Peering Connections Typical Practice
Overview
Peering connections provide users with VPC-level network interconnection services, enabling traffic exchange between different virtual networks for a stable, high-speed connection, whether within the same or different regions, or between the same or different users. After establishing the peering connections, configure routes to control traffic at both the global and subnet levels. Additionally, set up security group and ACL security policies to ensure secure service access.
Usage restrictions:
- A single VPC can create up to 10 peering connection instances, and a single user is allowed to create a maximum of 10 such instances.
- Only one peering connection can exist between any two VPCs at the same time.
For detailed steps, refer to the peering connections Operation guide.
Requirement scenarios
Two VPC peering connections
This configuration is applicable when two VPCs need to access each other's resources.
Example case
Create a peering connection between VPC A and VPC B.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| VPC A | 172.17.0.0/16 | Peering connections | int-atob |
| VPC B | 192.168.0.0/16 | Peering connections | int-btoa |
Establish peering connections between one VPC and multiple VPCs
This configuration can be used when other VPCs need to access resources in the central VPC without requiring mutual access.
Example case
VPC A functions as the central VPC, connecting to VPC B, VPC C, and VPC D through peering connections.
- VPC A is connected VPC B via peering connections;
- VPC A is connected VPC C via peering connections;
- VPC A is connected to VPC D using peering connections.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| VPC A | 172.16.0.0/16 | Peering connections | int-atob |
| VPC A | 172.17.0.0/16 | Peering connections | int-atoc |
| VPC A | 10.0.0.0/16 | Peering connections | int-atod |
| VPC B | 192.168.0.0/16 | Peering connections | int-btoa |
| VPC C | 192.168.0.0/16 | Peering connections | int-ctoa |
| VPC D | 192.168.0.0/16 | Peering connections | int-dtoa |
Multiple VPCs are interconnected via peering connections
When multiple VPCs require unrestricted access to each other's resources (such as in File Sharing networks), this setup can be applied.
Example case
Four VPCs are interconnected via full-mesh peering connections. All VPCs are under the same Baidu AI Cloud account and have no overlapping CIDR blocks:
- VPC A is connected VPC B via peering connections;
- VPC A is connected VPC C via peering connections;
- VPC A is connected VPC D via peering connections;
- VPC B is connected VPC C via peering connections;
- VPC B is connected VPC D via peering connections;
- VPC C is connected to VPC D through peering connections.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| VPC A | 172.16.0.0/16 | Peering connections | int-atob |
| VPC A | 172.17.0.0/16 | Peering connections | int-atoc |
| VPC A | 10.0.0.0/16 | Peering connections | int-atod |
| VPC B | 192.168.0.0/16 | Peering connections | int-btoa |
| VPC B | 172.17.0.0/16 | Peering connections | int-btoc |
| VPC B | 10.0.0.0/16 | Peering connections | int-btod |
| VPC C | 192.168.0.0/16 | Peering connections | int-ctoa |
| VPC C | 172.16.0.0/16 | Peering connections | int-ctob |
| VPC C | 10.0.0.0/16 | Peering connections | int-ctod |
| VPC D | 192.168.0.0/16 | Peering connections | int-dtoa |
| VPC D | 172.16.0.0/16 | Peering connections | int-dtob |
| VPC D | 172.17.0.0/16 | Peering connections | int-dtoc |
Advanced scenarios
Two subnets within one VPC are each connected via peering connections to two separate VPCs
This configuration can be applied when separate resource collections exist in different subnets of the central VPC, and other VPCs need selective access to these resources.
Example case
VPC A is the central VPC, containing two subnets—subnet X and subnet Y—that are connected to VPC B and VPC C via peering connections, respectively.
