Alibaba Cloud Top-up Service Alibaba Cloud VPC Peering Setup Guide: Account Purchase, KYC, Costs, Limits, and Cross-VPC Connection Steps

What users are usually trying to solve when they search for this topic

Most users searching for Alibaba Cloud VPC peering are not looking for a theory article. They are usually at one of these decision points: they need to connect an application VPC to a database VPC, isolate production from testing while still allowing access, connect VPCs owned by different accounts, or determine whether they can even proceed because the account has not passed verification, lacks balance, or is blocked by compliance review.

The practical questions are usually more urgent than the network configuration itself:

• Can I create a VPC peering connection with a newly registered Alibaba Cloud account?
• Do I need enterprise verification, or is individual verification enough?
• Which payment method supports immediate provisioning?
• Will risk control freeze my order or delay network resource activation?
• Is VPC peering billed separately, and how do I compare its cost with other connection methods?
• Why does the peering connection show as created, but ECS instances still cannot communicate?

This guide is written around those operational questions. The goal is to help you decide, purchase, configure, and troubleshoot without wasting time on avoidable blockers.

Preparation before you buy or configure anything

Account and permission checklist

Required resources

• Two VPCs already created, or a plan to create them.
• At least one ECS instance in each VPC for connectivity testing.
• Administrative access to route tables and security groups.
• Clear CIDR blocks, such as 10.10.0.0/16 and 10.20.0.0/16, without overlap.
• A decision on whether the two VPCs belong to the same account or different Alibaba Cloud accounts.

Operational prerequisites users often miss

Before opening the console, confirm three things:

• The target ECS instance actually uses the expected private IP. Users often configure the route correctly but test against an old IP after re-provisioning.
• The operating system firewall allows the traffic. On Linux, firewalld or iptables may block ICMP, SSH, or application ports even when the Alibaba Cloud security group is open.
• The application is bound to the private interface. If a service only listens on 127.0.0.1, VPC peering will not help.

Before deployment: account purchase, KYC, payment, funding, and renewals

1. Which Alibaba Cloud account type should you use?

If this VPC peering connection is for production workloads, use an enterprise-verified account whenever possible. Individual accounts can be used for testing and some production scenarios, but enterprise accounts usually face fewer issues when applying for higher quotas, handling invoices, passing internal audit, and assigning network permissions across teams.

If you expect cross-account peering between subsidiaries, clients, or business units, avoid creating resources under a personal account and migrating later. That causes avoidable routing changes, permission rework, and compliance review delays.

2. Identity verification and KYC issues that delay VPC deployment

Users often discover too late that registration alone does not mean full operational readiness. If your account is newly created, complete identity verification before planning a change window.

If a verification review is pending, do not schedule same-day production cutovers. Manual review or additional document requests can delay procurement.

3. Payment methods and funding choices

When users ask about VPC peering cost, the hidden issue is often whether they can provision dependent resources immediately. Common blockers include failed card verification, insufficient balance for pay-as-you-go resources, or an expired card during renewal.

For operational reliability:

• Use a payment method accepted in your billing region and test it with a small order before a maintenance window.
• If you rely on pay-as-you-go, keep sufficient balance to avoid unexpected service impact on related resources.
• If your finance team requires predictable spending, compare subscription and pay-as-you-go for the ECS, NAT, EIP, bandwidth, and database resources attached to the VPCs, not just the peering object itself.

4. Renewals and expiration planning

VPC connectivity issues are sometimes traced back to expired dependent resources, not the peering configuration. Examples include expired ECS instances, released EIPs, disabled VPN components, or deleted test servers previously used as jump hosts.

Set renewal reminders for:

• ECS instances in both VPCs
• Elastic IP addresses used for administration
• SSL certificates if your application will be accessed over HTTPS after the VPC connection
• Databases or Redis instances reachable through the peered network

If a business-critical route depends on a subscription ECS or database, enable auto-renewal where permitted by policy.

5. Risk control and compliance reviews users should expect

Alibaba Cloud may apply risk control checks to new accounts, unusual spending patterns, mismatched payment details, or sensitive traffic patterns. In practice, users encounter this as resource purchase failure, order review delay, or temporary restrictions.

Typical triggers include:

• New account purchasing multiple resources across regions immediately after registration
• Payment method country not matching account profile or verification details
• Cross-border deployment with incomplete business information
• Frequent creation and release of network resources in a short period

To reduce delays, keep account information consistent, verify identity before procurement, and avoid last-minute bulk purchases during a migration weekend.

