Docs

Direct Connect

Cloud data interconnection

Connecting cross-region data center to cloud via Direct Connect and CEN

This topic describes how to access Virtual Private Clouds (VPCs) in different regions from an on-premises data center through multiple BGP-based Direct Connect (DC) links separately.

Scenarios

A company has separate data centers in Guangzhou and Beijing, IDC-01 and IDC-02. The two data centers are connected via DC. The company has the following goals:

Access from IDC-01 (CIDR block: 192.168.1.0/24) to a VPC (VPC-01, CIDR block: 10.122.100.0/24) in the China (Guangzhou) region. To ensure service availability, deploy dual DC links to establish equal-cost multi-path routing (ECMP) between the data center and VPC.

Access from IDC-02 (CIDR block: 192.168.2.0/24) to a VPC (VPC-02, CIDR block: 10.122.200.0/24) in the China (Guangzhou) region.

VPC-01 and VPC-02 are configured for intercommunication.

Considering IDC-01 and IDC-02 are interconnected via DC, the solution uses multiple Cloud Enterprise Networks (CENs) and DC Gateways with custom Autonomous System Number (ASN). This not only achieves all goals, but also saves the CEN cross-region bandwidth package cost for the company. The overall network design is shown in the diagram below:

tip

This solution focuses on:

Plan the ASN for each DC Gateway based on the sample values in this solution. None of the DC Gateway ASNs can be 137718.

The custom DC Gateway ASNs of multiple DC Connections connecting the same data center and the same CNE must be the same (as DC Gateways shown in the figure, dcg-gz-01 and dcg-gz-02). In other scenarios, each DC Gateway ASN must be unique (as DC Gateways shown in the figure, dcg-bj and dcg-gz-01).

Prerequisites

Both IDC-01 and IDC-02 have DC Connections available. For procedure, see Creating a Direct Connect Connection.

The network between IDC-01 and IDC-02 is operational. Both data centers are equipped with gateway devices that support BGP routing.

tip

This example does not cover the interconnection method between IDC-01 and IDC-02 or the configuration of the associated switches and routers.

You have created two separate VPCs (VPC-01 and VPC-02) and their subnets in China (Guangzhou) and China (Beijing). For specific procedure, see Creating a VPC.

You have planned the CIDR blocks in advance to ensure VPC-01's CIDR blocks do not conflict with those of IDC-01, IDC-02, and VPC-02. For more about network planning, see Network planning and design.

Limits

Except for the two DC Connections accessing the same CEN (dcg-gz-01 and dcg-gz-02 in this example), the custom ASN of each DC Gateway must be unique and must not be 137718.

If an on-premises data center contains multiple DC Connections, and their DC Gateways are associated with the same CEN, you must ensure the custom ASNs of these DC Gateways are identical. Take "Scenarios" as an example. The custom ASNs for dcg-gz-01 and dcg-gz-02 must be identical.

Procedure

Step 1: Create a DC Connection

Activate three DC Connections. For procedure, see Creating a Direct Connect Connection. The DC Connections in this example are as follows:

IDC-01: DAS225_port01_conn and DAS225_port02_conn in China (Guangzhou), connecting to separate switches.

IDC-02: DAS387_port01_conn in China (Beijing).

Step 2: Create a DC Gateway

Create a DC Gateway for the DC Connection in IDC-01

In the top menu bar, select the region: China (Guangzhou).

Click Create DC Gateway.

Configure the DC Gateway based on the table below.

Parameter	Description	Sample value
Regions	The region where the DC Gateway is deployed. It must match the region of the DC Connection.	China (Guangzhou)
Name	Set a name for the DC Gateway.	dcg-gz-01
ASN	Set an ASN for the DC Gateway.	30000
IPv6	Enable IPv6 as needed.	Disable
Project	Select the project to which the new DC Gateway belongs.	Project-test
Agreement	Follow the console guidance to review and accept Legal.	Check

After confirming all parameters are correct, click Buy now to complete the action.

Click Go to console to return to the DC Gateway console. You can view the new DC Gateway (dcg-gz-01) in the DC Gateway list.

Repeat steps 1-6 to create another DC Gateway (dcg-gz-02) with configurations listed in the table below.

Parameter	Description	Sample value
Regions	The region where the DC Gateway is deployed.	China (Guangzhou)
Name	Set a name for the DC Gateway.	dcg-gz-02
ASN	Set an ASN for the DC Gateway.	30000
IPv6	Enable IPv6 as needed.	Disable
Project	Select the project for the new DC Gateway.	Project-test
Agreement	Follow the console guidance to review and accept Legal.	Check

tip

As dcg-gz-01 and dcg-gz-02 are connected to the same CEN, their ASNs must be identical.

