DocsICP FilingConsole
官方文档
首页

Internal network interconnection

更新时间：
复制 MD 格式
产品详情
我的收藏

Simple Application Server uses a virtual private cloud (VPC) automatically assigned by Alibaba Cloud for network isolation. By default, it does not support internal network interconnection with other Alibaba Cloud products in the same VPC, such as Elastic Compute Service (ECS) instances or ApsaraDB databases. You can enable internal network interconnection to establish connectivity. This topic describes how to set up and cancel internal network interconnection.

Scenarios

Internal network interconnection applies to the following business scenarios:

  • A Simple Application Server in the same account and region accesses an ECS instance over the internal network.

  • A Simple Application Server in the same account and region accesses an ApsaraDB database over the internal network.

This topic uses the following scenario as an example: A company has multiple Simple Application Servers and ECS instances in Alibaba Cloud Region A and wants its Simple Application Servers to communicate with ECS instances in VPC 1 over the internal network.

Impact

The first time you enable internal network interconnection in a region, all Simple Application Servers in that region shut down for about one minute. This shutdown may interrupt your services. Perform this operation during off-peak hours.

Set up internal network interconnection

If you have not enabled internal network interconnection in the region, the system uses the new version of internal network interconnection by default and establishes connectivity using a VPC peering connection.

Limits

  • The Simple Application Server console supports internal network interconnection only for resources under the same account and in the same region. This feature is free of charge.

  • The region must contain at least one Simple Application Server. Otherwise, this feature is unavailable.

  • A Simple Application Server can initiate up to 10 VPC peering connections.

Procedure

  1. Go to the in the Simple Application Server console.

  2. In the top navigation pane on the left, select the region where your Simple Application Server resides.

  3. In the upper-left corner of the Service Interconnection page, click Service Interconnection.

    If you use internal network interconnection for the first time, a dialog box appears. Click OK to grant authorization. The system then automatically creates a service-linked role. For more information, see Service-linked Role.

  4. In the Configure Service Interconnection dialog box, configure the parameters and click OK.

    Parameter

    Description

    Region

    The region where your Simple Application Server resides. This value is displayed by default and cannot be changed.

    Accepter VPC Instance

    All VPCs in the selected region are displayed by default. Select the VPC with which you want to establish internal network interconnection.

    Note

    • You can select only one VPC at a time. To connect to multiple VPCs, repeat this procedure.

    • A single accepter VPC supports up to 10 intra-region VPC peering connections. If your quota (vpc_quota_intra_region_peer_num_per_vpc) is insufficient, go to the Quota Center to request a quota increase. For more information, see Create a quota increase request.

  5. Verify internal network connectivity.

    Remotely connect to your Simple Application Server and run the ping command to ping the private IP address of the ECS instance in VPC 1. If the output resembles the following, internal communication between the Simple Application Server and the ECS instance works correctly.

    ping 10.10.xxx.xxx
PING 10.10.xxx.xxx (10.10.xxx.xxx) 56(84) bytes of data.
64 bytes from 10.10.xxx.xxx: icmp_seq=1 ttl=64 time=2.04 ms
64 bytes from 10.10.xxx.xxx: icmp_seq=2 ttl=64 time=2.11 ms
64 bytes from 10.10.xxx.xxx: icmp_seq=3 ttl=64 time=2.09 ms
64 bytes from 10.10.xxx.xxx: icmp_seq=4 ttl=64 time=2.09 ms

Delete a VPC peering connection

You can delete a VPC peering connection that is no longer needed. After deletion, internal network interconnection between your Simple Application Server and cloud resources in the accepter VPC stops. Ensure this action does not affect your business before proceeding.

  1. Go to the in the Simple Application Server console.

  2. In the top navigation pane on the left, select the region where your Simple Application Server resides.

  3. In the Actions column for the peering connection, click Delete.

  4. In the dialog box that appears, click OK.

FAQ

Q1: After setting up internal network interconnection, I receive the message “Network conflict detected with vpc-bp1shw9ozernphle****. Plan your network properly.” How do I resolve this?

The peering connection status shows Failed. The requester VPC CIDR block is 172.16.0.0/12, and the accepter VPC CIDR block is 192.168.0.0/16.

A1: The CIDR blocks of your Simple Application Server and the target VPC overlap, which may prevent internal network interconnection. First, verify whether internal connectivity works. If it does not, revise your network planning. Deploy interconnected workloads in VPCs with non-overlapping CIDR blocks to avoid address conflicts.

Q2: After setting up internal network interconnection, does only one Simple Application Server connect internally to cloud resources in the accepter VPC?

A2: No. All Simple Application Servers under the same account and in the same region reside in the same VPC by default. Therefore, all such servers can communicate internally with cloud resources in the accepter VPC.

Q3: After setting up internal network interconnection between a Simple Application Server and an ApsaraDB for Redis instance, why can’t they communicate over the internal network?

A3: To ensure the security and stability of Tair databases, the system blocks access from all IP addresses by default. After you enable service interconnection, you must add the private IP addresses or CIDR blocks of the Simple Application Servers to the whitelist of the ApsaraDB for Redis instances. For more information, see Configure Whitelist.

For more information about Redis instance authentication methods, see Authentication methods for instances.

Q4: After enabling internal network interconnection, why can’t my Simple Application Server connect internally to existing lightweight database instances in the same region?