Step-by-step: how to create Alibaba Cloud VPC peering and make traffic flow correctly

Step 1: Create or verify the two VPCs

In the Alibaba Cloud console, go to the VPC section and verify that both VPCs already exist. If not, create them first.

Where to click:

• Console
• VPC
• Virtual Private Cloud
• Create VPC

How to configure:

Important considerations:

• If the VPCs have overlapping CIDR blocks, stop here and redesign. Route entries cannot fix overlapping private address space cleanly.
• If you plan database access only, keep the database in a separate VPC with narrower security group rules.

Step 2: Confirm account ownership and permissions

Alibaba Cloud Top-up Service If the VPCs belong to different Alibaba Cloud accounts, confirm who will initiate the peering request and who will approve it.

Where to click:

• Console
• RAM
• Users or Roles

How to configure:

• Grant permissions for VPC management, route table modification, and ECS security management.
• If using a RAM sub-account, test whether it can view and edit route tables before the maintenance window.

Important considerations:

• Users often can create the peering object but cannot complete route configuration due to insufficient privileges.
• Cross-account approval delays are common when the owner of the target VPC is in a different team or country.

Step 3: Create the VPC peering connection

In the VPC console, open the peering connection area and start a new connection.

Where to click:

• Console
• VPC
• Peering Connection
• Alibaba Cloud Top-up Service Create Peering Connection

How to enter parameters:

Important considerations:

• Alibaba Cloud Top-up Service If the peer VPC is under a different account, the target side may need to accept the request.
• Creation of the peering connection alone does not enable traffic. Route configuration is mandatory.

Step 4: Add route entries on both sides

This is the step where users fail most often. A peering connection without reciprocal routes results in one-way or zero connectivity.

Alibaba Cloud Top-up Service Where to click:

• Console
• VPC
• Route Tables
• Select the route table associated with the vSwitch used by your ECS instances
• Add Route Entry

How to configure:

Important considerations:

• Check that the route table you edit is actually associated with the ECS subnet in use.
• If there are multiple route tables, users often edit the default route table while the ECS instance uses a custom route table.
• Confirm that no more specific route overrides the desired path.

Step 5: Open security groups and operating system firewalls

Even with correct peering and route entries, traffic can still fail due to security controls.

Where to click:

• Console
• ECS
• Security Groups
• Inbound Rules

How to configure:

Linux firewall examples:

Windows verification examples:

• Alibaba Cloud Top-up Service Open Windows Defender Firewall with Advanced Security.
• Check inbound rules for RDP, database client, or custom application ports.
• Confirm the service is listening on the private interface, not localhost only.

Step 6: Test connectivity from ECS instances

After routes and security rules are in place, test from source to destination.

If the TCP test works but ping fails, ICMP may simply be blocked. Do not assume the network path is broken.

What usually causes deployment failure after purchase or configuration

1. Account restriction or pending review

Symptom: You cannot purchase dependent resources, create network objects, or complete a cross-account request.

Practical fix:

• Check account messages and order center for pending review notices.
• Alibaba Cloud Top-up Service Complete any missing KYC or document request.
• If finance used a different payer profile, confirm the billing identity matches the account’s verification details.

2. Overlapping CIDR blocks

Alibaba Cloud Top-up Service Symptom: Peering can be created in the console, but routing design becomes invalid or traffic never reaches the intended destination.

Practical fix:

• Redesign one VPC CIDR before production deployment.
• For migrations, create a new VPC with non-overlapping CIDR and move workloads gradually.

Alibaba Cloud Top-up Service 3. Route table attached to the wrong subnet

Symptom: Some ECS instances in the VPC can communicate, others cannot.

Practical fix:

• Check the route table association for each vSwitch.
• Add the route to every relevant route table, not just the default one.

4. Security group rule too narrow or missing return path

Symptom: Connection times out, especially for MySQL, Redis, or RDP.

Practical fix:

• Allow the source VPC CIDR or the exact application subnet.
• Verify outbound restrictions if a custom egress policy is used.

5. Local firewall or service binding issue

Symptom: Ping works, but the application port fails.

Practical fix:

• Check whether the service listens on 0.0.0.0 or the target private IP.
• Open the port in firewalld, iptables, or Windows Firewall.

Configuration recommendations by scenario

For individual developers

Use pay-as-you-go for test ECS instances and keep the design simple: one application VPC and one database or utility VPC. Use small instances, a narrow CIDR plan, and strict security group rules. Avoid creating cross-region links unless you are specifically testing latency behavior, because related bandwidth and architecture choices can increase cost and troubleshooting complexity.

