Alibaba Cloud

Virtual Private Cloud

Product Introduction

Issue: 20200506
Virtual Private Cloud Product Introduction /  Legal disclaimer

Legal disclaimer
Alibaba Cloud reminds you to carefully read and fully understand the terms and conditions
of this legal disclaimer before you read or use this document. If you have read or used this
document, it shall be deemed as your total acceptance of this legal disclaimer.

1. You shall download and obtain this document from the Alibaba Cloud website or other
Alibaba Cloud-authorized channels, and use this document for your own legal business
activities only. The content of this document is considered confidential information of
Alibaba Cloud. You shall strictly abide by the confidentiality obligations. No part of this
document shall be disclosed or provided to any third party for use without the prior
written consent of Alibaba Cloud.

2. No part of this document shall be excerpted, translated, reproduced, transmitted, or

disseminated by any organization, company, or individual in any form or by any means
without the prior written consent of Alibaba Cloud.

3. The content of this document may be changed due to product version upgrades,
adjustments, or other reasons. Alibaba Cloud reserves the right to modify the content
of this document without notice and the updated versions of this document will be
occasionally released through Alibaba Cloud-authorized channels. You shall pay
attention to the version changes of this document as they occur and download and
obtain the most up-to-date version of this document from Alibaba Cloud-authorized
channels.

4. This document serves only as a reference guide for your use of Alibaba Cloud products
and services. Alibaba Cloud provides the document in the context that Alibaba Cloud
products and services are provided on an "as is", "with all faults" and "as available"
basis. Alibaba Cloud makes every effort to provide relevant operational guidance based
on existing technologies. However, Alibaba Cloud hereby makes a clear statement that it
in no way guarantees the accuracy, integrity, applicability, and reliability of the content
of this document, either explicitly or implicitly. Alibaba Cloud shall not bear any liability
for any errors or financial losses incurred by any organizations, companies, or individual
s arising from their download, use, or trust in this document. Alibaba Cloud shall not,
under any circumstances, bear responsibility for any indirect, consequential, exemplary
, incidental, special, or punitive damages, including lost profits arising from the use or
trust in this document, even if Alibaba Cloud has been notified of the possibility of such
a loss.

Issue: 20200506 I
Virtual Private Cloud Product Introduction /  Legal disclaimer

5. By law, all the contents in Alibaba Cloud documents, including but not limited to
pictures, architecture design, page layout, and text description, are intellectual property
of Alibaba Cloud and/or its affiliates. This intellectual property includes, but is not
limited to, trademark rights, patent rights, copyrights, and trade secrets. No part of
this document shall be used, modified, reproduced, publicly transmitted, changed,
disseminated, distributed, or published without the prior written consent of Alibaba
Cloud and/or its affiliates. The names owned by Alibaba Cloud shall not be used,
published, or reproduced for marketing, advertising, promotion, or other purposes
without the prior written consent of Alibaba Cloud. The names owned by Alibaba Cloud
include, but are not limited to, "Alibaba Cloud", "Aliyun", "HiChina", and other brands
of Alibaba Cloud and/or its affiliates, which appear separately or in combination, as
well as the auxiliary signs and patterns of the preceding brands, or anything similar
to the company names, trade names, trademarks, product or service names, domain
names, patterns, logos, marks, signs, or special descriptions that third parties identify as
Alibaba Cloud and/or its affiliates.

6. Please contact Alibaba Cloud directly if you discover any errors in this document.

II Issue: 20200506
Virtual Private Cloud Product Introduction /  Legal disclaimer

Issue: 20200506 III

Virtual Private Cloud Product Introduction /  Document conventions

Document conventions
Style Description Example

A danger notice indicates a

situation that will cause major Danger:
system changes, faults, physical Resetting will result in the loss of
injuries, and other adverse results. user configuration data.

A warning notice indicates a

situation that may cause major Warning:
system changes, faults, physical Restarting will cause business
injuries, and other adverse results. interruption. About 10 minutes
are required to restart an
instance.

A caution notice indicates warning

information, supplementary Notice:
instructions, and other content If the weight is set to 0, the server
that the user must understand. no longer receives new requests.

A note indicates supplemental

instructions, best practices, tips, Note:
and other content. You can use Ctrl + A to select all
files.

> Closing angle brackets are used Click Settings > Network > Set
to indicate a multi-level menu network type.
cascade.

Bold Bold formatting is used for buttons Click OK.

, menus, page names, and other UI
elements.

Courier font Courier font is used for commands. Run the cd /d C:/window
command to enter the Windows
system folder.

Italic Italic formatting is used for bae log list --instanceid

parameters and variables.
Instance_ID

[] or [a|b] This format is used for an optional ipconfig [-all|-t]

value, where only one item can be
selected.

Issue: 20200506 I
Virtual Private Cloud Product Introduction /  Document conventions

Style Description Example

{} or {a|b} This format is used for a required switch {active|stand}

value, where only one item can be
selected.

