Patent Description:
With development of cloud technologies, there is a demand for communication between a virtual private cloud (Virtual Private Cloud, VPC) and an on-premises data center. However, due to reasons such as private network address planning, if private network addresses of the VPC and the on-premises data center that need to communicate with each other overlap, that is, the VPC and the on-premises data center have a same private network segment, the VPC and the on-premises data center cannot communicate with each other.

<NPL> discloses that Twice NAT is necessary when private and external realms have address collisions. The most common case where this would happen is when a site had (improperly) numbered its internal nodes using public addresses that have been assigned to another organization. Alternatively, a site may have changed from one provider to another, but chosen to keep (internally) the addresses it had been assigned by the first provider. That provider might then later reassign those addresses to someone else. The key issue in such cases is that the address of the host in the external realm may have been assigned the same address as a host within the local site. If that address were to appear in a packet, it would be forwarded to the internal node rather than through the NAT device to the external realm. Twice-NAT attempts to bridge these realms by translating both source and destination address of an IP packet, as the packet transitions realms. SRISURESH M HOLDREGE LUCENT TECHNOLOGIES P also teaches that a private network connected to a business partner through a VPN could employ traditional NAT to communicate with the partner. Likewise, it is possible to employ twice NAT, if the partner's address space overlapped with the private network.

<CIT> discloses systems and methods for network address translations are provided, which include a dynamic double network address translation solution for interconnecting overlapping IP networks.

To resolve a problem in the conventional technology, this application provides a method for communication between a virtual private cloud and an on-premises data center, a method for configuring communication between a virtual private cloud and an on-premises data center, and a related apparatus, so as to resolve a technical problem that a VPC cannot communicate with an on-premises data center because private network addresses of the VPC and the on-premises data center overlap.

According to a first aspect, this application provides a method for configuring communication between a virtual private cloud VPC and an on-premises data center. The method is defined by claim <NUM>.

Through bridging of the second VPC, the first VPC accesses the subnet of the on-premises data center by using the second VPC, so that communication between the first VPC and the second VPC can be implemented when the private network address segments of the first VPC and the second VPC overlap.

By configuring a routing rule, the second VPC can forward a packet between the first VPC and the remote connection gateway, to implement bridging.

By configuring a packet rule, the NAT gateway binds the private network address in the first VPC with the first address, and binds the address in the subnet of the on-premises data center with the second address.

Through bridging of the second VPC, a device in the first VPC may access the remote connection gateway by using the second address.

In a possible implementation of the second aspect, the method further includes the following steps: configuring a connection between the NAT gateway and the second VPC, and configuring a remote connection between the remote connection gateway and the subnet of the on-premises data center.

Because the NAT gateway is connected to the second VPC, and the remote connection gateway is remotely connected to the subnet of the on-premises data center, the first VPC may access the subnet of the on-premises data center by accessing the remote connection gateway of the second VPC.

By setting a routing rule, the response packet returned by the subnet of the on-premises data center can be forwarded to the first VPC by using the second VPC, to make a response.

The remote connection gateway is remotely connected to the subnet of the on-premises data center. Therefore, after a packet reaches the remote connection gateway, the packet may reach the subnet of the on-premises data center through the remote connection gateway.

According to a second aspect, this application provides an apparatus for configuring communication between a virtual private cloud VPC and an on-premises data center. The apparatus is defined by claim <NUM>.

The second aspect or any implementation of the second aspect is an apparatus implementation corresponding to the first aspect or any implementation of the first aspect. Descriptions of the first aspect or any implementation of the first aspect are applicable to the second aspect or any implementation of the second aspect.

According to a third aspect, this application provides a computing device, including at least one memory and at least one processor. The at least one memory is configured to store program instructions, and the at least one processor executes the program instructions to perform the method in the first aspect or any possible implementation of the first aspect.

Terms used in embodiments of the present invention are first explained.

A cloud data center is a data center that provides a public cloud service.

An on-premises data center is a data center that provides a non-public cloud service. If the on-premises data center provides an on-premises service, the on-premises data center includes a plurality of physical machines (physical machine). If the on-premises data center provides a private cloud service, the on-premises data center includes a plurality of virtual machines.

A public cloud service is infrastructure as a service (Infrastructure as a Service, IaaS), and means that infrastructure provided by a public cloud service provider is externally provided as a service on the internet. In this service model, a user does not need to construct a data center, but rents infrastructure such as a server, a storage, and a network for use. The public cloud service is implemented by providing a virtual environment (such as a virtual machine). A core attribute of the public cloud service is that a plurality of users share cloud infrastructure and the users are isolated from each other.

