Private connection

A private connection is a logical link of your on-prem infrastructure to a virtual network in a cloud. A private connection’s destination in the cloud network is a routing instance.

Here is an example of using two private connections to set up fault-tolerant IP connectivity:

The main components of a private connection are:

• Point-to-point subnet
• BGP connectivity

The cloud network and on-prem infrastructure will then exchange routes via the configured BGP to start sending traffic between on-prem and cloud network resources.

A private connection is set up within a trunk. You can have multiple private connections to different cloud networks in a single trunk.

A private connection is set up inside a trunk and has its own unique VLAN ID.

The maximum IP MTU for a private connection is 8,910 bytes. Yandex Cloud equipment does not support changing the IP MTU.

Point-to-point subnetPoint-to-point subnet

To set up a private connection, you need a point-to-point subnet. It is used to configure IP connectivity between the Yandex Cloud equipment and the customer or telecom provider equipment.

A point-to-point subnet can be either /30 or /31 in size. You cannot use subnets of other sizes.

You can use the following IP address ranges in your point-to-point subnet:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16
• 169.254.0.0/16

IP addressing in other ranges is not allowed.

BGP connectivityBGP connectivity

BGP connectivity is required to exchange routing information, e.g., subnet prefixes, and is configured within each private or public connection between the customer’s and Yandex Cloud point of presence equipment. Once the sides exchange information about their subnets, they can route IPv4 traffic between them.

BGP ASNBGP ASN

To set up BGP connectivity, each side must specify the BGP autonomous system number (ASN) in ASPlain format. The Yandex Cloud BGP ASN is 200350.

You are allowed to use a public BGP ASN (if you have one) on the customer edge equipment. You are allowed to use any value from the following (RFC 6996) private BGP ASN ranges on the customer edge equipment:

• 64512 - 65534: For 2-byte BGP ASNs.
• 4200000000 - 4294967294: For 4-byte BGP ASNs.

You are not allowed to use the following (RFC 5398) BGP ASN ranges on the customer edge equipment:

• 64496 – 64511: For 2-byte BGP ASNs.
• 65536 – 65551: For 4-byte BGP ASNs.

You are not allowed to include any BGP ASN from the above ranges in the BGP AS_Path attribute on the customer edge equipment.

BGP authentication (optional)BGP authentication (optional)

For better BGP connection security, you can use BGP authentication based on BGP MD5 password. We recommend using passwords at least 20 characters long, including letters, numbers, and special characters.

BFD protocolBFD protocol

If you cannot connect your router to the Yandex Cloud equipment directly, you can use intermediate network devices, e.g., switches. The BFD protocol is used to quickly detect faults on the intermediate network devices.

The BFD protocol is always enabled on the Yandex Cloud equipment with the following settings:

• timer: 300ms
• multiplier: 3

These values are fixed and cannot be changed manually.

You can configure the timer setting on your equipment as needed. When establishing a BFD session, these parameters will be aligned between the customer’s and Yandex Cloud equipment.

We do not recommend setting multiplier to anything other than 3, as this may cause BFD performance issues.

BGP timersBGP timers

Below you can see the Yandex Cloud default timer values in seconds:

• minimum-hold-time = 90

Using values less than the specified ones on the customer edge equipment will cause issues with establishing a BGP adjacency.

Private connection topologiesPrivate connection topologies

The following options for setting up private connections are supported:

• Private connection through a direct customer connection.
• Private connection through a telecom provider connection (L2 transit).
• Private connection through a telecom provider connection (L3VPN).

Private connection through a direct customer connectionPrivate connection through a direct customer connection

This scenario implies setting up L3 and BGP connectivity between the customer equipment at the point of presence and the Yandex Cloud equipment. In this case, the following applies:

• You independently provide L3 connectivity between your equipment in your data center and your equipment at the point of presence.
• Your equipment at the point of presence establishes BGP peering with the Yandex Cloud equipment.
• All BGP route announcements from your equipment at the point of presence enter all Yandex Cloud availability zones.

Private connection through a telecom provider connection (L2 transit)Private connection through a telecom provider connection (L2 transit)

This scenario assumes you do not have your own equipment at the point of presence and you use the services of a telecom provider that ensures connectivity between Yandex Cloud and your own equipment. For this operation, the following requirements apply:

• The telecom provider sets up L2 connectivity between its equipment at the point of presence and the Yandex Cloud equipment.
• Your equipment in your data center establishes L3 connectivity and BGP peering with the Yandex Cloud equipment at the point of presence.
• All BGP route announcements from your equipment in your data center enter all Yandex Cloud availability zones.

Private connection through a telecom provider connection (L3VPN)Private connection through a telecom provider connection (L3VPN)

This scenario assumes you do not have your own equipment at the point of presence and you use the services of a telecom provider that ensures connectivity between Yandex Cloud and your own equipment. You cannot technically set up BGP peering with the Yandex Cloud equipment on your own. For this operation, the following requirements apply:

• The telecom provider sets up L2 connectivity between its equipment at the point of presence and the Yandex Cloud equipment.
• The telecom provider equipment establishes L3 connectivity and BGP peering with the Yandex Cloud equipment at the point of presence. This connection integrates into the customer L3VPN, which ensures direct connectivity between your equipment in your data center and Yandex Cloud.
• All BGP route announcements from the telecom provider equipment at the point of presence enter all Yandex Cloud availability zones.
• While providing L3VPN, the telecom provider can use both static and dynamic routing protocols.

Use casesUse cases

• Creating a new partner trunk and a private connection in it
• Creating a direct trunk and a private connection in it
• Adding a private connection to a trunk
• Deleting a private connection