Access cloud resources from ENS using an SAG vCPE

Scenario

This scenario involves an enterprise with a Virtual Private Cloud (VPC) in the China (Shanghai) region. The enterprise plans to deploy a business system on ENS in the same region and connect it to cloud resources by using a SAG vCPE. To achieve this, two ENS instances are created: one for the business system and the other to host the SAG vCPE image. After deployment, the second instance functions as an SAG vCPE device, allowing the business system to connect to cloud resources.

Deployment process

Prerequisites

Before you begin, make sure that you meet the following requirements:

• You have enabled ENS. For more information, see Enable Service.

• A VPC is created and cloud services are deployed in the VPC. For more information, see Create a VPC with an IPv4 CIDR block.

• You understand the security group rules for the cloud services in your VPC and have confirmed that these rules allow access from your ENS resources. For more information, see View security group rules and Add security group rules.

• You have created an ECS instance in your VPC. For more information, see Create an instance by using the wizard.

Step 1: Create an SAG vCPE instance

Create an SAG vCPE instance on the SAG console. You will use this instance to manage your SAG vCPE devices.

1. Log on to the SAG console.

2. On the Smart Access Gateway page, choose Purchase SAG > Create SAG (vCPE).

3. On the SAG vCPE (Software) page, configure the SAG vCPE instance as follows, and then click Buy Now to complete the payment.

   Parameter	Description
   Region	Select the region for the SAG vCPE instance. This topic uses China (Shanghai) as an example.
   Instance name	Enter a name for the SAG vCPE instance.
   Instance type	The default value is SAG-vCPE.
   Edition	The default value is Basic.
   Deployment mode	Select the deployment mode for the SAG vCPE devices. The default is High-availability. In this mode, one SAG vCPE instance can connect to two SAG vCPE devices by default. You can configure the two SAG vCPE devices in an active/standby pair to improve network availability. This topic uses only the primary device.
   Peak bandwidth	The peak bandwidth for network communication. Unit: Mbps.
   Quantity	Select the number of SAG vCPE instances to create. This topic uses 1 as an example.
   Subscription duration	Select a subscription duration.
   Resource Group	Select the resource group to which the SAG vCPE instance belongs.

4. Return to the SAG console. In the top navigation bar, select the region where you created the instance.

5. In the left-side navigation pane, click Smart Access Gateway.

6. On the SAG page, click the ID of the instance that you created.

7. On the instance details page, click the Device management tab. View and record the serial number and key of the primary SAG vCPE device. You will need these credentials later to associate the device with the SAG vCPE instance.

Step 2: Deploy the SAG vCPE image

1. Pre-deploy the ENS private CIDR block.

   The Alibaba Cloud edge computing team deploys the private CIDR block for ENS. You must submit a ticket to apply for this deployment.

   Provide the private CIDR block required for your ENS instances. Plan your IP addresses carefully to avoid conflicts across your network. The edge computing team allocates a sub-block for each node from the larger network CIDR block to ensure that private IP addresses are unique.

   In this topic, the pre-deployed CIDR block is 10.0.0.0/8, and the private CIDR block allocated to the business system instance and the SAG vCPE image instance is 10.0.2.0/24.

2. Create an edge service.

   1. Log on to the ENS console.

   2. In the left-side navigation pane, choose Computing and Images > Instances.

   3. On the Instances page, click Create Instance.

   4. On the Edge Node Service purchase page, click the Edge service tab.

   5. On the Edge service tab, configure the Basic information.

      Before you configure the basic information, make sure that you understand the environment requirements for deploying an SAG vCPE image. For more information, see Environment requirements.

      Parameter	Description
      Service name	Enter a name for the service, up to 30 characters long.
      Image	ENS supports custom images and public images. This topic uses a Public Image as an example. The operating system is Ubuntu and the version is ubuntu_18_04_64_20G_alibase_20191119.
      Instance type	Select the instance type on which to install the SAG vCPE image. This topic uses 2C4G as an example. Deployed on a 2-vCPU and 4-GiB instance, an SAG vCPE image can provide encrypted private network bandwidth exceeding 300 Mbps (with 1,024-byte packets).
      Storage	Configure the sizes of the system disk and data disk in GB. This topic uses the default values.
      Bandwidth	Select the peak public bandwidth for the instance. Unit: Mbps. For information about bandwidth billing, see Billing overview.
      Logon password	The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Note The logon password cannot contain the following special characters: "\ and spaces.

