Dedicated gateway
The dedicated gateway functions as the API connecting a local VPC to a physical dedicated line. When configuring the route table for physical line connectivity within a local VPC, ensure the next hop points to the corresponding dedicated gateway.
The dedicated gateway features the following attributes:
| Attribute | Value specification | Description |
|---|---|---|
| Gateway name | String format | User-defined dedicated gateway name |
| ID | String format | The system-generated dedicated gateway identifier, unique to this VPC |
| Status | Available/not configured | Current status of the dedicated gateway |
| Local region | North China-Beijing/South China-Guangzhou/East China-Suzhou | Region where the dedicated gateway is located |
| Local network | Local VPC ID/name | Local virtual private cloud |
| Bind physical dedicated line | Physical dedicated line ID and dedicated channel ID | Currently, only binding one physical dedicated line is supported |
Usage constraints
If a physical dedicated line is used for traffic interconnection, the following constraints must be satisfied:
- Upon completion of physical dedicated line construction and dedicated gateway configuration, to enable bidirectional traffic flow, route entries pointing to the peer network must be configured in both route tables, with the next hop of the local VPC route table directed to the corresponding dedicated gateway
- A single channel of a physical dedicated line can only connect one dedicated gateway within a VPC for that VPC
- The dedicated gateway and the local access point of the physical dedicated line must be within the same region
- The peer network of the physical dedicated line and the local VPC CIDR must not have overlapping ranges.
Create dedicated gateway
- In the left navigation bar of the Virtual Private Cloud console, select Network Connection - Dedicated Gateway, and click the Create Dedicated Gateway button.
- Fill in the following configuration information:
Basic configuration
| ConfigMap | Description |
|---|---|
| Virtual private cloud | Select virtual private cloud |
| Gateway name | Name information of dedicated gateway |
| Egress bandwidth | 2 Mbps to 10,000 Mbps |
| Bind physical dedicated line | Users may select to bind/not to bind physical dedicated line. To bind, enter the physical dedicated line ID and dedicated channel ID in the pop-up window |
| Description | Description of this dedicated gateway |
| Resource group | Select resource group |
Description:
- For dedicated channels, if the egress bandwidth exceeds 10,000 Mbps, contact Baidu AI Cloud staff to raise the upper limit.
Link probe
| ConfigMap | Description |
|---|---|
| Enabled or not | Link probe switch, disabled by default |
| Probing method | The probing method is PING (ICMP) |
| Source IP | The source IP defaults to "Auto-assign." If custom is selected, the custom IP must be an available IP within the VPC |
| Destination IP | The destination IP represents the interconnected IP of the bound channel IDC, automatically retrieved after binding the dedicated channel. The destination IP allow list for link probing supports user customization and helps check the availability of remote IPs under non-directly connected physical dedicated lines. Please note that this feature doesn’t create Ingress automatically. Users must configure routing on the destination IP's network device to point to the interconnected Baidu Cloud IP of the dedicated channel. |
| Health check interval | The interval for path checks (input range: integer within 1–60 ; recommended setting: 3 seconds) |
| Unhealthy threshold | If the number of consecutive health check failures exceeds the threshold, the path is considered unhealthy (Input range: 2–5, default: 3). |
| Health threshold | For an unhealthy path, if the number of consecutive health check successes exceeds the threshold, the path is considered healthy (input range: 2–5, default: 3). |
| Automatically generate route | By default, a route for connectivity probing is automatically generated. If this is disabled, users must manually create an Ingress to the IDC interconnection IP for connectivity probing. |
Description:
- If no dedicated channel is bound, link probe configuration cannot be performed.
- A dedicated gateway with link probe disabled will remain in the "Available" status after successfully binding to a physical dedicated line.
- Using link probe is recommended for multi-line routing of dedicated lines; otherwise, dedicated line issues may impact traffic switching toward the egress cloud.
- link probe destination IP supports customization (currently an allow list function). Submit a ticket to apply for access.
- After entering the configuration information, click OK to finalize the steps for creating the dedicated gateway.
Link probe usage restrictions:
- Typically, when the dedicated channel association feature is not used, a single dedicated gateway can only support one link probe.
- When users enable the dedicated channel association feature, multiple link probes can be added. However, each physical dedicated line can only select one dedicated channel for link probing.
(Optional) bind physical dedicated line
Application scenarios:
This step is necessary if the user's dedicated gateway is not linked to a physical dedicated line.
- On the Dedicated Gateway List page, select the gateway name and click Bind in the operation column.