A non-public cloud service is infrastructure dedicated to a single user, for example, a private cloud service and an on-premises service.

A private cloud (Private Cloud) service means that a single user owns infrastructure such as a server, a storage, and a network, and can fully control the infrastructure. The private cloud service is implemented by providing a virtual environment (such as a virtual machine). A core attribute of the private cloud service is that the single user exclusively uses the infrastructure.

An on-premises (On-premises) service means that a single user locally builds infrastructure such as a server, a storage, and a network. The user exclusively uses the infrastructure. The on-premises service is implemented by using a physical machine.

A private network address is an IP address that cannot be forwarded on the internet but can be forwarded only on a local area network. The private network address is prohibited from being used on the internet.

The private network address is a reserved IP address. The following table lists classification of private network addresses, a network segment, and a quantity of private network addresses.

Virtual private cloud (Virtual Private Cloud, VPC): The VPC is configured on a public cloud, and the VPC is a local area network of a user of a public cloud service in a cloud data center.

Specifically, VPCs are used to isolate virtual networks. Each VPC has an independent tunnel number, and one tunnel number corresponds to one virtual network. Packets between virtual machines in a VPC have a same tunnel identifier and are sent to a physical network for transmission. Tunnel identifiers of virtual machines in the different VPCs are different, and the virtual machines are located on two different routing planes. Therefore, the virtual machines in the different VPCs cannot communicate with each other, naturally implementing logical isolation.

The tunnel identifier may be, for example, a virtual local area network identifier (Virtual Local Area Network Identification, VLAN ID) or a virtual network identifier (Virtual Network ID, VNI).

First, <FIG> is a schematic diagram of a system structure of a VPC communications system. As shown in <FIG>, the VPC communications system includes a cloud data center <NUM>, a client <NUM>, and an on-premises data center <NUM>. The cloud data center <NUM>, the client <NUM>, and the on-premises data center <NUM> all access the internet <NUM>, and the client <NUM> accesses the cloud data center <NUM> over the internet <NUM>.

As shown in <FIG>, the cloud data center <NUM> provides a VPC <NUM> for a public cloud user. The VPC <NUM> includes a subnet <NUM> and a subnet <NUM>. The subnet <NUM> and the subnet <NUM> are connected to a router <NUM>. The subnet <NUM> includes a virtual machine (virtual machine, VM) <NUM>, a VM <NUM>, and a switch <NUM>. The subnet <NUM> includes a VM <NUM>, a VM <NUM>, and a switch <NUM>. The VM <NUM> and the VM <NUM> are connected to the switch <NUM>, and the VM <NUM> and the VM <NUM> are connected to the switch <NUM>.

The router <NUM> is configured to forward a packet for communication between the subnet <NUM> and the subnet <NUM>.

The on-premises data center <NUM> includes a subnet <NUM> and a remote connection gateway <NUM>. The subnet <NUM> includes a switch <NUM>, a physical machine (Physical machine, PM) <NUM>, and a PM <NUM>. The PM <NUM> and the PM <NUM> are connected to the switch <NUM>, and the switch <NUM> is connected to the remote connection gateway <NUM>.

As shown in <FIG>, the subnet <NUM> and the subnet <NUM> have a same private network address segment. Therefore, private network addresses of the subnet <NUM> and the subnet <NUM> overlap.

The client <NUM> accesses a control platform <NUM> over the internet <NUM>, to enter configuration information into the control platform <NUM>. The control platform <NUM> configures the VPC <NUM> in the cloud data center <NUM> based on the configuration information. Specifically, the control platform <NUM> may configure each function module in the VPC <NUM>, for example, may create or delete the VPC <NUM>, create or delete a virtual machine in the VPC <NUM>, or configure a routing rule of a router in the VPC <NUM>. The control platform <NUM> may manage the VPC based on the configuration information entered by the user.

After the control platform <NUM> configures the VPC <NUM>, the client <NUM> may log in to a VM <NUM>-<NUM> in the VPC <NUM> through a remote desktop.

The client <NUM> is, for example, a terminal device having a network access function, such as a mobile phone, a personal computer, or a personal digital assistant. The public cloud user operates the client <NUM> to access the VM <NUM>-<NUM> provided by the cloud data center <NUM>.

