VPC FAQs

What are the components of a VPC?

Baidu AI Cloud virtual private cloud consists of multiple services:

1. Subnets: Users can customize the network segments of the virtual private cloud and its subnet’s network segments.

   A Virtual Private Cloud (VPC) is a logically isolated virtual network within Baidu AI Cloud. It allows users to define the VPC's IP address range within a selected scope. A subnet is a division within the VPC’s IP range that hosts isolated resources.

2. Security group

   A Security Group is a stateful, packet-filtering virtual firewall that regulates inbound and outbound traffic for one or more Baidu Cloud Compute instances. It precisely defines ingress and egress policies based on protocol and port (IP + port), thus bolstering the security of services like Baidu Cloud Compute, Load Balancers, and cloud databases.

3. ACL

   Access Control List (ACL) is a firewall component within VPC that manages security group policies at the subnet level, allowing flexible traffic configuration for one or more subnets to meet diverse network security needs.

4. Route table

   A route table contains a set of routing policies that dictate how network traffic flows within each subnet of a virtual private cloud.

5. NAT gateway

   Internet connection: Flexible, high-performance Internet connection methods include the following two types:

   • The NAT gateway is a highly reliable network address translation (NAT) service that allows resources in private subnets to access the Internet.
   • An Elastic IP (EIP) is an independently allocated public IP for accessing the Internet. It supports dynamic binding and unbinding with various instances (e.g., BCC, DCC, BBC, NAT gateway) and is often used to mitigate instance failure impacts.

6. VPN gateway

   Deploy a hybrid cloud to connect the user’s data center and VPC. A VPN connection enables secure communication between the user’s IDC and the virtual private cloud through an encrypted public network tunnel.

7. Peering connections

   Peering connections offer users network interconnection services at the VPC level, facilitating traffic exchange between different virtual networks. These interconnections can occur within the same user account or across accounts and regions.

How to start using VPC?

Users can access VPC services via the Baidu AI Cloud console or APIs.

• For the management console, please refer to the [Operation guide](VPC/Operation guide/VPC.md).
• API: Refer to VPC [api](VPC/API Reference/Overview.md).

How many virtual private clouds, subnets, route tables, NAT gateways, peering connections, and VPN gateways can each user create?

Refer to VPC resource quotas. If additional resources are required, apply through Quota management.

What IP address ranges can be used in a virtual private cloud and subnet?

Virtual private clouds support three private IP ranges: 172.b.0.0/16 (where b is 16~31), 192.168.0.0/16, and 10.0.0.0/16. A VPC CIDR can use any of these ranges or parts of them. It also supports the use of public IP address ranges as VPC address ranges, though careful consideration is advised when opting for public IP addresses as private network segments.

Number of IPs in a network block = 2 ^ (32-mask). Therefore, the 10.0.0.0/16 network block can contain up to 65536 IP addresses.

Can the intranet IP of a Baidu Cloud Compute instance be modified? How?

It can be modified. Follow these steps:

1. Log in to the Baidu Cloud Compute console, click on Baidu Cloud Compute (BCC) in the left navigation panel, and navigate to the BCC list page.
2. Click the Baidu Cloud Compute Instance ID to access the BCC details page.
3. Click "Change Intranet IP" beside the Intranet IP Information section.
4. Enter the new IP address and click OK. The new IP will only take effect after the server is rebooted or the Network Interface Card is restarted within the BCC operating system.

Does Baidu AI Cloud distinguish between VPC and classic networks?

No, due to considerations for user services and product security, Baidu AI Cloud only provides VPC services. Traditional or classic networks are not supported.

Can a VPC communicate with the public network/other VPCs (cross-region or cross-account)/user data centers?

For a virtual private cloud, how can I configure only some resources to access the public network through the gateway?

Method 1: Bind an EIP to the resource instance in the VPC that requires public network access. This allows the instance to connect to the public network via the EIP.