II Issue: 20200506
Virtual Private Cloud Product Introduction /  Document conventions

Issue: 20200506 III

Virtual Private Cloud Product Introduction /  Contents

Contents

Legal disclaimer......................................................................... I
Document conventions................................................................I
1 What is a VPC?....................................................................... 1
2 Architecture............................................................................ 3
3 Benefits.................................................................................. 5
4 Scenarios................................................................................6
5 Terms..................................................................................... 9
6 Limits................................................................................... 10

IV Issue: 20200506
Virtual Private Cloud Product Introduction /  1 What is a VPC?

1 What is a VPC?
A Virtual Private Cloud (VPC) is a private network dedicated to your Alibaba Cloud account.
You have full control over your VPC, which you can define and customize by specifying the
IP address range and configuring route tables and network gateways. You can also launch
Alibaba Cloud resources such as Elastic Compute Service (ECS), Relational Database Service
(RDS), and Server Load Balancer (SLB) in your own VPC.

Furthermore, you can connect your VPC to other VPCs or local networks to create a custom
network environment. In this way, you can smoothly migrate applications to the cloud and
extend on-premises data centers.

Components

Each VPC consists of one VRouter, at least one private CIDR block, and one or more
VSwitches.

Issue: 20200506 1
Virtual Private Cloud Product Introduction /  1 What is a VPC?

• Private CIDR block

When you create a VPC or a VSwitch, you must specify the private IP address range in the
form of a CIDR block.

You can use the standard private CIDR blocks listed in the following table and their
subnets as CIDR blocks of your VPCs. For more information, see #unique_4.

CIDR block Number of available private IP addresses

(excluding those reserved by the system)

192.168.0.0/16 65,532

172.16.0.0/12 1,048,572

10.0.0.0/8 16,777,212

• VRouter

A VRouter is a hub that connects all VSwitches in a VPC and serves as a gateway
between the VPC and other networks. After a VPC is created, a VRouter is automatically
created for the VPC. Each VRouter is associated with a route table.

For more information, see #unique_5.

• VSwitch

A VSwitch is a basic network device that connects different cloud resources in a VPC
. After you create a VPC, you can create one or more subnets in the VPC by creating
VSwitches. The VSwitches within a VPC are interconnected. You can deploy your
applications in VSwitches that belong to different zones to improve service availability.

For more information, see Create a VSwitch.

2 Issue: 20200506
Virtual Private Cloud Product Introduction /  2 Architecture

2 Architecture
Based on the tunneling technique, VPCs isolate virtual networks. Each VPC has a unique
tunnel ID, and each tunnel ID corresponds to only one VPC.

Background information

With the development of cloud computing, a variety of network virtualization techniques

have been developed to meet the increasing demands for virtual networks with higher
scalability, security, reliability, privacy, and connectivity.

Earlier solutions combined the virtual network with the physical network to form a flat
network, for example, the large layer-2 network. However, with the increase of virtual
network scale, problems such as ARP spoofing, broadcast storms, and host scanning are
becoming more serious. To resolve these problems, various network isolation techniques
are developed to completely isolate the physical network from the virtual network. One of
these techniques can isolate users with a VLAN. However, a VLAN only supports up to 4,096
nodes, which are insufficient for the large number of users in the public cloud.

Principles

Based on the tunneling technique, VPCs isolate virtual networks. Each VPC has a unique
tunnel ID, and each tunnel ID corresponds to only one VPC. A tunnel encapsulation carrying
a unique tunnel ID is added to each data packet transmitted over the physical network
between ECS instances in a VPC. In different VPCs, ECS instances with different tunnel
IDs are located on two different routing planes. Therefore, these ECS instances cannot
communicate with each other.

Based on the tunneling and Software Defined Network (SDN) techniques, Alibaba Cloud
has developed VPCs that are integrated with gateways and VSwitches.

Logical architecture

As shown in the following figure, a VPC consists of a gateway, a controller, and one or
more VSwitches. The VSwitches and gateway form a key data path. By using a protocol
developed by Alibaba Cloud, the controller distributes the forwarding table to the
gateway and VSwitches to provide a key configuration path. In the overall architecture,
the configuration path and data path are separated from each other. The VSwitches are
distributed nodes, the gateway and controller are deployed in clusters, and all links are
equipped with disaster recovery. These features improve the availability of the VPC.

Issue: 20200506 3
Virtual Private Cloud Product Introduction /  2 Architecture

4 Issue: 20200506
Virtual Private Cloud Product Introduction /  3 Benefits

3 Benefits
This topic describes the benefits of using VPCs.

High security

Each VPC has a unique tunnel ID, and each tunnel ID corresponds to a virtual network.
Different VPCs are isolated by tunnel IDs:

• Similar to traditional networks, VPCs can also be divided into subnets. ECS instances
in the same subnet use the same VSwitch to communicate with each other, while ECS
instances in different subnets use VRouters to communicate with each other.

• VPCs are completely isolated from each other and can only be interconnected by
mapping an EIP or a NAT IP address.

• ECS IP packets are encapsulated by using the tunneling technique. Therefore, informatio
n about the data link layer (layer-2 MAC address) of ECS does not go to the physical
network. As a result, the layer-2 network between different ECS instances or between
different VPCs is isolated.