The on-premises data center <NUM> belongs to the public cloud user, and the cloud data center <NUM> belongs to a public cloud service provider. The public cloud user obtains control and management permissions of the VPC <NUM> in the cloud data center <NUM> by paying the public cloud service provider. In some service requirements, the public cloud user needs to connect the subnet <NUM> to the subnet <NUM>. Therefore, a remote connection gateway <NUM> needs to be configured in the VPC <NUM> to connect to a remote connection gateway <NUM> of the on-premises data center <NUM>. For details, refer to <FIG>.

<FIG> is a schematic diagram of another system structure of a VPC communications system. Compared with <FIG>, the remote connection gateway <NUM> is additionally configured in <FIG>, a remote communication tunnel is established between the remote connection gateway <NUM> and the remote connection gateway <NUM>, and an IP packet may be transmitted between the VPC <NUM> and the subnet <NUM> through the remote communication tunnel.

When the VM <NUM> needs to communicate with the PM <NUM>, assuming that the subnet <NUM> and the subnet <NUM> have different private network address segments, the VM <NUM> in the subnet <NUM> may construct an IP packet. A source IP address of the IP packet is a private network address of the VM <NUM> in the subnet <NUM>, a destination IP address of the IP packet is a private network address of the PM <NUM> in the subnet <NUM>, and the IP packet reaches the PM <NUM> through the switch <NUM>, the router <NUM>, the remote connection gateway <NUM>, the remote connection gateway <NUM>, and the switch <NUM>.

However, in the network environment shown in <FIG>, the subnet <NUM> and the subnet <NUM> have a same private network address segment. Therefore, a source IP address of an IP packet constructed by the VM <NUM> is the private network address <NUM>. <NUM> of the VM <NUM> in the subnet <NUM>, and a destination IP address of the IP packet is the private network address <NUM>. <NUM> of the PM <NUM> in the subnet <NUM>. The source IP address and the destination IP address of the IP packet are the same. The IP packet is intercepted by an operating system of the VM <NUM>, or is returned to the VM <NUM> by the switch <NUM>.

Similarly, a source IP address and a destination IP address of an IP packet sent by the PM <NUM> to the VM <NUM> are also the same, which also causes a same technical problem.

To resolve the foregoing technical problem, an embodiment of the present invention provides a method for configuring communication between a VPC and an on-premises data center. The method is configured based on the VPC system shown in <FIG>. For details, refer to <FIG> is a flowchart of a method for configuring communication between a VPC and an on-premises data center according to an embodiment of the present invention. The method specifically includes the following steps.

Step S101: Create a VPC <NUM> in the cloud data center <NUM>.

Step S102: Create a network address translation (Network address translation, NAT) gateway <NUM> in the VPC <NUM>, and set a connection between the NAT gateway <NUM> and the VPC <NUM>.

A private network address <NUM>. <NUM> in a private network address segment of the VPC <NUM> is set in the NAT gateway <NUM>.

It should be noted that a private network address in a private network address segment of the VPC <NUM> is also set in the NAT gateway <NUM>. Unless otherwise specified in this embodiment of the present invention, the mentioned private network address in the NAT gateway <NUM> is the private network address <NUM>. <NUM> in the VPC <NUM> in the NAT gateway <NUM>.

Step S103: Create and configure a remote connection gateway <NUM> in the VPC <NUM>, and set a remote connection between the remote connection gateway <NUM> and the remote connection gateway <NUM>.

A private network address <NUM>. <NUM> in the private network address segment of the VPC <NUM> is set in the remote connection gateway <NUM>.

The remote connection gateway is, for example, a direct connect gateway or a virtual private network (Virtual private network, VPN) gateway.

Step S104: Configure a packet processing rule on the NAT gateway <NUM>.

For an outbound packet whose source IP address is <NUM>. <NUM> and destination IP address is <NUM>. <NUM>, modify the source IP address into <NUM>. <NUM>, modify the destination IP address into <NUM>. <NUM>, and send a modified outbound packet to a router <NUM>.

For an inbound packet whose source IP address is <NUM>. <NUM> and destination IP address is <NUM>. <NUM>, modify the source IP address into <NUM>. <NUM>, modify the destination IP address into <NUM>. <NUM>, and send a modified inbound packet to the router <NUM>.

The outbound packet is a packet received by the NAT gateway <NUM> from the router <NUM>, and the inbound packet is a packet received by the NAT gateway <NUM> from a router <NUM>.

