Features
Smart Access Gateway (SAG) connects on-premises networks to Alibaba Cloud over WANs, 4G networks, and Express Connect circuits. Beyond connectivity, SAG includes built-in network management capabilities — Quality of Service (QoS), Network Address Translation (NAT), access control lists (ACLs), flow logs, and health checks — giving you traffic control, security enforcement, and network visibility from a single product.
Features at a glance
| Feature | What it does |
|---|---|
| Multiple network types | Connect over WAN, 4G, or Express Connect with active-standby failover |
| Routing | Configure static routing, BGP, or OSPF dynamic routing |
| QoS | Prioritize traffic and allocate bandwidth by workload |
| NAT | Translate private IPs for Internet access (SNAT) or expose private services (DNAT) |
| Access control | Define whitelists and blacklists per SAG instance using ACLs |
| Flow logs | Record inbound and outbound traffic for monitoring, troubleshooting, and analysis |
| Health checks | Verify network connectivity between an SAG device and a target destination |
Multiple network types
SAG supports three connection types — WAN, 4G, and Express Connect — and pairs them as active-standby connections to maintain high availability if one link fails.
WAN and 4G (active-standby)
SAG devices connect to Alibaba Cloud over a WAN as the primary link, with a 4G connection as standby. If the WAN link fails, the 4G connection takes over automatically.
Each SAG device includes a built-in 4G SIM card, but this card is for receiving device configurations from Alibaba Cloud only — it does not carry data traffic. To use 4G as a standby link, purchase a data-capable SIM card from an Internet service provider (ISP) and insert it into the SAG device.
SAG and Express Connect (active-standby)
If your on-premises network already connects to Alibaba Cloud over an Express Connect circuit, you can add an SAG device as a standby connection. The SAG link activates automatically if the Express Connect circuit becomes unavailable.
Express Connect and Internet (active-standby)
SAG also supports pairing an Express Connect circuit with an Internet connection as active and standby links. The standby link takes over if the active connection fails.
Only SAG-1000 devices support connections over Express Connect circuits. SAG-100WM devices do not support Express Connect. For more information, see What is Express Connect?
Routing methods
SAG devices support three routing methods:
| Method | Description |
|---|---|
| Static routing | Manually configured; suitable for simple or stable network topologies |
| Border Gateway Protocol (BGP) dynamic routing | Standard inter-AS routing protocol for dynamic path selection |
| Open Shortest Path First (OSPF) dynamic routing | Link-state protocol for automatic route updates within a network |
For configuration steps, see Manage routes.
Quality of service (QoS)
When multiple business systems share the same network link — for example, enterprise resource planning (ERP), office automation (OA), and order management — they compete for bandwidth. Without prioritization, business-critical traffic may experience packet loss or high latency during peak periods.
QoS policies let you allocate bandwidth based on 5-tuple rules (source IP, destination IP, source port, destination port, and protocol) and assign priorities to different traffic types. This ensures critical workloads get the bandwidth they need while keeping latency, packet loss, and network jitter under control.
For more information, see What is a QoS policy?
Network Address Translation (NAT)
SAG supports Source Network Address Translation (SNAT) and Destination Network Address Translation (DNAT), giving you control over how private IP addresses are exposed to and from the Internet.
SNAT
SNAT translates private IP addresses to public IP addresses, allowing devices on your private network to access the Internet through the SAG device. Private networks remain inaccessible from the Internet. SNAT also resolves IP conflicts between overlapping private networks.
For TCP, UDP, DCCP, and SCTP — protocols that use specific port numbers — SNAT preserves the port range of the source port after translation:
Source port smaller than 512 → translated port is also smaller than 512
Source port between 512 and 1023 → translated port is also in the 512–1023 range
Source port 1024 or larger → translated port is also 1024 or larger
For configuration steps, see Configure an SNAT rule.
DNAT
DNAT maps private IP addresses to public IP addresses, allowing your private network to provide services over the Internet.
For configuration steps, see Add a DNAT rule.
Access control
SAG supports access control lists (ACLs) that let you define whitelists and blacklists for each SAG instance. For more information, see ACL overview.
Flow logs
Flow logs record inbound and outbound traffic on your SAG instances. Use them to diagnose and understand your network:
Troubleshoot connectivity issues — identify unexpected traffic drops, diagnose intermittent connection failures, and pinpoint the source of anomalies faster than manual inspection
Monitor network traffic — track traffic volumes and patterns across your SAG instances over time
Analyze traffic data — export and analyze flow log data to support capacity planning and informed business decisions
For more information, see Flow log overview.
Health checks
Health checks test the network connectivity between an SAG device and a specified destination. Use health checks to detect link degradation proactively — before it affects your users — rather than discovering issues only after a failure is reported. For configuration steps, see Create a health check.
Network probe monitoring
SAG supports network probe monitoring. You can create application network probe monitors for SAG instances to monitor specific service targets. You can then configure alert rules in the CloudMonitor console to receive notifications about abnormal monitoring data. This lets you resolve issues promptly. For more information, see Network probe monitoring.