP for each zone.

   In the Network Load Balancer (NLB) console, go to the Instance Details tab of the target instance. In the zone table at the bottom, check the vSwitch ID and VIP columns to obtain the vSwitch ID and VIP for each zone.

4. Click each vSwitch ID to obtain its CIDR block.

   On the vSwitch details page, in the Basic Information section, note the IPv4 CIDR block (for example, 192.168.0.0/24) and IPv6 CIDR block fields.

Step 3: Configure zone IP

1. Go to the Workspace Management page.

2. Find your Alibaba Cloud Model Studio secure storage workspace. In the Actions column, click Manage Model Studio Secure Storage.

3. On the Endpoint Configuration page, click Next Step to go to the Zone IP Configuration page.

   Select the same zones you chose in Step 1: Create a gateway. If only one zone matches, select that zone only. Set the zone IP address to the VIP you obtained in Step 2: Get zone VIPs and vSwitch CIDR blocks.

4. After completing the configuration, click Save.

Step 4: Add the MSE NLB IP addresses to the security group of the reverse endpoint

1. In Security Groups, find the security group associated with the reverse endpoint.

2. Click the security group name to go to the Security Group Details page.

3. On the Inbound tab, click Add Rule and configure the following parameters.

   • Port Range > Destination: Select All (1/65535).

   • Source: Enter the VIPs you obtained in Step 2: Get zone VIPs and vSwitch CIDR blocks. Separate multiple VIPs with commas.

4. Click Save on the right side of the row.

Next steps

Go to the Resource Configuration page to configure resources in your private network (for example, Elasticsearch, ADB, OSS). This lets Alibaba Cloud Model Studio store data in the appropriate resources.