Step S105: Configure a routing rule on the VPC <NUM>.

Routing rule <NUM>: Forward a packet whose destination IP address belongs to <NUM>. <NUM>/<NUM> to the NAT gateway <NUM>.

Routing rule <NUM>: Forward a packet whose destination IP address belongs to <NUM>. <NUM>/<NUM> to the subnet <NUM>.

The routing rule is applied to the router <NUM> of the VPC <NUM>.

Step S106: Configure a routing rule on the VPC <NUM>.

Routing rule <NUM>: Forward a packet whose destination IP address is <NUM>. <NUM> to the NAT gateway <NUM>.

Routing rule <NUM>: Forward a packet whose destination IP address is <NUM>. <NUM> to the remote connection gateway <NUM>.

The foregoing configuration method is performed by the control platform <NUM>. <FIG> is a schematic diagram of a structure of a VPC communications system after the VPC shown in <FIG> is configured by using the configuration method shown in <FIG>. As shown in <FIG>, through the foregoing configuration, the subnet <NUM> is bound with the NAT gateway <NUM>, the subnet <NUM> is bound with the remote connection gateway <NUM>, and bridging is implemented between the subnet <NUM> and the subnet <NUM> by using the VPC <NUM>. The VM <NUM> can access the PM <NUM> by constructing an IP packet whose destination IP address is a private network address of the remote connection gateway <NUM>, and the PM <NUM> can access the VM <NUM> by constructing an IP packet whose destination IP address is a private address of the NAT gateway <NUM>.

<FIG> and <FIG> are a data interaction diagram of a method for communication between a VPC and an on-premises data center based on the VPC communications system shown in <FIG> according to an embodiment of the present invention. The communication method is used to disclose a process of communication between a VM <NUM> and a PM <NUM>. As shown in <FIG> and <FIG>, the method includes the following steps.

Step <NUM>: The VM <NUM> constructs an IP packet <NUM> and sends the IP packet <NUM> to a switch <NUM>.

A source IP address of an IP header of the IP packet <NUM> is a private network address <NUM>. <NUM> of the VM <NUM> in a subnet <NUM>, a destination IP address of the IP header of the IP packet <NUM> is a private network address <NUM>. <NUM> of a remote connection gateway <NUM>, and a data part of the IP packet <NUM> carries request information.

It should be noted that, based on a service requirement, the VM <NUM> may query and obtain a correspondence between <NUM>. <NUM> and the PM <NUM> in advance, for example, may query the correspondence between <NUM>. <NUM> and the PM <NUM> from a second VPC, or may query the correspondence between <NUM>. <NUM> and the PM <NUM> from a control platform <NUM>.

Step <NUM>: The switch <NUM> forwards the IP packet <NUM> to a router <NUM>.

After receiving the IP packet <NUM>, the switch <NUM> determines that the destination IP address of the IP packet <NUM> does not belong to the subnet <NUM>, and sends the IP packet <NUM> to the router <NUM> to perform packet transmission across network segments.

Step <NUM>: The router <NUM> forwards the IP packet <NUM> according to a routing rule <NUM>.

After receiving the IP packet <NUM>, the router <NUM> matches the routing rule <NUM> based on the destination IP address (<NUM>. <NUM>) of the IP packet <NUM>, and sends the IP packet <NUM> to a NAT gateway <NUM> according to the routing rule <NUM>.

Step <NUM>: The NAT gateway <NUM> modifies the source IP address of the IP packet <NUM> according to a packet processing rule <NUM>, and sends a modified IP packet <NUM> to a router <NUM>.

After the NAT gateway <NUM> receives the IP packet <NUM> from the router <NUM>, because the IP packet <NUM> is from the router <NUM>, the NAT gateway <NUM> determines that the IP packet <NUM> is an outbound packet, matches the packet processing rule <NUM>, modifies the source IP address of the IP packet <NUM> from <NUM>. <NUM> into <NUM>. <NUM>, modifies the destination IP address of the IP packet <NUM> from <NUM>. <NUM> into <NUM>. <NUM>, and sends a modified IP packet <NUM> to the router <NUM>.

Step <NUM>: The router <NUM> forwards the IP packet <NUM> to a remote connection gateway <NUM> according to a routing rule <NUM>.