• ECS instances in a VPC use security groups as firewalls to control traffic going to and
from ECS instances. This is layer-3 isolation.

High flexibility

You can use security groups or whitelists to flexibly control traffic going to and from the
cloud resources in a VPC.

Ease of use

You can quickly create and manage VPCs in the VPC console. After a VPC is created, the
system automatically creates a VRouter and a route table for the VPC.

High scalability

You can create multiple subnets in a VPC to deploy different services. Additionally, you can
connect a VPC to other VPCs or on-premises data centers to expand your network.

Issue: 20200506 5
Virtual Private Cloud Product Introduction /  4 Scenarios

4 Scenarios
This topic describes the scenarios in which VPCs are used to guarantee a high level of data
security and service availability.

Host applications that provide external services

You can host applications that provide external services in a VPC and control access to
these applications from the Internet by creating security group rules and access control
whitelists. You can also isolate Internet-based mutual access between the application
server and the database. For example, you can deploy the web server in a subnet that can
access the Internet and deploy the application database in a subnet that cannot access the
Internet.

Host applications that require access to the Internet

You can host applications that require access to the Internet in a subnet of a VPC and route
traffic through network address translation (NAT). After you configure SNAT rules, instances
in the subnet can access the Internet without exposing their private IP addresses, which can
be changed to public IP addresses any time to avoid external attacks.

6 Issue: 20200506
Virtual Private Cloud Product Introduction /  4 Scenarios

Implement disaster tolerance across zones

You can create one or multiple subnets in a VPC by creating VSwitches. VSwitches in a VPC
can communicate with each other. You can deploy resources on VSwitches in different
zones for disaster tolerance.

Isolate business systems

VPCs are logically isolated from each other. Therefore, you can create multiple VPCs to
isolate multiple business systems, for example, isolate the production environment from
the test environment. You can also create a peering connection between two VPCs if they
need to communicate with each other.

Issue: 20200506 7
Virtual Private Cloud Product Introduction /  4 Scenarios

Build a hybrid cloud

You can create a dedicated connection to connect your VPC to an on-premises data
center to expand your local network. By doing so, you can seamlessly migrate your local
applications to the cloud without changing the method of access to these applications.

Control big bandwidth fluctuations caused by multiple applications

If your applications generate big bandwidth fluctuations, you can configure DNAT
forwarding rules through the NAT Gateway. Then, you can add EIPs to Internet Shared
Bandwidth so that these EIPs can share the bandwidth. This can reduce bandwidth
fluctuations and save your cost.

8 Issue: 20200506
Virtual Private Cloud Product Introduction /  5 Terms

5 Terms
This topic describes the terms about VPCs.

Term Description

Virtual Private Cloud (VPC) A VPC is a private network established in Alibaba Cloud.
VPCs are logically isolated from each other. You can create
and manage cloud resources in your VPC, such as ECS, SLB
, and RDS.

VSwitch A VSwitch is a basic network device that connect different

cloud resources in a VPC. When you create a cloud resource
in a VPC, you must specify the VSwitch to which the cloud
resource is connected.

VRouter A VRouter is a hub that connects all VSwitches in a

VPC and serves as a gateway that connects the VPC to
other networks. A VRouter also forwards network traffic
according to the route entries in its route table.

Route table A route table is a list of route entries in a VRouter.

Route entry Each item in a route table is a route entry. A route entry
specifies the next hop address for the network traffic
directed to a destination CIDR block. Route entries are
divided into system route entries and custom route entries.

Issue: 20200506 9
Virtual Private Cloud Product Introduction /  6 Limits

6 Limits
This topic describes the limits of Virtual Private Cloud (VPC). Before you use this service, we
recommend that you understand these limits.

Item Limit Can I apply

for an
increase to
the quota?

The maximum number of VPCs that 10 submit a

can be created in a region ticket.

Available CIDR blocks for VPCs 192.168.0.0/16, 172.16.0.0/12, 10.0.0 submit a

.0/8, and their subnets ticket.

The maximum number of secondary 1 submit a

IPv4 CIDR blocks that can be created ticket.
in a VPC

The number of VRouters that can be 1 N/A

created in a VPC

The maximum number of VSwitches 24 submit a

that can be created in a VPC ticket.

The maximum number of route 10 submit a

tables that can be created in a VPC ticket.

The maximum number of custom 48 submit a

route entries that can be created in a ticket.
route table

The maximum number of user CIDR 3 N/A

blocks that can be created in a VPC

10 Issue: 20200506
Virtual Private Cloud Product Introduction /  6 Limits

Item Limit Can I apply

for an
increase to
the quota?

The maximum number of private IP 60,000 N/A

addresses that can be used by a VPC
Note:

• If an Elastic Compute Service

(ECS) instance has only one
private IP address, the ECS
instance uses only one network
address.
• If an ECS instance is associated
with multiple network interface
controllers, or a network
interface controller has multiple
IP addresses configured, the
number of network addresses
used by the ECS instance is
the total number of the IP
addresses assigned to the
network interface controllers
that are associated with the ECS
instance.

Issue: 20200506 11