Hybrid access for network migration

Background

Previously, when you migrated an RDS instance from a classic network to a VPC, the internal endpoint for the classic network was replaced with a VPC internal endpoint. Although the endpoint string remained unchanged. This process caused a transient connection that lasted for up to 30 seconds and prevented ECS instances in the classic network from accessing the RDS instance over the internal network. To enable smooth network migrations, ApsaraDB RDS for SQL Server has introduced the hybrid access feature.

Hybrid access allows ECS instances in both the classic network and a VPC to simultaneously access the RDS instance. During the hybrid access period, the RDS instance retains its original classic network internal endpoint while also gaining a new internal endpoint in the VPC. This prevents transient connections during the network migration.

However, for security and performance reasons, we recommend that you use only a VPC. The hybrid access period is temporary. After the retention period expires, the original classic network internal endpoint is automatically released, and applications can no longer use it to access the database. To avoid impacting your services, you must configure all your applications to use the new VPC internal endpoint during the hybrid access period.

For example, if a company uses hybrid access to migrate from a classic network to a VPC, some applications can connect to the database through the VPC while others continue to use the original classic network internal endpoint. Once all applications are updated to connect through the VPC, the original classic network internal endpoint can be released.

Prerequisites

• The instance uses the classic network.

• A VPC and a vSwitch must be available in the same availability zone as the instance. For information about how to create a VPC and a vSwitch, see Manage VPCs.

Limitations

• During the hybrid access period, you cannot switch the network type back to the classic network or migrate the instance to another availability zone.

• ApsaraDB RDS for SQL Server 2008 R2 instances do not support switching from a classic network to a VPC. You can choose one of the following solutions:

  • Solution 1: Upgrade the major version of the instance. During the upgrade process, change the instance network type to VPC.

  • Solution 2: Purchase a new RDS instance, select the target VPC during purchase, and then migrate your data to the new instance.

  • Solution 3: If your services no longer require connections from the classic network, you can manually delete the classic network endpoint on the Database Connection page of the RDS instance. After deletion, connections are supported only through the public endpoint. For more information, see Enable a public endpoint.

    Important

    • After you delete the classic network endpoint, it cannot be restored. Proceed with caution.

    • We recommend keeping the classic network endpoint to first test connectivity with the public endpoint. After you confirm that everything works as expected, you can delete the classic network endpoint.

• Temporary instances only support the classic network, and you cannot switch them to a VPC. For information about how to log on to a temporary instance, see Log on to a temporary instance.

Migrate from classic network to VPC

1. Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the instance ID.

2. In the left-side navigation pane, click Database Connection.

3. Click Switch to VPC.

   Note

   If the Switch to VPC button is not displayed, check the Prerequisites and Limitations sections in this topic.

4. In the dialog box that appears, select a VPC and a vSwitch, and specify whether to retain the classic network endpoint.

   • Select a VPC. We recommend selecting the VPC where your ECS instance resides. Otherwise, the ECS instance and the RDS instance cannot communicate over the internal network unless you connect the two VPCs by using Cloud Enterprise Network (CEN) or a VPN gateway.

   • Select a vSwitch. If no vSwitches are available in the selected VPC, create a vSwitch in the same availability zone as your instance. For more information, see Manage vSwitches.

   • Select or clear Reserve original classic endpoint. The following table describes the options.

     Actions	Description
     Clear the check box	The classic network endpoint is not retained, and the original classic network endpoint becomes a VPC endpoint. If you do not retain the classic network endpoint, a transient connection for up to 30 seconds occurs when you switch the network type. Internal access to the RDS instance from ECS instances in the classic network is immediately disconnected.
     Select the check box	The classic network endpoint is retained, and a new VPC endpoint is generated. This enables hybrid access mode, where ECS instances in both the classic network and the VPC can access the RDS instance over the internal network. If you retain the classic network endpoint, no transient connection occurs when you switch the network type. Internal access from ECS instances in the classic network remains active until the classic network endpoint expires. Before the classic network endpoint expires, you must configure the ECS instances in the VPC to use the VPC endpoint. This ensures a smooth migration of your services to the VPC.

5. Add the internal IP address of the ECS instance to the IP whitelist of the RDS instance. This allows the ECS instance to access the RDS instance over the internal network. On the Whitelist Settings page, the instance uses the General Whitelist Mode. In this mode, the IP whitelist allows access from both the classic network and the VPC. The required IP addresses must be added to the default group.

6. • If you chose to retain the classic network endpoint, configure your ECS instances to use the VPC endpoint of the RDS instance before the classic network endpoint expires.

   • If you did not retain the classic network endpoint, internal access from ECS instances in the classic network is immediately disconnected after you switch the network type. You must immediately configure your ECS instances to use the VPC endpoint of the RDS instance.

   Note

   If you need to connect an ECS instance from a classic network to an RDS instance in a VPC over the internal network, you can use ClassicLink or migrate the ECS instance to the VPC.

Modify the classic network endpoint expiration time

During the hybrid access period, you can adjust the retention period of the classic network internal endpoint at any time. The retention period is recalculated from the date of the change. For example, if the original endpoint is set to expire on August 18, 2017, and you change the expiration time to "14 days" on August 15, 2017, the endpoint will be released on August 29, 2017. To modify the expiration time, perform the following steps:

1. Log on to the ApsaraDB RDS console and go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the instance ID.

2. In the left-side navigation pane, click Database Connection.

3. On the Instance Connection tab, click Change Expiration Time.

4. In the Change Expiration Time dialog box, select an expiration time and click OK.

Related articles

• For more information about the functional differences between a VPC and a classic network, see FAQ about network types.

• You can also switch the network type from the classic network to a VPC by calling the ModifyDBInstanceNetworkType API operation.

• If an ECS instance cannot access an RDS instance over the internal network, the RDS instance cannot be accessed from the internet, or other connection issues occur, see Troubleshoot instance connection failures.