Method 2: Use a NAT gateway for public network access. Place the Baidu Cloud Compute instances requiring public Internet access in a subnet and configure routing policies in the route table to direct public Internet-bound traffic through the NAT gateway. Follow these steps:

1. Set up a subnet and host Baidu Cloud Compute instances requiring public internet access within it. Use the console to purchase a Baidu Cloud Compute instance and choose the subnet during the network configuration step.
2. To purchase and configure a NAT gateway, refer to Configuration Steps.
3. Set routing policies in the subnet's route table to send packets meant for the public Internet through the NAT gateway.

Under one VPC, can Baidu Cloud Compute instances be created in different Availability Zones, and how?

Yes, but there are two prerequisites:

1. Instances can only be created in different Availability Zones (AZs) within the same region as the VPC. For instance, if your VPC is in the South China-Guangzhou Region, you can create Baidu Cloud Compute instances in Guangzhou availability zones A and B. However, you cannot create instances in both Guangzhou and Beijing Availability Zones under the same VPC.
2. To deploy a Baidu Cloud Compute instance in an availability zone, you must first establish a subnet in that zone.

How to connect a VPC with a traditional data center?

Use VPN or the Express Tunnel service to interconnect a VPC with a user's IDC network, thereby building a secure and customized hybrid cloud network for seamless and secure migration of existing services to the cloud.

What resources can be created within a VPC?

VPCs currently support services like Baidu Cloud Compute (BCC), dedicated compute (DCC), bare metal compute (BBC), elastic public IP (EIP), cloud disk server (CDS), dedicated ET, Baidu MapReduce (BMR), simple cache service (SCS), relational database (RDS), load balancer (BLB), and others. New products are being supported regularly; please check the official website for updates.

Can VPCs communicate internally?

By default, different VPCs are entirely isolated from one another, and inter-VPC internet communication is not enabled. To enable connectivity, users can set up peering connections for high-speed communication between VPCs. Alternatively, VPN gateways or EIP-based external communication can be used.

Can internet under the same VPC be interconnected?

Subnets within the same VPC are interconnected by default.

How can instances (Baidu Cloud Compute, databases) without public IP addresses access the Internet?

They can access the Internet via NAT gateway. By creating a NAT gateway and configuring the route table associated with the subnet, instances within the subnet can access the Internet. For detailed [operational steps](VPC/Operation guide/Network Connection/NAT Gateway.md), please refer to the documentation.

Can a VPC establish connections with multiple IDCs via VPN?

Yes, the private network currently supports multiple VPN gateways, allowing one VPN tunnel per gateway to connect multiple on-premise IDCs.

How is the network quality between a virtual private cloud and IDC connected via VPN guaranteed?

Communication between the virtual private cloud and IDC relies on the public network, which may be subject to latency, packet loss, or jitter. For more stable communication quality, it is recommended to use the Express Tunnel service. The VPN backend monitors network quality 24/7, including keepalive and network latency. If any network anomalies occur, operations personnel will promptly address them. Users can also monitor the traffic status of VPN Gateways and tunnels in real-time via the console and contact us promptly if anomalies are detected.

How to set up a high-availability virtual IP address service using Keepalived software in a VPC?

Follow these steps to set up a VIP Service within a VPC:

1. Configure unicast mode in Keepalived to establish heartbeat with peers;
2. The VIP must select an IP address outside the subnet range of the VPC; otherwise, the route configuration will fail the validity check
3. In the VPC route table [, configure the instance-type route ](VPC/Operation guide/Route table.md) to direct the next hop for the VIP to the primary instance
4. Configure switch actions in the Keepalived notify script. During a failure, call the Route Table API to delete the instance route where the next hop for the VIP is the primary instance and add a route where the next hop is the standby instance, achieving VIP migration.

How to conduct regular comprehensive checks on Security Group configurations?

You can activate the "Cloud Advisor" service to regularly receive inspection reports on the security, availability, performance and cost of cloud resources. The report includes several Security Group-related inspection items, such as Security Group - Unrestricted Access, and Security Group - Unrestricted Specific Ports. Please visit Cloud Advisor Homepage to learn about or activate the Cloud Advisor services.