- VPC A is connected VPC B via peering connections;
- VPC A is connected to VPC C through peering connections.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| Subnet X in VPC A | 10.0.0.0/16 | Peering connections | int-atob |
| Subnet Y in VPC A | 10.0.0.0/16 | Peering connections | int-atoc |
| VPC B | 172.16.0.0/24 | Peering connections | int-btoa |
| VPC C | 172.16.1.0/24 | Peering connections | int-ctoa |
Specific subnets in two VPCs establish peering connections with the same VPC
When a central VPC hosts a set of resources that do not require full access to peer-connected VPCs (e.g., for active directory services), this configuration can be utilized.
Example case
VPC A serves as the central VPC with a single subnet, while VPC B and VPC C have two subnets each, with only one subnet in each VPC dedicated to peering connections with VPC A.
- VPC A is connected VPC B via peering connections;
- VPC A is connected to VPC C through peering connections.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| VPC A | 10.0.0.0/24 | Peering connections | int-atob |
| VPC A | 10.0.1.0/24 | Peering connections | int-atoc |
| Subnet X in VPC B | 172.16.0.0/24 | Peering connections | int-btoa |
| Subnet Y in VPC C | 172.16.0.0/24 | Peering connections | int-btoc |
Multiple instances in one VPC establish peering connections with instances in two other VPCs respectively
This configuration is suitable if peering connection traffic needs to be restricted to specific instances.
Example case
VPC A is a central VPC with a single subnet containing two instances that are interconnected via peering connections to instances in VPC B and VPC C. As an example, BCC is used.
- VPC A is connected VPC B via peering connections;
- VPC A is connected to VPC C through peering connections.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| Instance 172.16.0.88/32 in VPC A | 10.0.0.44/32 | Peering connections | int-atob |
| Instance 172.16.0.99/32 in VPC A | 10.0.0.55/32 | Peering connections | int-atoc |
| Instance 10.0.0.44/32 in VPC B | 172.16.0.88/32 | Peering connections | int-btoa |
| Instance 10.0.0.55/32 in VPC C | 172.16.0.99/32 | Peering connections | int-ctoa |
Implement peering connections between one VPC and two VPCs by adopting the longest prefix matching
A VPC with peering connections to two VPCs within the same network segment can implement the longest prefix matching.
Example case
VPC A is a central VPC with a single subnet connected to VPC B and VPC C via peering connections. VPC B and VPC C have overlapping CIDR blocks. Specific instances in VPC A and VPC B are linked through peer connections, while other traffic targeting the 10.0.0.0/16 IP range is routed to VPC C. The instance is exemplified by Baidu Cloud Compute.
- VPC A is connected VPC B via peering connections;
- VPC A is connected to VPC C through peering connections.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| VPC A | 10.0.0.77/32 | Peering connections | int-atob |
| VPC A | 10.0.0.0/16 | Peering connections | int-atoc |
| VPC B | 172.16.0.0/16 | Peering connections | int-btoa |
| VPC C | 172.16.0.0/16 | Peering connections | int-ctoa |
Note: If VPC A sends traffic to an instance in VPC B other than 10.0.0.77/32, the traffic will be routed to VPC C instead of VPC B.
Complex topology cases
This configuration is recommended for complex topologies involving multiple VPC peering connections with partially overlapping CIDR blocks.
Example case
In this scenario, central VPC A is peered with multiple VPCs. VPC E connects to VPC F via peering. VPC A and VPC F share overlapping CIDR blocks, so peering traffic between VPC A and VPC E is restricted to a specific subnet (Subnet X) within VPC E. This ensures that if VPC E receives a request from VPC A or VPC F, the response traffic is sent to the correct VPC. Currently, Baidu AI Cloud does not support unicast reverse path forwarding in VPC peering and verifies the source IP of packets to route reply packets correctly.
Similarly, VPC E and VPC H share overlapping CIDR blocks. Peering traffic between VPC F and VPC E is limited to Subnet Y within VPC E, while peering traffic between VPC F and VPC H is restricted to Subnet X within VPC H. This ensures that if VPC F receives traffic from VPC E or VPC H, it can send response traffic to the appropriate VPC.
