Alibaba Cloud Recharge: Troubleshooting IP Unable to Route and Subnetting of Network Segment
When building an enterprise-level cloud architecture or cross-cloud/hybrid cloud networking, many teams have encountered such crazy scenarios:
The firewall on the open line is configured and the security group is fully released. The routing table looks clear, but there is "ping failure" and "routing failure" between two VPCs or between the cloud and the local data center (IDC) ".
As an SEO site optimizer, I 've delved into many of the underlying network issues that affect site availability and load performance. The Spider spider of the search engine is extremely sensitive to the network connectivity and response delay (TTFB) when crawling web pages. If the on-cloud microservice architecture times out due to VPC (proprietary network) network segment overlap or routing conflicts, the front-end page will frequently throw 502/504 errors. This will not only directly lower the Core Web Vitals score, but also allow search engines to determine the site is unstable, and then significantly cut off the site's inclusion and keyword ranking.
Today, we will proceed from the actual combat network, in-depth analysis
The underlying causes of IP unroutable due to network segment conflict in Alibaba Cloud VPC
And teach you how to do science.
Network Segment Division and Subnet (VSwitch) Planning
.
1. Why IP cannot be routed due to VPC CIDR block conflicts?
To understand this problem, we must first understand the underlying routing logic of Alibaba Cloud VPC.
1. The longest prefix matching principle (Longest Prefix Match)
The routing tables in Alibaba Cloud VPC, as well as CEN, VPN Gateway, and VBR, follow the core rules of network communication when forwarding data packets--
Longest Prefix Match
.
When the network segments of multiple destinations overlap in the system routing table and the custom routing table, the router will preferentially select the route with the longest subnet mask (that is, the most accurate and specific range) for forwarding.
2. Three typical scenarios of network segment conflicts
Scenario A:VPC completely overlaps with the local IDC network segment. For example, the VPC on Alibaba Cloud selects 192.168.0.0/16, while the local IDC of the enterprise happens to be 192.168.0.0/16. When you establish a dedicated line (VBR) or try to communicate IPsec-VPN, the routing table inside the VPC will digest all 192.168.x.x traffic inside the VPC by default, and will not send data packets to the dedicated line gateway at all, resulting in direct "disconnection" between the two sides ".
Scenario B: When multiple VPC CIDR blocks intersect (the CIDR blocks overlap or include), the VPC-A CIDR block is 10.0.0.0/16, and the VPC-B CIDR block is 10.0.1.0/24. When both ends are connected through a Cloud Enterprise Network (CEN) or peer-to-peer connection, the traffic VPC-A to access 10.0.1.100 can be sent.
In the past, the traffic returned by the VPC-B was intercepted by its own local direct connection route, resulting in "one-way communication" or "direct packet loss".
Scenario C: Conflicts with Alibaba Cloud Reserved CIDR Block or Container CIDR Block (K8s/ACK) Some underlying managed services of Alibaba Cloud (such as Pod CIDR Block of ACK Container Service, Service CIDR Block, or 100.64.0.0/10 of SLB Health Check CIDR Block) need to occupy specific private network space. If you blindly plan when creating a VPC, the CIDR block of the pod conflicts with the CIDR block VSwitch the node, and the Pod IP between containers cannot complete cross-node routing.
Four-step method for in-depth troubleshooting of 2. VPC network segment conflicts and routing exceptions
When you encounter "IP cannot be routed" or "network one-way unreachable" on the cloud, do not blindly change the security group. It is recommended to check according to the following standardized process:
Step 1: Check the CIDR range of the VPC and Internet segment
Log on to the Alibaba Cloud console and find
VPC
, check both ends of the conflict
Main segment (Primary CIDR)
with
Additional segment (Secondary CIDR)
.
O & M and Infrastructure Tips: Before troubleshooting the network architecture and preparing to implement network segment reconfiguration or build a new VPC, make sure that the O & M status of the cloud account is normal. If the enterprise is launching a new project, expanding a new regional node, or purchasing a dedicated line/VPN gateway component, please confirm that the Alibaba Cloud account has been recharged or the account balance is sufficient. Avoid VPN gateway downtime, dedicated channel interruption, or routing table lock caused by cloud resource arrears, thus concealing the real network segment conflict troubleshooting results.
Step 2: Analyze Route Table Priority and Details
Go to the VPC route table page and check the following two types of routes:
System Route: Direct routes that are usually 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 have the highest priority and cannot be deleted.
Custom Route: Contains routes to CEN, VBR, VPN Gateway, NAT Gateway, or ECS instances. Check whether the destination network segment is the same but the next hop is different, or whether the high-priority route masks the destination IP address ".
Step 3: Use Alibaba Cloud Network Intelligence Service (NIS) for path analysis
Aliyun officially provides a very powerful Diagnostic tool--
Network Intelligence Service NIS(Network Intelligence Service)
:
Open the NIS console and select Path Analysis.
Enter the IP address of the source ECS instance and the IP address of the destination ECS instance (such as an IDC or an ECS instance in another VPC).
Click to initiate
Analysis, NIS will automatically draw the traffic path and clearly indicate which routing node the packet was dropped due to "network segment conflict/lack of route" (Drop).
Step 4: Use it inside ECS
traceroute
or
Mass Transit Railway
Diagnosis
Log on to the source Linux ECS and run the following command:
Bash
# Diagnose which step on the path is missing
traceroute -n <destination IP>
# Or use MTR to view packet loss rate and node response
mtr -g <destination IP>
If the traffic is terminated as soon as it leaves the local network (the first hop) or as soon as it arrives at the gateway, and there is no next hop in the VPC system, it can be basically determined that the local route is blocked due to a network segment conflict.