Create a DC Gateway for the DC Connection in IDC-02

Repeat steps 1-6 of "Create a DC Gateway for the DC Connection in IDC-01" to create a DC Gateway (dcg-bj) in China (Beijing) with configurations listed in the table below.

Parameter	Description	Sample value
Regions	The region where the DC Gateway is deployed.	China (Beijing)
Name	Set a name for the DC Gateway.	dcg-bj
ASN	Set an ASN for the DC Gateway.	40000
IPv6	Enable IPv6 as needed.	Disable
Project	Select the project to which the new DC Gateway belongs.	Project-test
Agreement	Follow the console guidance to review and accept Legal.	Check

Step 3: Create a Virtual Interface

Create a Virtual Interface for the DC Connection in IDC-01

Click Create DC Virtual Interface.

Configure the Virtual Interface based on the table below.

Parameter	Description	Sample value
Basic information
Resource owner	Select the account to which the Virtual Interface belongs.	My account
Regions	The region where the Virtual Interface is deployed. It must be the same as the region of the DC Connection and the DC Gateway.	China (Guangzhou)
Name	Set a name for the Ethernet Virtual Interface.	VIF-gz-01
DC Connection	Filter the DC Connection by project to associate with the Virtual Interface.	Project-test\|DAS225_port01_conn
DC Gateway	Filter the DC Gateway by project to associate with the Virtual Interface.	Project-test\|dcg-gz-01
Bandwidth limit	Enable bandwidth limit as needed.	Disable
Interconnection information
IPv4 interconnect IP	Set the IPv4 IP for interconnection. Cloud gateway peer IP: Set an IPv4 address and mask for the cloud DC gateway. You may customize the interconnect IP according to network planning, but confirm that the cloud gateway peer IP and your gateway peer IP are in the same CIDR block without duplication. Use a private IP address that does not conflict with cloud or on-premises IP addresses. Your gateway peer IP: Set an IPv4 address and mask for the gateway on your on-premises data center. You may customize the interconnect IP according to network planning, but confirm that the cloud gateway peer IP and your gateway peer IP are in the same CIDR block without duplication. Use a private IP address that does not conflict with cloud or on-premises IP addresses.	Cloud gateway IP: 10.0.0.1/30 Your gateway IP: 10.0.0.2/30
IPv6 interconnect IP	Enable IPv6 IP for interconnection as needed.	Disable
VLAN ID	Set a VLAN ID for connecting to the data center. Confirm that this VLAN ID is unoccupied. Range: 0–2999. 0: The DC Connection's switch port operates in Layer 3 routing mode with no VLAN configured. This mode supports only a single untagged Virtual Interface per DC Connection. 1–2999: The DC Connection's switch port operates in Layer 3 sub-interface mode. Each sub-interface has a unique VLAN ID mapped to a separate Virtual Interface. This mode supports multiple Virtual Interfaces per DC Connection.	10
Routing information
Route type	Support two route types: BGP and Static. The type is BGP in this example.	BGP
Peer ASN	Set the ASN of the BGP Peer (IPv4). The valid range for ASN is 1 to 4294960000. The ASN of the BGP Peer can neither be the same as that of the DC Gateway, nor be the VolcanoEngine ASN (137718).	465000
BGP key	Type the key for the IPv4 BGP Peer.	123456****
Detection method	Select a detection method to check the line health. For details, see Detection methods. In Direct Connect redundancy access mode, enabling Bidirectional Forwarding Detection (BFD) allows quick line switching when a route failure occurs. If enabling BFD control packet, you must configure BFD synchronously for your data center, confirming that Detect interval and Detect multiplier match those configured on VolcanoEngine.	BFD
BFD mode	Select a mode for the BFD detection. The mode is BFD control packet in this example.	BFD control packet
Detect interval	The time interval for sending and receiving BFD packets.	1000
Detect multiplier	The number of detection attempts. If a session fails to receive the defined number of consecutive packets, the system declares a route failure.	3

Click Create to complete the action.

Repeat steps 1-4 to create another Virtual Interface with configurations listed in the table below.

