Connecting On-Premises IDC to Cloud VPC via Multi-Line ECMP (Static Routing)

Overview

This document provides guidance on how to integrate and use Express Tunnel (ET) to connect a local Internet Data Center (IDC) to the cloud via static routing with ECMP, enabling communication with a virtual private cloud (VPC) on the cloud.

Requirement scenarios

This document uses the scenario depicted in the diagram as an example to demonstrate how a local IDC can connect to Baidu AI Cloud using the static routing method of the Express Tunnel product for load redundancy. Normally, four physical dedicated lines simultaneously forward traffic. If one physical line fails, its traffic is load-balanced across the remaining physical lines to ensure uninterrupted service.

Solution overview

This document adopts the scenario in the following diagram as an example to explain how a local IDC accesses Baidu AI Cloud through ECMP dedicated lines. An enterprise in Beijing has a local IDC (VPC network segment: 192.168.0.0/16) and has created a virtual private cloud (VPC) (network segment: 172.168.0.0/12) in North China-Beijing Region of Baidu AI Cloud. To avoid single-point failures, the enterprise is required to apply for two physical dedicated lines from each of two carriers. Each pair of physical dedicated lines connects to the same Express Tunnel POP point of Baidu AI Cloud, with all four physical dedicated lines forwarding traffic simultaneously.

Configuration steps

Environment preparation

• Users have already created a VPC in the North China-Beijing Region of Baidu AI Cloud, and deployed related services using cloud resources such as Baidu Cloud Compute (BCC) within the VPC;
• Users have understood the security group rules applied to BCC instances in the VPC and ensured that the security group rules allow mutual access between the local IDC and cloud-based BCC instances;
• Before purchasing physical dedicated lines, users have reviewed the applicable billing rules. As this document requires four physical dedicated lines, users must submit four port applications.

Configuration example

Please execute configurations according to steps specified in the document, and proceed only after verifying the completion of the current step

Step I: Create a physical dedicated line

• Log in to the Baidu AI Cloud console.
• Go to Product Service, select Express Tunnel (ET), click on Physical Dedicated Line, and choose Apply for Physical Dedicated Line.
• On the Create Dedicated Channel page, configure the required parameters and click OK after confirming there are no mistakes.

• Description:

• After completing the configuration steps, submit the order to proceed to the payment page.
• After successfully completing the payment, go back to the physical dedicated line console interface, where the status will show "Pending Approval." Reach out to the Baidu AI Cloud team for review and approval.
• Once the Baidu AI Cloud team approves, the physical dedicated line status will update to "Available," and you will receive an email notification confirming the successful creation of Physical Dedicated Line 1.
• Repeat Step I to set up Physical Dedicated Lines 2, 3, and 4.

Step II: Create dedicated channel

• When the physical dedicated line becomes available, click on Dedicated Channel, and then choose Add Dedicated Channel under the dedicated channels section of the account.
• On the Create Dedicated Channel page, configure the required parameters and click OK after confirming there are no mistakes.

• Description:

• After completing the configuration, the status of the dedicated line channel on the console will display "Pending Application." Contact the Baidu AI Cloud team for review and approval.
• After approval from Baidu AI Cloud staff, the dedicated channel status will change to "available." Test connectivity between the cloud interconnection IP and the IDC interconnection IP.
• Repeat Step II to create dedicated channels for Physical Dedicated Lines 2, 3, and 4 in sequence.

Step III: Create a dedicated gateway and bind a dedicated channel

• Start by creating a VPC in the desired Region. In this document, a VPC has been created in the North China-Beijing Region of Baidu AI Cloud, and associated cloud resources, like BCC cloud servers, have been deployed within the VPC for related services.
• Once the dedicated channel is active, click on Dedicated Gateway. Alternatively, log in to the VPC Management Console and select Dedicated Gateway under Network Connections.
• From the dropdown menu at the top of the page, choose the desired cloud VPC, and then click Create Dedicated Gateway.
• On the Create Dedicated Gateway page, configure the parameter details, and click OK after ensuring that there are no errors.

• Description:

• Once the configuration is complete, the dedicated gateway's status on the console will change to "available." Repeat Step 3 to create Dedicated Gateways 2, 3, and 4 sequentially, binding each to Physical Dedicated Lines 2, 3, and 4 respectively.

Step IV: Create a dedicated gateway and bind a dedicated channel

• Configure routes in the VPC Route Table and on the Dedicated Channel Details page. Carefully review and verify this step, as any missing configuration could disrupt link connectivity.
• Configure the VPC multi-line routing
• Log in to the VPC Management Console and select "Route Table" under the Virtual Private Cloud (VPC) section.
• Use the dropdown at the top of the page to select a cloud VPC, and click on the corresponding route table name.
• Navigate to the VPC route interface and click "Add Route."
• In the "Add Route" interface, configure the necessary parameters and click "Confirm" after verifying them.

• Configure dedicated line route
• Log in to the Express Tunnel (ET) management console, go to the "Dedicated Channel" tab, select the channel ID associated with Physical Dedicated Line 1, and open the Dedicated Channel Details page.
• Go to the Route Management tab and click on Create New Route Entry.
• In the Create Route Entry interface, set the parameter details and click OK after reviewing them.

• After completing the configuration, repeat these steps to set up dedicated routing for Dedicated Channels 2, 3, and 4.

Step V: Configure local IDC

• Users need to finalize route settings on the local IDC side. Note that the commands will differ based on the vendor's equipment. Consult directly with the device vendor for detailed configuration commands.
• Here’s an example using configuration commands for a Cisco C-series switch.

ip route 172.16.0.0 255.240.0.0 9.39.39.1

ip route 172.16.0.0 255.240.0.0 9.39.39.5

ip route 172.16.0.0 255.240.0.0 9.39.39.9

ip route 172.16.0.0 255.240.0.0 9.39.39.13

Step VI: Create link probe

• By default, Baidu AI Cloud sends an ICMP packet every 3 seconds from the source IP address of each line to the destination address. If no response is received for three consecutive periods on a physical dedicated line, Baidu AI Cloud initiates a secondary inspection mechanism to identify the fault location. If an issue is detected, traffic will automatically reroute to another physical dedicated line.
• Log into the VPC Management Console and select Dedicated Gateway from the Network Connections section.
• In the Operations column for the appropriate dedicated gateway instance, click on Link Probe.
• Go to the Link Probe page and click the Add Rule button.
• On the Create Rules page, fill in the required parameters and click OK once all information is verified to be correct.

• Description:

• After completing the above configuration, wait a moment for the initialization inspection of the link probe.
• Once the link probe status is confirmed normal, repeat Step VI to create link probes for Dedicated Gateways 2, 3, and 4.

Step VII: Connectivity testing

• Description:

• After completing the above configuration, users should test the connectivity of the physical dedicated line.
• Log in to the BCC Instance within the VPC via the VPC Management Console.
• Run the ping command to verify connectivity between the BCC instance in the cloud VPC (172.16.0.0/12) and the local IDC (192.168.0.0/16). A reply message indicates a successful connection.
• Execute the tracert\traceroute command to check whether the two physical dedicated lines have achieved load balancing access through the route tracking commands.

Testing and verification

Related products (required)

Baidu Cloud Compute (BCC)