After receiving the IP packet <NUM>, the router <NUM> matches the routing rule <NUM> based on the destination IP address (<NUM>. <NUM>) of the IP packet <NUM>, and forwards the IP packet <NUM> to the remote connection gateway <NUM>.

Step <NUM>: The remote connection gateway <NUM> sends the IP packet <NUM> to the remote connection gateway <NUM> through a remote communication tunnel.

Step <NUM>: The remote connection gateway <NUM> forwards the IP packet <NUM> to a switch <NUM>.

Step <NUM>: The switch <NUM> sends the IP packet <NUM> to the PM <NUM>.

The switch <NUM> sends the IP packet <NUM> to the PM <NUM> based on the destination IP address <NUM>. <NUM> of the IP packet <NUM>.

Step <NUM>: The PM <NUM> constructs and sends an IP packet <NUM> to the switch <NUM>.

The IP packet <NUM> is a reply packet of the IP packet <NUM>.

After receiving the IP packet <NUM>, the PM <NUM> obtains the request information from the data part of the IP packet <NUM>, generates response information based on the request information, and constructs the IP packet <NUM>. Specifically, the PM <NUM> sets the source IP address <NUM>. <NUM> of the IP packet <NUM> to a destination IP address of the IP packet <NUM>, sets the destination IP address <NUM>. <NUM> of the IP packet <NUM> to a source IP address of the IP packet <NUM>, adds the response information to a data part of the IP packet <NUM>, and sends the IP packet <NUM> to the switch <NUM>.

Step <NUM>: The switch <NUM> forwards the IP packet <NUM> to the remote connection gateway <NUM>.

After receiving the IP packet <NUM>, the switch <NUM> determines that the destination IP address <NUM>. <NUM> of the IP packet <NUM> does not belong to a subnet <NUM> (<NUM>. <NUM>/<NUM>), and sends the IP packet <NUM> to the remote connection gateway <NUM> to perform remote packet transmission.

Step <NUM>: The remote connection gateway <NUM> sends the IP packet <NUM> to the remote connection gateway <NUM> through the remote communication tunnel.

Step <NUM>: The remote connection gateway <NUM> sends the IP packet <NUM> to the router <NUM>.

Step <NUM>: The router <NUM> forwards the IP packet <NUM> to the NAT gateway <NUM> according to a routing rule <NUM>.

After receiving the IP packet <NUM>, the router <NUM> matches the routing rule <NUM> based on the destination IP address (<NUM>. <NUM>) of the IP packet <NUM>, and forwards the IP packet <NUM> to the NAT gateway <NUM>.

Step <NUM>: The NAT gateway <NUM> modifies the IP packet <NUM> according to a packet processing rule <NUM>, and sends a modified IP packet <NUM> to the router <NUM>.

After the NAT gateway <NUM> receives the IP packet <NUM> from the router <NUM>, because the IP packet <NUM> is from the router <NUM>, the NAT gateway <NUM> determines that the IP packet <NUM> is an inbound packet, matches the packet processing rule <NUM>, modifies the destination IP address of the IP packet <NUM> from <NUM>. <NUM> into <NUM>. <NUM>, modifies the source IP address of the IP packet <NUM> from <NUM>. <NUM> into <NUM>. <NUM>, and sends a modified IP packet <NUM> to the router <NUM>.

Step <NUM>: The router <NUM> forwards the modified IP packet <NUM> to the switch <NUM> according to a routing rule <NUM>.

The router <NUM> matches the routing rule <NUM> based on the destination IP address <NUM>. <NUM> of the IP packet <NUM>, and sends the IP packet <NUM> to the subnet <NUM>. Specifically, the router <NUM> sends the IP packet <NUM> to the switch <NUM> of the subnet <NUM>.

Step <NUM>: The switch <NUM> sends the IP packet <NUM> to the VM <NUM>.

The switch <NUM> sends the IP packet <NUM> to the VM <NUM> based on the destination IP address <NUM>. <NUM> of the IP packet <NUM>.

After receiving the IP packet <NUM>, the VM <NUM> determines that the IP packet <NUM> is the reply packet of the IP packet <NUM> based on the source IP address <NUM>. <NUM> and the destination IP address <NUM>. <NUM> of the IP packet <NUM> (because the source IP address and the destination IP address of the IP packet <NUM> are inverted compared with those of the IP packet <NUM>). The VM <NUM> obtains the reply information from the data part of the IP packet <NUM> to complete a communication process between the VM <NUM> and the VM <NUM>.