A4: Before enabling internal network interconnection, Simple Application Servers and lightweight database instances created in the same region could communicate over the internal network. After enabling internal network interconnection, the underlying VPC for Simple Application Servers in that region changes, breaking internal connectivity with existing lightweight database instances. You can connect only over the public network. For more information, see Log on to a database over the public network using DMS.

Note

After enabling internal network interconnection, newly created lightweight database instances can communicate internally with Simple Application Servers in the same region.

Set up internal network interconnection (legacy version)

If you have already enabled internal network interconnection in the region, the system uses the legacy version by default and establishes connectivity using Cloud Enterprise Network (CEN).

Note

To upgrade from the legacy version to the new version, remove all network instances in the region. For more information, see Remove a network instance.

Limits

  • The Simple Application Server console supports internal network interconnection only for resources under the same account and in the same region. This feature is free of charge.

  • The region must contain at least one Simple Application Server. Otherwise, this feature is unavailable.

  • Operations performed in the CEN console do not sync to the Simple Application Server console.

  • You can associate only one CEN instance per region.

  • Only CEN Basic Edition instances are supported. If you select a CEN Enterprise instance created in the CEN console, internal network interconnection for Simple Application Servers becomes unavailable.

Procedure

  1. Go to the Servers page in the Simple Application Server console.

  2. In the top navigation pane on the left, select the region where your Simple Application Server resides.

  3. In the upper-left corner of the Service Interconnection page, click Service Interconnection.

    If you use internal network interconnection for the first time, a dialog box appears. Click OK to grant authorization. The system then automatically creates a service-linked role. For more information, see Service-linked Role.

  4. In the Configure Service Interconnection dialog box, configure the parameters and click OK.

    Important: The first time you enable internal network interconnection in a region, all Simple Application Servers in that region shut down for about one minute.

    Parameter

    Description

    Region

    The region where your Simple Application Server resides. This value is displayed by default and cannot be changed.

    CEN Instance

    Select a CEN instance from the drop-down list. If no CEN instances appear, select Automatic Creation. The system creates a CEN instance for you.

    VPC

    Select one or more VPCs with which you want to establish internal network interconnection.

  5. Verify internal network connectivity.

    Remotely connect to your Simple Application Server and run the ping command to ping the private IP address of the ECS instance in VPC 1. If the output resembles the following, internal communication between the Simple Application Server and the ECS instance works correctly.

    ping 10.10.xxx.xxx
PING 10.10.xxx.xxx (10.10.xxx.xxx) 56(84) bytes of data.
64 bytes from 10.10.xxx.xxx: icmp_seq=1 ttl=64 time=2.04 ms
64 bytes from 10.10.xxx.xxx: icmp_seq=2 ttl=64 time=2.11 ms
64 bytes from 10.10.xxx.xxx: icmp_seq=3 ttl=64 time=2.09 ms
64 bytes from 10.10.xxx.xxx: icmp_seq=4 ttl=64 time=2.09 ms

Remove a network instance

After removing a network instance, internal network interconnection between your Simple Application Server and cloud resources in the target VPC stops. Proceed with caution.

  1. Go to the Servers page in the Simple Application Server console.

  2. In the top navigation pane on the left, select the region where your Simple Application Server resides.

  3. In the Actions column for the target network instance, click Remove.

  4. In the Remove VPC dialog box, click OK.

FAQ

Q1: After setting up internal network interconnection, I receive the message “A network conflict may exist. Internal network interconnection may fail after activation due to network conflicts.” How do I resolve this?

A1: The CIDR blocks of your Simple Application Server and other VPC resources overlap, which may prevent internal network interconnection. First, verify whether internal connectivity works. If it does not, see Resolve CIDR block conflicts for vSwitches in VPC instances in CEN or Change the VPC of an ECS instance for solutions.

Q2: After setting up internal network interconnection, does only one Simple Application Server connect internally to cloud resources in the accepter VPC?

A2: No. All Simple Application Servers under the same account and in the same region reside in the same VPC by default. Therefore, all such servers can communicate internally with cloud resources in the accepter VPC.

Q3: After setting up internal network interconnection between a Simple Application Server and an ApsaraDB for Redis instance, why can’t they communicate over the internal network?

A3: To ensure the security and stability of Tair databases, the system blocks access from all IP addresses by default. After you enable service interconnection, you must add the private IP addresses or CIDR blocks of the Simple Application Servers to the whitelist of the ApsaraDB for Redis instances. For more information, see Configure Whitelist.

For more information about Redis instance authentication methods, see Authentication methods for instances.

Q4: After enabling internal network interconnection, why can’t my Simple Application Server connect internally to existing lightweight database instances in the same region?

A4: Before enabling internal network interconnection, Simple Application Servers and lightweight database instances created in the same region could communicate over the internal network. After enabling internal network interconnection, the underlying VPC for Simple Application Servers in that region changes, breaking internal connectivity with existing lightweight database instances. You can connect only over the public network. For more information, see Log on to a database over the public network using DMS.

Note

After enabling internal network interconnection, newly created lightweight database instances can communicate internally with Simple Application Servers in the same region.

References

By default, Simple Application Servers and Object Storage Service (OSS) in the same region support internal network interconnection without additional configuration. For more information, see Access OSS resources over the internal network using OSS internal endpoints.

Previous：Scale up a data diskNext：O&M and monitoring