The route tables for VPCs B, D, E, F, and G are configured to direct traffic through relevant peering connections to access the full CIDR block of VPC A. Meanwhile, VPC A's route table is configured to connect with VPCs B, C, and D to access their respective CIDR blocks. For the peering connection int-aaaaeeee, VPC A's route table limits traffic to Subnet X (192.168.0.0/24) in VPC E, while Subnet X's route table in VPC E routes traffic to VPC A's full CIDR block.
The route table for VPC G directs traffic through the appropriate peering connections to access the complete CIDR blocks of VPC F and VPC H, while the route table for VPC H directs traffic through the relevant peering connections to access the full CIDR block of VPC G. Additionally, the route table for subnet X in VPC H is configured to access the full CIDR block of VPC F via the corresponding peering connection. The route table for VPC F enables connectivity to subnet Y in VPC E and subnet X in VPC H through designated peering connections.
- VPC A is connected VPC B via peering connections;
- VPC A is connected VPC C via peering connections;
- VPC A is connected VPC D via peering connections;
- VPC A is connected VPC E via peering connections;
- VPC E is connected VPC F via peering connections;
- VPC F is connected VPC G via peering connections;
- VPC F is connected VPC H via peering connections;
- VPC G has established a peering connection with VPC H.
Peering Connection Transitivity
A VPC that forms peering connections with multiple VPCs can enable cross-VPC communication through proper route table configurations, making this setup straightforward. This configuration involves using a relay VPC.
Example case
All VPCs belong to the same Baidu AI Cloud account. VPC B serves as the relay VPC and connects to both VPC A and VPC C in a star topology via peering connections. Route configurations are required to establish communication between VPC A and VPC C through VPC B.
- VPC A is connected VPC B via peering connections;
-
VPC B is connected to VPC C using peering connections.
Notes In this case, the route relay for VPC B must be enabled. Please refer to the [Relay VPC Operation Guide](VPC/Operation guide/VPC.md#Relay VPC).
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| VPC A | 172.16.0.0/16 | Peering connections | int-atob |
| VPC A | 10.0.0.0/16 | Peering connections | int-atob |
| VPC B | 192.168.0.0/16 | Peering connections | int-btoa |
| VPC B | 10.0.0.0/16 | Peering connections | int-btoc |
| VPC A | 10.0.0.0/16 | Peering connections | int-btoc |
| VPC C | 192.168.0.0/16 | Peering connections | int-btoa |
| VPC C | 192.168.0.0/16 | Peering connections | int-ctob |
| VPC C | 172.16.0.0/16 | Peering connections | int-ctob |
Additionally, Baidu AI Cloud supports enabling connection propagation for peering connections using dedicated lines or VPNs by configuring route tables.
CIDR block overlap
Peering connections allow two VPCs with overlapping CIDR blocks to interconnect.
Example case
VPC A and VPC B share the same CIDR block, each containing two subnets. They are connected through peering connections, and route table configurations enable communication between the subnets in each VPC.
Configure routes
| Source network segment | Destination segment | Route type | Next-hop instance |
|---|---|---|---|
| Subnet X in VPC A | 192.168.2.0/24 | Peering connections | int-atob |
| Subnet Y in VPC A | 192.168.4.0/24 | Peering connections | int-atob |
| Subnet X in VPC B | 192.168.1.0/24 | Peering connections | int-btoa |
| Subnet Y in VPC B | 192.168.3.0/24 | Peering connections | int-btoa |
Note: In this case, the subnet CIDRs at both ends must not overlap when configuring the route.
Unsupported cases
Multi-hop cases
The transitivity of peering connections is limited to one VPC.
Example case
VPC A is connected to VPC B, VPC B is connected to VPC C, and VPC C is connected to VPC D. However, direct connectivity between VPC A and VPC D is not supported. Switching from a linear topology to a star topology is recommended.