In conclusion, the NAT gateway <NUM> and the VPC <NUM> are configured in the cloud data center <NUM>, and regulation configuration is performed, so that the cloud VM <NUM> and the on-premises PM <NUM> can communicate with each other when private network addresses of the VM <NUM> and the PM <NUM> are the same.

For example, this embodiment of the present invention is applicable to the following scenario. To be specific, the VPC <NUM> is used as a large internal network of an enterprise, and the VPC <NUM> is used as a small internal network of the enterprise. For example, the VPC <NUM> is a virtual network of a financial department, the subnet <NUM> is an on-premises network of a research and development department, and the VPC <NUM> is a virtual network of an IT management department of the enterprise. When private network addresses of the VPC <NUM> and the subnet <NUM> overlap, a private network address of the VPC <NUM> may be applied for from the control platform. For example, the VPC <NUM> applies for a private network address <NUM> of the VPC <NUM>, and the subnet <NUM> applies for a private network address <NUM> of the VPC <NUM>. The control platform sets a packet processing rule on the NAT gateway <NUM>, to bind a virtual machine in the VPC <NUM> with the private network address <NUM>, and bind a physical machine in the subnet <NUM> with the private network address <NUM>. The virtual machine in the VPC <NUM> may access the physical machine in the subnet <NUM> by accessing the private network address <NUM>, and the physical machine in the subnet <NUM> may access the virtual machine in the VPC <NUM> by accessing the private network address <NUM>. In this way, a technical problem that communication cannot be performed because a cloud private network address and an on-premises private network address inside the enterprise overlap is resolved.

It should be noted that, in this embodiment of the present invention, a virtual machine may also be disposed in the on-premises data center, that is, a PM may be replaced with a VM. This is not limited in this embodiment of the present invention.

In addition, in another embodiment of the present invention, packet processing rules <NUM> and <NUM> may be further set on the NAT gateway <NUM> to replace the packet processing rules <NUM> and <NUM>.

In this embodiment, it is assumed that the PM <NUM> trusts only an IP packet whose source IP address is <NUM>. <NUM>, and when receiving an IP packet whose source IP address is not <NUM>. <NUM>, discards the IP packet. In this case, the packet processing rules <NUM> and <NUM> are configured on the NAT gateway <NUM>, so that a source IP address of an IP packet received by the PM <NUM> is <NUM>. This ensures that the PM <NUM> does not discard the IP packet but responds to the IP packet.

This embodiment is applicable to a case in which an important database is set on the PM <NUM>. For example, the PM <NUM> is a database of a bank, and the VPC needs to perform source address translation by using the NAT gateway <NUM>, to modify a source address of an IP packet sent by the virtual machine in the VPC <NUM> into a trusted address of the PM <NUM>, so as to ensure that the PM <NUM> normally processes the IP packet.

Further, <FIG> is a schematic diagram of a structure of a configuration apparatus according to an embodiment of the present invention. As shown in <FIG>, the configuration apparatus <NUM> includes an address binding module <NUM>, a gateway configuration module <NUM>, an address configuration module <NUM>, and a routing rule configuration module <NUM>. The gateway configuration module <NUM> is configured to execute the action of creating a NAT gateway and a remote connection gateway in the configuration method disclosed in the foregoing embodiments. The address configuration module <NUM> is configured to execute the action of configuring private network addresses for the NAT gateway and the remote connection gateway in the configuration method disclosed in the foregoing embodiments. The address binding module <NUM> is configured to execute the action of configuring a packet processing rule for the NAT gateway in the configuration method disclosed in the foregoing embodiments. The routing rule configuration module <NUM> is configured to execute the action of configuring a routing rule for a router in the configuration method disclosed in the foregoing embodiments.

The configuration apparatus <NUM> may be disposed in the control platform <NUM> disclosed in the foregoing embodiments.