   6. Click Next to configure the Edge compute distribution.

      Parameter	Description
      Network layer	This topic uses the default value Large Region.
      Node scheduling policy	For dispersion, you can select city-dispersed or city-concentrated. This topic uses City-dispersed and Price Priority as an example. Note If multiple instances are required in the selected area, the city-dispersed policy attempts to schedule instances in different cities, while the city-concentrated policy attempts to schedule instances in the same city.
      Region	You can add or remove China Telecom, China Unicom, and China Mobile instances in the Northeast, East China, North China, Central China, South China, Southwest, and Northwest regions. This topic adds two China Mobile instances in the East China region.

   7. Click Next to go to the Confirm configuration page.

   8. On the Confirm configuration page, confirm the settings, read and agree to the terms of service, and then click Create.

      For more information about the parameters, see Create an edge service.

3. After you create the edge service, view the ENS instance information.

   1. In the left-side navigation pane, choose Resource Management > Instances.

   2. On the Instances page, filter the instances by the ID of the edge service you created. View the IP addresses and other information of the instances created under this edge service.

      

4. Deploy the SAG vCPE image on an ENS instance.

   After deployment, the ENS instance functions as an SAG vCPE device that connects your ENS service to Alibaba Cloud.

   1. Download the deployment script to the ENS instance.

      Log on to the ENS instance where you want to deploy the SAG vCPE image by using SSH. Download the script to the /root directory of the ENS instance.

      Important

      • You can download the script to a custom path. If you do, make sure to update the path when you run the script.

      • After you download the script, do not modify its content or filename.

      ssh root@112.XX.XX.25   # Log on to the instance by using its public IP address. Replace the IP address with the actual one.
      yes                     # Enter yes when you log on by using SSH for the first time to create an authentication file.
                    # The logon password for the ENS instance. By default, this is the password of the edge service.
      # Run the following command to download the script.   
      wget -O /root/sag_vcpe_v2.3.0_deployment.sh https://sdwan-oss-shanghai.oss-cn-shanghai.aliyuncs.com/vcpe_vm/sag_vcpe_v2.3.0_deployment.sh                                

   2. Grant executable permissions to the script.

      chmod +x /root/sag_vcpe_v2.3.0_deployment.sh

   3. Run the deployment script.

      /root/sag_vcpe_v2.3.0_deployment.sh -n sage6nniq3**** -k **** -t ens  -w eth0

      The following table describes the parameters of the script. For more information about the script, see Descriptions of the script parameters.

      Parameter	Description
      -n	The serial number of the SAG vCPE device.
      -k	The key of the SAG vCPE device.
      -t	The service provider of the host on which you want to install the SAG vCPE image. Valid values: aliyun (Default): The SAG vCPE image is deployed on an Alibaba Cloud ECS instance. aws: The SAG vCPE image is deployed on an Amazon EC2 instance. ENS: The SAG vCPE image is deployed on an Alibaba Cloud ENS instance. azure: The SAG vCPE image is deployed on a Microsoft Azure virtual machine. If the SAG vCPE image is deployed on a server in an on-premises network, you can set this parameter to any string other than aliyun, ENS, aws, or azure.
      -w	The name of the NIC for the WAN port. You can run the ifconfig command to view the NIC name of the host.

   4. When you run the script, the system automatically checks if the deployment environment meets the requirements. If required components are missing, the system prompts you as shown in the following figure. Enter yes to allow the system to install the required components automatically.

      

   5. If the environment meets the requirements, the system starts to deploy the SAG vCPE image directly. After the image is deployed, a message appears, as shown in the following figure.

      

   6. Verify the deployment.

      After the deployment is complete, run the docker ps command to check if the following two containers exist:

      If the system contains the vsag-core container and the vsag-manager-base container, the SAG vCPE image is deployed.

5. After the SAG vCPE image is deployed, deploy your business system on the other ENS instance. The specific steps depend on your business requirements and are not described in this topic.

Step 3: Configure the SAG vCPE network

After you deploy the SAG vCPE image, configure the network for the SAG vCPE device on the SAG console to connect it to Alibaba Cloud.

1. Configure on-premises route synchronization.

   1. Log on to the Smart Access Gateway console.

   2. In the top navigation bar, select the target region.

   3. On the Smart Access Gateway page, find the target instance and click Network configuration in the Actions column.

   4. On the Network Configuration > On-premises Route Sync Method tab, click Add Static Route.

   5. In the Add Static Route dialog box, enter the private CIDR block of the ENS business system instance, and then click OK.