- A configuration dialog pops up; enter the following configuration information:
| ConfigMap | Description |
|---|---|
| Bind physical dedicated line | Bound physical dedicated line ID and dedicated channel ID |
| Cloud network | Users can select the local VPC segment or customize one or more segments |
Description:
Each VPC supports up to 10 dedicated gateways. Submit a ticket to apply for additional quotas.
Edit dedicated gateway
Click the Edit button next to the dedicated gateway to access the Edit page.
- In the basic configuration section, fields such as gateway name, egress bandwidth, cloud network, and description can be modified, but bound physical dedicated lines and dedicated channels cannot be edited.
- In the link probing section, if previously configured, settings like the switch, health check interval, unhealthy threshold, and healthy threshold can be modified. However, the probing method, source IP, and destination IP cannot be edited. If link probing has not been configured beforehand, its settings will align with the creation page options.
- Enable options: "Enable" starts link probing, "Disable" removes the link probe configuration, and "Pause" retains the configuration but suspends link probing.
Configure dedicated gateway route
Once the Express Tunnel connection is established, users must configure the route table to enable traffic exchange between the cloud environment and their on-premises network. Current dedicated lines support load balancing and active-standby switching.
Steps to configure the route table in Baidu AI Cloud:
- In the navigation bar, select Route Table, and then click Add Route in the route table list.
- Enter the route table associated with the on-premises network that will be accessed.
| ConfigMap | Description |
|---|---|
| Source network segment | Enter the source network segment |
| Destination segment | Enter the destination network segment |
| Route type | Select dedicated gateway to configure single-line and multi-line routing. Multi-line routing supports active-standby and load balancer modes |
| Next-hop instance | Select the created dedicated line gateway. |
| Description | Edit route entry description information |
- Click OK to complete the route table configuration. When BCCs within the associated subnet of this route table access the on-premises network, traffic will be routed through the dedicated gateway.
Local data center CPE device configuration
Static routing is configured between the dedicated gateway and the local IDC. The local CPE device must be configured with the following static routes:
- On the local CPE device, configure the next hop of the first dedicated gateway's link probe source IP as the interconnect IP address of the first cloud-based dedicated channel.
- On the local CPE device, configure the next hop of the second dedicated gateway's link probe source IP as the interconnect IP address of the second cloud-based dedicated channel.
View monitor data
- Log into the Management Console, select Product Service - Virtual Private Cloud (VPC), then go to Network Connection - Dedicated Gateway in the left navigation bar to view the Dedicated Gateway Instance List.
- Select Monitor after the instance, and a floating monitor window will appear on the right side of the page.
- Click View More to access the Monitor Of Instance Details page.
Dedicated gateway supports TOPN statistics
TOPN: After setting the time range, statistical method, and metric, enable the TOP display function and click the Refresh button on the far-left side. The system will then automatically showcase the top 10 VPC network segments ranked by traffic share based on your selection.
Statistical methods include: Average, Maximum, Minimum, Sum.
Monitoring metrics include: ingress traffic, egress traffic, ingress bandwidth, egress bandwidth, ingress packet rate, and egress packet rate.
Log into the Baidu AI Cloud Management Console, select Product Service - Network - Virtual Private Cloud (VPC). In the left navigation bar, find the dedicated gateway, click its name, go to Monitor in the left navigation bar, and check the Dedicated Gateway Instance Monitor Information.
Note:
- At present, the TOPN function is in the public beta stage. To apply for a trial use, please submit a Ticket application.
- The status of the dedicated gateway instance is shown as "available."
- Network traffic must route through the dedicated gateway instance.
- After clicking the Refresh button, there may be a delay before the Traffic Graph appears. Please wait approximately three minutes for it to load.
- Data should be available within the past three days, and the maximum query time span is 30 days.
- The system supports three time selection methods: 1. Query time range less than 1 hour (1–59 minutes): For example, if you initiate a query at 20:00, only data from 18:56 to 19:55 can be queried. 2. Query time range of more than 1 hour: Query time must be an integer multiple of 1 hour, ranging from 1 to 12 hours. For example, if you query at 20:00 with a range between 1 and 12 hours, only data before 19:00 will be available. 3. For ranges over 1 hour that are not whole multiples, you can query up to an hour's data combined with a range of less than 1 hour (1–59 minutes).
Manage Alarms
Users can manage alarm policies of dedicated gateway. For detailed steps, refer to [BCM Alarm Management](BCM/Operation guide/Alarm Service/Manage Alarms.md).