<FIG> is a schematic diagram of a structure of a computing device according to an embodiment of the present invention. As shown in <FIG>, the computing device may include a processing unit <NUM> and a communications interface <NUM>. The processing unit <NUM> is configured to implement functions defined by an operating system running on a physical server and various software programs, for example, to implement a function of the control platform <NUM> shown in <FIG>. The communications interface <NUM> is configured to communicate and interact with another computing node. Another device may be another physical server. Specifically, the communications interface <NUM> may be a network adapter. Optionally, the physical server may further include an input/output interface <NUM>. The input/output interface <NUM> is connected to an input/output device, to receive input information and output an operation result. The input/output interface <NUM> may be a mouse, a keyboard, a display, an optical disk driver, or the like. Optionally, the physical server may further include a secondary memory <NUM>. The secondary memory <NUM> is generally referred to as an external memory. A storage medium of the secondary memory <NUM> may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, an optical disc), a semiconductor medium (for example, a solid-state drive), or the like. The processing unit <NUM> may have a plurality of specific implementation forms. For example, the processing unit <NUM> may include a processor <NUM> and a memory <NUM>. The processor <NUM> performs related operations of the control platform <NUM> in the foregoing embodiments based on program instructions stored in the memory <NUM>. The processor <NUM> may be a central processing unit (CPU) or a graphics processing unit (English: graphics processing unit, GPU). The processor <NUM> may be a single-core processor or a multi-core processor. The processing unit <NUM> may alternatively be independently implemented by using a logic device with built-in processing logic, for example, a field programmable gate array (English full name: Field Programmable Gate Array, FPGA for short) or a digital signal processor (English: digital signal processor, DSP).

A person skilled in the art may clearly understand that, for the purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to a corresponding process in the foregoing method embodiments. The descriptions of procedures corresponding to the foregoing accompanying drawings have respective focuses. For a part that is not described in detail in a procedure, refer to related descriptions of another procedure.

Further, in another embodiment of the present invention, a container may alternatively be used to replace a virtual machine. This is not limited in this embodiment of the present invention.

It should be noted that any apparatus embodiment described above is merely an example. The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, that is, may be located in one position, or may be distributed on a plurality of network units. Some or all of the processes may be selected based on actual requirements to achieve the objectives of the solutions of embodiments. In addition, in the accompanying drawings of the apparatus embodiments provided in the present invention, connection relationships between processes indicate that the processes have communication connections with each other, which may be specifically implemented as one or more communications buses or signal cables. A person of ordinary skill in the art may understand and implement embodiments of the present invention without creative efforts.

Based on the descriptions of the foregoing implementations, a person skilled in the art may clearly understand that the present invention may be implemented by software in addition to necessary universal hardware, or by dedicated hardware, including a dedicated integrated circuit, a dedicated CPU, a dedicated memory, a dedicated component, and the like. Generally, any function that can be implemented by a computer program can be easily implemented by corresponding hardware. Moreover, a specific hardware structure used to implement a same function may be in various forms, for example, in a form of an analog circuit, a digital circuit, or a dedicated circuit. However, for the present invention, software program implementation is a better implementation in most cases. Based on such an understanding, technical solutions of the present invention essentially or the part contributing to the conventional technology may be implemented in a form of a software product. The computer software product is stored in a readable storage medium, such as a floppy disk of a computer, a USB flash drive, a removable hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk, or an optical disc, and includes several instructions for instructing a computer device (which may be a personal computer, a host, a network device, or the like) to perform the methods described in embodiments of the present invention.

Claim 1:
A method for configuring communication between a virtual private cloud VPC and an on-premises data center (<NUM>), wherein a first virtual private cloud VPC and a subnet (<NUM>) of the on-premises data center that have a same private network address segment communicate with each other by using a second VPC, wherein the second VPC is used as a large internal network of an enterprise, and wherein the first VPC is used as a small internal network of the enterprise, and a private network address segment of the second VPC is different from private network address segments of the first VPC and the subnet; and the method comprises:
configuring (S102) a network address translation NAT gateway (<NUM>) on the first VPC to form a connection between the NAT gateway and the second VPC, and configuring (S103) a remote connection gateway on the second VPC to form a remote connection between the remote connection gateway and the subnet of the on-premises data center, wherein a first address is configured for the NAT gateway, a second address is configured for the remote connection gateway, the first address and the second address belong to the private network address segment of the second VPC, and the first address is different from the second address; and
configuring (S105, S106) a first packet processing rule and a second packet processing rule on the NAT gateway, wherein the first packet processing rule comprises: translating a source address of an outbound packet from a private network address in the first VPC into the first address, translating a destination address of the outbound packet from the second address into a private network address in the subnet, and sending a modified outbound packet to a router of the second VPC; and the second packet processing rule comprises: modifying a source address of an inbound packet from the private network address in the subnet into the second address, translating a destination address of the inbound packet from the first address into the private network address in the first VPC, and sending a modified inbound packet to a router of the first VPC.