For enterprise users

Use enterprise-verified accounts, separate production and non-production VPCs, and create naming standards for peering connections and route tables. Give RAM roles only the permissions needed for network operations. Document every route addition as part of the change ticket. Before the cutover, perform TCP-based verification for application ports, not just ping tests.

For cross-border businesses

Choose regions based on both latency and compliance requirements. Run latency tests between your user base, the application VPC, and the data VPC before finalizing architecture. Keep account identity, billing country, and business documents consistent to reduce risk-control delays. If your website requires DNS, SSL certificates, and HTTPS deployment after the VPC connection, prepare those items in parallel so network completion does not become the only remaining blocker.

For website applications

Keep frontend workloads and backend databases in different VPCs when access control needs to be stricter. Open only required ports between the VPCs. For Linux-based web servers, verify SSH over private IP, firewall rules for 80/443, and DNS resolution if private domain records are used internally. For Windows application servers, validate RDP from the management subnet and test application service ports over private IP after peering is enabled.

For database workloads

When connecting MySQL or Redis across VPCs, focus on security and timeout behavior. Allow only the application subnet CIDR, not the full VPC if possible. Check database bind address, parameter group restrictions, and connection limits. If high concurrency is expected, test latency and connection pool settings after peering is live. Network connectivity alone does not guarantee stable database performance.

Cost comparison and billing planning

Users often ask for VPC peering cost, but the real spending usually comes from the attached compute, storage, bandwidth, and operational design. Plan total cost, not just the peering object.

Budgeting tips:

• For testing, use small ECS sizes and pay-as-you-go.
• For stable long-term production, compare subscription discounts with expected uptime.
• Enable budget alerts so a sudden traffic increase does not become a finance incident first and a network incident later.

Validation and troubleshooting checklist after go-live

Network verification sequence

1. Verify the peering connection status is active or accepted.
2. Check route entries on both VPCs.
3. Alibaba Cloud Top-up Service Confirm route table association with the correct vSwitch.
4. Test private IP connectivity between ECS instances.
5. Check security group inbound and outbound rules.
6. Check OS firewall rules.
7. Check the target service binding and port listening state.

MySQL connection problems over peering

If your application still cannot connect to MySQL after VPC peering:

• Confirm port 3306 is open in the ECS security group or database whitelist.
• Check mysqld is listening on the private IP or 0.0.0.0, not only 127.0.0.1.
• Verify user privileges, for example whether the user is allowed from the source private subnet.
• Test with nc -zv target-ip 3306 before troubleshooting credentials.

Redis connection problems over peering

For Redis, a common issue is that the port is reachable but authentication or bind settings block access. Test network reachability first, then check the Redis bind address, protected mode, password, and source ACL or whitelist policy.

Optimization recommendations

Security optimization

• Restrict security group rules to specific subnets instead of the entire peer VPC whenever possible.
• Use separate VPCs for production, testing, and database tiers.
• Alibaba Cloud Top-up Service Review RAM permissions so route modifications require the correct approval process.
• For public-facing websites, combine private inter-VPC traffic with proper DNS, SSL certificate configuration, and HTTPS deployment on the application side.

Performance optimization

• Select regions based on measured latency, not assumptions.
• Run TCP and application-level tests after deployment, especially for database workloads.
• Monitor CPU, memory, disk I/O, and network usage on the connected ECS instances to verify that the problem is not server-side saturation.

Cost optimization

• Use pay-as-you-go for temporary migration or testing environments.
• Move stable production compute to subscription if utilization is predictable.
• Delete unused test peering connections, idle ECS instances, and forgotten EIPs after validation completes.

Stability optimization

• Document every VPC CIDR, route table, and security group rule.
• Take snapshots or backups before major migration work if application or database changes are involved.
• Prepare a rollback plan: route removal, security rule restoration, and service-level connection tests.

Final operational advice before you implement

Alibaba Cloud Top-up Service If your main concern is whether you can complete Alibaba Cloud VPC peering without purchase or account surprises, the answer depends less on the peering feature itself and more on readiness around it: verified account status, payment setup, route planning, CIDR design, and permissions. In real deployments, the most common blockers are not the console steps. They are pending KYC, cross-account approval delays, wrong route table edits, and security rules that were never opened.

Alibaba Cloud Top-up Service Handle those prerequisites first, then create the peering connection, add reciprocal routes, test over private IP, and verify application ports one by one. That sequence avoids most failed cutovers.