      

2. Associate the SAG instance with the CCN instance.

   CCN is an important component of SAG. SAG connects your on-premises networks to Alibaba Cloud through CCN.

   1. Create a CCN instance. For more information, see Create a CCN instance.

      The SAG vCPE instance and CCN instance must be deployed in the same region.

   2. In the navigation pane on the left, choose Smart Access Gateway > Instances.

   3. On the Smart Access Gateway page, find the instance and click Network Configuration in the Actions column.

   4. On the details page of the SAG vCPE instance, choose Network Configuration > Network Instance Details.

   5. In the Associated Instances Under Current Account section, click Attach Network, select a CCN instance, and then click OK.

   6. After you associate the SAG vCPE instance with the CCN instance, click the Device Management tab. If the VPN Status and Control Status of the SAG vCPE device are Normal, it indicates that the SAG vCPE device is connected to Alibaba Cloud.

      

3. Configure Cloud Enterprise Network.

   You need to attach the SAG vCPE instance to a Cloud Enterprise Network (CEN) instance and then attach your VPC instance to the same CEN instance. This allows the SAG vCPE instance and the VPC instance to learn routes from each other, enabling communication between the SAG vCPE device and resources in the VPC.

   1. In the left-side navigation pane, click Cloud Connect Network.

   2. On the Cloud Connect Network page, find the target CCN instance and click Bind to CEN instance in the Actions column.

   3. In the CEN Instance panel, select the CEN instance and click OK.

      You can use one of the following methods to select a CEN instance. In this example, Create CEN is selected.

      • Existing CEN: If you have already created a CEN instance, you can select an existing CEN instance from the drop-down list.

      • Create CEN: If you have not created a CEN instance, enter an instance name. The system then automatically creates a CEN instance and associates the CEN instance with the CCN instance.

   4. Attach your Alibaba Cloud VPC to this CEN instance. For more information, see Attach a VPC to a CEN instance.

Step 4: Configure the ENS network

To enable communication between your business system and cloud resources, you need to configure a route on your business system instance to direct traffic to the cloud resources.

1. Log on to the ENS business system instance.

   1. Open a command-line window on your computer with administrator privileges.

   2. Log on to your business system instance by using SSH.

   ssh root@112.XX.XX.27   # Log on to the instance by using its public IP address. Replace the IP address with the actual one.
   yes                     # Enter yes when you log on by using SSH for the first time to create an authentication file.
                 # The logon password for the business system instance. By default, this is the password of the edge service.    

2. Configure the route.

   Set the next hop for traffic destined for the cloud CIDR block to the public IP address of the ENS instance hosting the SAG vCPE. The SAG vCPE device will handle the communication with the cloud resources.

   # Add a permanent static route to the /etc/sysconfig/static-routes file.
   
   vi /etc/sysconfig/static-routes # Create and open the static-routes file.
   # Press the "i" key to enter insert mode.
   any net 172.16.1.0/24 gw 112.XX.XX.25 # Configure the route. Set the next hop for the destination cloud CIDR block to the public IP address of the ENS instance hosting the SAG vCPE.
   # Press the Esc key to exit insert mode.
   :wq # Enter :wq and press Enter to save and exit the file.
   service network restart # Restart the network service.
   route -n # View the added routes.

Step 5: Test connectivity

After you complete these steps, services in your Alibaba Cloud VPC and ENS can communicate. The following procedure describes how to test connectivity between an ECS instance in the VPC and your ENS business instance.

1. Log on to the ENS business system instance. For more information, see Step 1 in Step 4: Configure the ENS network.

2. Use the ping command to verify communication between your business system instance and an ECS instance in the Alibaba Cloud VPC. Specify the private IP address of the business system instance as the source.

   ping -I src-ip dst-ip

   • -I: Specifies the source IP address for the request.

   • src-ip: The source IP address. For example, the private IP address of the business system instance.

   • dst-ip: The destination IP address. For example, the private IP address of the ECS instance in the Alibaba Cloud VPC.

   The test shows that the business system instance can communicate with the ECS instance in the Alibaba Cloud VPC.

Related topics

• What is Cloud Enterprise Network?

• What is Edge Node Service?

• Cloud Connect Network overview