Cloud Connect
Cloud Connect
Please review the following to ensure your Cloud Connect services are configured appropriately. A Cloud Connect service is a point-to-point Layer 2 connection between your Service Port and a cloud provider's port on our network, delivered in the same way as a Virtual Leased Line.
To order or manage a Cloud Connect service, see Cloud Connect.
Port Configuration
For your reference, our Cloud Connect ports are configured as follows:
| Setting | Configuration |
|---|---|
| MAC layer | IEEE 802.3-2002 |
| UNI MTU | 9100 bytes |
| VLAN EtherType | 0x8100 |
| CoS level | Standard |
| Unicast frame delivery | Deliver unconditionally |
| Multicast frame delivery | Deliver unconditionally |
| Broadcast frame delivery | Deliver unconditionally |
The cloud provider may support a smaller MTU than our ports. Please check your cloud provider's documentation for the MTU supported on your connection.
Layer 2 Control Tunnelling
Our Cloud Connect ports are configured to discard or tunnel frames with the following protocols:
| Protocol | Action |
|---|---|
| STP, RSTP, MSTP | Tunnel |
| Pause | Discard |
| LACP | Discard |
| Link OAM | Discard |
| 802.1x | Discard |
| E-LMI | Tunnel |
| LLDP | Tunnel |
| GARP | Tunnel |
VLAN Tagging
| Provider | Your end | Cloud provider end |
|---|---|---|
| AWS Direct Connect | Tagged (VLAN 1 - 4094) or untagged. | Allocated by us from the VLANs available on the AWS Port, and assigned to your hosted connection. |
| Azure ExpressRoute | Tagged only (VLAN 1 - 4094), one VLAN per link. | Set by Azure for your ExpressRoute circuit. |
We translate between the VLAN at your end and the VLAN at the cloud provider's end, so the two don't need to match.
- AWS Direct Connect - your service carries a single VLAN tag. The VLAN of your hosted connection is set by us, and is used automatically by any virtual interface you create on it. Configure your router with the VLAN at your end of the service, or untagged.
- Azure ExpressRoute - your service carries two VLAN tags (QinQ), both using EtherType 0x8100:
- Outer tag - the VLAN at your end of each link.
- Inner tag - the VLAN ID you configure for each peering on your ExpressRoute circuit in Azure. Inner tags are passed through unchanged, so configure the same VLAN ID on your router as in Azure. Each peering on your circuit uses its own inner tag.
The VLAN at your end of the service is shown in the Connections section of the service's details page, and the VLANs at both ends are shown when editing the service. Your end's VLAN can be changed; the cloud provider's end can't be changed.
MAC Address
Due to a hardware limitation, we require your router's MAC address to provision a Cloud Connect service where your Service Port is on the same network device as the cloud provider's port. Please use your router's Layer 3 MAC address. Upcoming works in Q1 2027 will remove this requirement.
Capacity
Each cloud provider port has a fixed capacity shared between every Cloud Connect service delivered on it:
- AWS Direct Connect - only speeds that fit within the AWS Port's remaining capacity can be ordered, and a single hosted connection can't use an AWS Port's full capacity. Each AWS Port supports a maximum of 50 hosted connections.
- Azure ExpressRoute - the speed of your service is set by your ExpressRoute circuit's bandwidth in Azure.
Redundancy
Azure ExpressRoute services are always delivered as a primary and secondary link, connecting to separate Azure Ports. Both links must be delivered on Service Ports at the same exchange. We recommend delivering each link on a separate Service Port for redundancy.
Routing
BGP for your Cloud Connect service is configured with your cloud provider:
- AWS Direct Connect - once you have accepted your hosted connection, create a virtual interface on it. See Direct Connect virtual interfaces in the AWS documentation.
- Azure ExpressRoute - once your circuit's provider status is Provisioned, configure peering on your circuit. See Create and modify peering for an ExpressRoute circuit in the Microsoft documentation. Configure BGP on both the primary and secondary links, so your service remains available if one link fails.