How Do 3. Plan VPC CIDR Block and Subnetting (VSwitch) Scientifically?
"It is better to prevent the fire afterwards than to prevent it beforehand". The most thorough way to solve the network segment conflict is to establish a standard in the early stage of business construction.
Cloud IP Address Management (IPAM) System
.
The private CIDR blocks allowed by Alibaba Cloud VPC mainly include three standard blocks:
10.0.0.0/8(16,777,216 IP)
172.16.0.0/12(1,048,576 IP)
192.168.0.0/16(65,536 IPs)
1. Golden Rule of Enterprise Network Segment Division
Rule 1: Isolate network segments strictly according to the environment (Env)
Never use the exact same CIDR in the production environment (Prod), test environment (Test), and development environment (Dev)! The recommended scheme is as follows:
Production VPC(Prod): Use 10.1.0.0/16
Test environment VPC(Test): Use 10.2.0.0/16
Development Environment VPC(Dev): Using 10.3.0.0/16
Offline IDC computer room: unified reservation of 10.100.0.0/16
Rule 2: Reserve enough expansion space (mask blank)
When allocating a network segment to a VPC, use
/16
Mask (including 65,535 IP), but only a few were created initially.
/24
Mask of the switch (VSwitch, contains 254 IPs). The remaining subnet CIDR blocks are left blank for future service expansion or access to the container cluster.
Rule 3: Subnetting Across Availability Zones and Business Levels
A VPC contains multiple switches (VSwitch), and each VSwitch can only belong to a specific
Availability Zone (Zone)
. It is recommended that in accordance with"
Availability Zone Business Hierarchy
"for subnetting:
Subnet Name
Availability Zone
Subnet CIDR Example
Role and Planning Description
VSw-Web-Zone
A
Zone A
10.1.1.0/24
Store application gateways, Nginx, and front-end Web servers
VSw-App-ZoneA
Zone A
10.1.2.0/24
Store backend microservices and Java/Node.js business nodes
VSw-DB-ZoneA
Zone A
10.1.3.0/24
Store RDS databases and Redis cache nodes
VSw-Web-ZoneB
Zone B
10.1.11.0/24
Cross-zone disaster recovery, corresponding to the Web tier of ZoneA.
VSw-App-ZoneB
Zone B
10.1.12.0/24
Cross-zone disaster recovery, corresponding to the app layer of ZoneA
VSw-DB-ZoneB
Zone B
10.1.13.0/24
Cross-zone disaster recovery, corresponding to the DB layer of ZoneA
After this division, not only the routing table is extremely clear, but also in combination with the security group rules, it is very convenient to realize the in-depth security defense of "only allowing Web subnet to access App subnet and only allowing App subnet to access DB subnet.
4. if the network segment has conflicts, how to smooth repair?
If your business is already running, but the VPC and the local IDC network segments overlap due to historical reasons, the cost of rebuilding the VPC and migrating data is extremely high. The following remedial options can be used at this point:
1. Use VPC to attach a network segment (Secondary CIDR)
Alibaba Cloud VPC supports the expansion of new CIDRs without affecting existing services.
In the VPC console, add a new non-conflicting additional CIDR block (for example, 172.18.0.0/16).
Create a new switch (VSwitch) under the additional network segment.
The services that require cross-network segment communication are gradually migrated or tied to the new VSwitch node.
2. IP address mapping with NAT gateway (Private NAT)
If you can't modify the CIDR on either end, you can do so by deploying
Private NAT Gateway (Private NAT)
To achieve the interoperability of overlapping network segments.
Through SNAT (source address translation) and DNAT (destination address translation), the conflicting real IP (for example, 192.168.1.100) is mapped to a neutral virtual IP (for example, 10.254.1.100).
Cross-domain traffic only needs to access the mapped neutral IP to complete routing, thus skillfully bypassing the collision caused by the longest prefix match.
5. SEO perspective summary: the network base determines the upper limit of the site
Many website managers tend to focus only on front-end code optimization and content construction, but ignore the cloud computing infrastructure for SEO.
The far-reaching impact.
High intranet availability guarantees high capture rate: Reasonable VPC network segment division and clear routing table are the prerequisites for ensuring high concurrency and low latency communication of microservices. The inner web link is unimpeded, the front page can be loaded in seconds, and the search engine spider can efficiently complete the index capture.
Avoid unavailability caused by architecture reconstruction: once the network is paralyzed or forced to stop for migration due to network segment conflicts, the 500/502 error report generated by the whole station will seriously damage the trust established by the search engine and lead to the destruction of the keyword ranking accumulated for a long time.
Operation and maintenance funds to ensure the stability of the cloud: the stable operation of the infrastructure is inseparable from the standardized operation and maintenance management of enterprise cloud resources. During VPC planning, CEN construction, dedicated line access, or network component expansion, budget planning is arranged in advance to ensure the completion of Alibaba Cloud account recharge, which can effectively prevent the risk of the entire station intranet interruption caused by the shutdown of cloud network components due to arrears.
Understand the principle of VPC routing, do a good job of forward-looking subnet network segment planning, you can build a set of highly available, easy to expand the cloud network base for the website, for the stable operation of the site and SEO echelon construction escort!