Parameter	Description	Sample value
Basic information
Resource ownership	Select the account to which the Virtual Interface belongs.	My account
Regions	The region where the Virtual Interface is deployed. It must be the same as the region of the DC Connection and the DC Gateway.	China (Guangzhou)
Name	Set a name for the Ethernet Virtual Interface.	VIF-gz-02
DC Connection	Filter the DC Connection by project to associate with the Virtual Interface.	Project-test\|DAS225_port02_conn
DC Gateway	Filter the DC Gateway by project to associate with the Virtual Interface.	Project-test\|dcg-gz-02
Bandwidth limit	Enable bandwidth limit as needed.	Disable
Interconnection information
IPv4 interconnect IP	Set the IPv4 IP for interconnection.	Cloud gateway peer IP: 10.0.0.5/30 Your gateway peer IP: 10.0.0.6/30
IPv6 interconnect IP	Enable IPv6 IP for interconnection as needed.	Disabled
VLAN ID	Set a VLAN ID for connecting to the data center. Confirm that this VLAN ID is unoccupied. Range: 0–2999.	20
Routing information
Route type	Support two route types: BGP and Static.	BGP
Peer ASN	Set the ASN of the BGP Peer (IPv4).	465000
BGP key	Type the key for the IPv4 BGP Peer.	123456****
Detection method	Select a detection method to check the line health. For details, see Detection methods. In Direct Connect redundancy access mode, enabling Bidirectional Forwarding Detection (BFD) allows quick line switching when a route failure occurs. If enabling BFD control packet, you must configure BFD synchronously for your data center, confirming that Detect interval and Detect multiplier match those configured on VolcanoEngine.	BFD
BFD mode	Select a mode for the BFD detection. The mode is BFD control packet in this example.	BFD control packet
Detect interval	The time interval for sending and receiving BFD packets.	1000
Detect multiplier	The number of detection attempts. If a session fails to receive the defined number of consecutive packets, the system declares a route failure.	3

Create a Virtual Interface for the DC Connection in IDC-02

Repeat steps 1-4 of "Create a Virtual Interface for the DC Connection in IDC-01" to create a Virtual Interface in China (Beijing) with configurations listed in the table below.

Parameter	Description	Sample value
Basic information
Resource ownership	Select the account to which the Virtual Interface belongs.	My account
Regions	The region where the Virtual Interface is deployed. It must be the same as the region of the DC Connection and the DC Gateway.	China (Beijing)
Name	Set a name for the Ethernet Virtual Interface.	VIF-bj
DC Connection	Filter the DC Connection by project to associate with the Virtual Interface.	Project-test\|DAS387_port01_conn
DC Gateway	Filter the DC Gateway by project to associate with the Virtual Interface.	Project-test\|dcg-bj
Bandwidth limit	Enable bandwidth limit as needed.	Disable
Interconnection information
IPv4 interconnect IP	Set the IPv4 IP for interconnection.	Cloud gateway peer IP: 10.0.0.9/30 Your gateway peer IP: 10.0.0.10/30
IPv6 interconnect IP	Enable IPv6 IP for interconnection as needed.	Disable
VLAN ID	Set a VLAN ID for connecting to the data center. Confirm that this VLAN ID is unoccupied. Range: 0–2999.	30
Routing information
Route type	Supports two route types: BGP and Static.	BGP
Peer ASN	Set the ASN of the BGP Peer (IPv4).	466000
BGP key	Type the key for the IPv4 BGP Peer.	123456****
Detection method	Select a detection method to perform a health check on the line.	BFD
BFD mode	Select a mode for the BFD detection.	BFD control packet
Detect interval	The time interval for sending and receiving BFD packets.	1000
Detect multiplier	The number of BFD detection attempts. If a BFD session fails to receive the defined number of consecutive packets, the system declares a route failure.	3

Step 4: Create a Cloud Enterprise Network and load the network instance

Click Create CEN.

Configure the CEN based on the table below and load VPC-01.

Parameter	Value
Basic information
Name	cen-01
Network Instances
Attaching a network instance	Enable
Regions	China (Guangzhou)
Instance type	VPC
Network Instances	Project-test\|VPC-01
More information
Project	Project-test

Click Create to complete the action.

In the CEN Instance list, click the name of the target instance: cen-01.

In the Network Instances tab, click Attach Network Instance.

The Attach Network Instance window pops up. Configure the information of the DC Gateway instance to be loaded, and then click Attach to complete the action.

Parameter
Value
Account
My account
Regions
China (Guangzhou)
Instance type
DC Gateway
Network Instances
dcg-gz-01

Repeat steps 5-7 to load another DC Gateway (dcg-gz-02) into cen-01.

Repeat steps 1-7 to create another CEN (cen-02) and load VPC-02. The specific configuration is shown in the table below.

Parameter	Value
Basic information
Name	cen-02
Network Instances
Attaching a network instance	Enable
Regions	China (Beijing)
Instance type	VPC
Network Instances	Project-test\|VPC-02
More information
Project	Project-test

Repeat steps 5-7 to load the DC Gateway (dcg-bj) into cen-02. The specific configuration is shown in the table below.

Parameter
Value
Account
My account
Regions
China (Beijing)
Instance type
DC Gateway
Network Instances
dcg-bj

Step 5: Add a security group rule to a VPC

You need to allow the IPs of IDC-01, IDC-02, and the peer VPC in the security groups of both VPC-01 and VPC-02.

In the top menu bar, select the region: China (Guangzhou).

In the VPC list, search for the target VPC: VPC-01.

Click VPC-01 to enter its details page, then click Security Group.

In the security group list, click Edit rule in the Actions column of the target security group.

On the Access rules tab, select Inbound rules, and click Add rule.

Add three inbound rules as shown in the figure below, allowing the CIDR blocks of IDC-01 (192.168.1.0/24), IDC-02 (192.168.2.0/24), and VPC-02 (100.122.200.0/24) to access VPC-01.

Similarly, repeat steps 1–6 to add three inbound rules in the security group of VPC-02, allowing the CIDR blocks of IDC-01 (192.168.1.0/24), IDC-02 (192.168.2.0/24), and VPC-01 (100.122.100.0/24) to access VPC-02.

Step 6: Configure on-premises routing

You also need to configure routes and BFD separately for IDC-01 and IDC-02. Since two switches (assumed as switch-01 and switch-02) are connected in IDC-01, configure BGP routes and BFD on respective switches.

Reference commands

Configuration on switch-01 of IDC-01:

bgp 465000 //465000 is the BGP neighbor ASN on the local IDC-01 side.​
peer 10.0.0.1 as-number 30000 //10.0.0.1 is the local (BytePlus side) peering IP address of the first dedicated line on the on-premises IDC-01 side; 30000 is the ASN of the dedicated line gateway dcg-gz-01.​
peer 10.0.0.1 password simple 123456**** // BGP key.​
peer 10.0.0.1 bfd ​
network 192.168.1.0 255.255.255.0 //Private CIDR block and subnet mask of local IDC-01.​
​
interface HGE1/1/1 // DC interface​
bfd detect-multiplier 3 //Number of BFD attemps.​
bfd min-transmit-interval 1000 //Minimum interval for sending single-hop BFD control packets.​
bfd min-receive-interval 1000 //Minimum interval for receiving single-hop BFD control packets.​

Configuration on switch-02 of IDC-01:

bgp 465000 //465000 is the ASN of the BGP Peer for on-premises IDC-01.​
peer 10.0.0.5 as-number 30000 //10.0.0.5 is the cloud gateway peer IP of the second DC on the on-premises IDC-01 side; 30000 is the ASN of the DC Gateway dcg-gz-02.​
peer 10.0.0.5 password simple 123456**** //BGP key.​
peer 10.0.0.5 bfd​
network 192.168.1.0 255.255.255.0 //Private CIDR block and mask of on-premises IDC-01.​
​
interface HGE1/1/1 // DC interface.​
BFD detect multiplier 3 // BFD detect multiplier (number of detection times).​
bfd min-transmit-interval 1000 //The minimum interval for sending single-hop BFD control packets.​
bfd min-receive-interval 1000 //The minimum interval for receiving single-hop BFD control packets.​

Configuration on the switch of IDC-02:

bgp 466000 // 466000 is the BGP neighbor ASN on the on-premises IDC-02 side.​
peer 10.0.0.9 as-number 40000  //10.0.0.9 is the local (cloud gateway) peering IP address of the on-premises IDC-02; 40000 is the ASN of dcg-bj.​
peer 10.0.0.9 password simple 123456**** // BGP key.​
peer 10.0.0.9 bfd​
network 192.168.2.0 255.255.255.0 //Private CIDR block and mask of on-premises IDC-02.​
​
interface HGE1/1/1 // DC interface.​
bfd detect-multiplier 3 // BFD detection time multiplier.​
bfd min-transmit-interval 1000 //The minimum interval for sending single-hop BFD control packets.​
bfd min-receive-interval 1000 // The minimum interval for receiving single-hop BFD control packets.​

Step 7: Test connectivity

Log in to any Elastic Compute Service (ECS) within VPC-01 in China (Guangzhou). Ping the IP address of an ECS within the interconnected CIDR block of VPC-02 in China (Beijing). A successful ping response confirms network connectivity between VPC-01 and VPC-02.

Last updated: 2026.08.24 11:30:49

Parameter	Value
Account	My account
Regions	China (Guangzhou)
Instance type	DC Gateway
Network Instances	dcg-gz-01