Border Gateway
one BGP edge to every network.
A BGP gateway for your VPC. Over Zenlayer's network fabric it reaches public clouds, your on-prem data centers, internet exchanges, and other fabrics — privately, under an ASN you assign.
// teams shipping on Zenlayer
over network fabric
Border Gateway
your VPC's BGP edge
Public clouds
On-prem data centers
Internet exchanges
3rd-party network fabrics
01
Connect your VPC to clouds, on-prem, and IXs
Border Gateway is your VPC's BGP edge. Over Zenlayer's network fabric it connects out to the networks your architecture depends on — public clouds, your on-prem data centers, internet exchanges, and other fabrics — without touching the public internet.
- Reaches clouds, on-prem, IXs, and fabrics over the network fabric
- Private paths, not the public internet
- Routed by BGP under an ASN you assign
One border gateway per VPC per region — the VPC's single door to the outside.
02
Private Layer-3 to the public clouds
The Border Gateway advertises your VPC's routes over BGP and links directly to a Cloud Router — both inside Zenlayer's network. The Cloud Router reaches the public cloud across the network fabric: a routed, private path that never touches the public internet.
- Layer-3, BGP-routed private connect to AWS, Azure, Google Cloud, and Oracle
- A Cloud Router carries your routes into the cloud across the network fabric — off the public internet
- Reach multiple clouds from one VPC, each as its own private path
Your VPC
subnets
your routes
Border Gateway
BGP edge
direct
Cloud Router
Layer 3
network fabric
Public clouds
Gateway BGP ASN
AS65000
you assign · 65000–65534
Interconnect CIDR
/27 – /28
the peering subnet
Routing scope
Regional / Global
one region or all
Advertised subnets
All / selected
you choose
03
Your ASN, your routes, your scope
The gateway speaks BGP under the ASN you set. Advertise every subnet or just the ones you choose, and control whether routes stay Regional or go Global.
- BGP under a private ASN you assign (65000–65534)
- Advertise ALL or selected subnets
- Regional or Global routing scope
A /27 or /28 BGP interconnect CIDR — standard BGP, your control.
04
Who Border Gateway is for
Architectures whose value is in the connections between networks, not just the compute inside one.
Hybrid cloud
Connect your on-prem data center to your cloud VPC privately, over the network fabric — not the public internet.
Multicloud, no internet hops
Reach AWS, Azure, Google Cloud, and Oracle from one VPC over Layer-3 private connect for consistent, private paths.
Interconnect from emerging markets
Private reach to clouds, IXs, and fabrics from the regions hyperscalers underserve (APAC, MEA, LATAM).
05
Create it with the API, SDKs, or CLI
Stand up a Border Gateway in one call — set your ASN, VPC, and routing scope — then attach a Cloud Router to reach your clouds. Drive it over the REST API, the Go and Node SDKs, or the CLI.
REST API
Go + Node SDKs
CLI
developer_console — bash
# Create a Border Gateway under your Global VPC
$ curl -X POST https://console.zenlayer.com/api/v2/zec \
-H "Content-Type: application/json" \
-H "X-ZC-Action: CreateBorderGateway" \
-H "Authorization: <your signed credentials>" \
-d '{
"regionId": "asia-southeast-1",
"vpcId": "vpc-xxxxxxxx",
"label": "border-gateway-1",
"asn": 65000,
"routingMode": "Global",
"advertisedSubnet": "ALL"
}'
# → { "requestId": "…", "zbgId": "zbg-…" }
Border Gateway FAQ
What you can connect to, BGP/ASN, and routing scope.
What can my VPC connect to through Border Gateway?
Public clouds (AWS, Azure, Google Cloud, Oracle, Tencent, and Alibaba), your on-prem data centers via a datacenter port, internet exchanges, and 3rd-party network fabrics — all privately, over Zenlayer's network fabric.
Do I run BGP, and which ASN does the gateway use?
Yes — the gateway runs BGP under a private ASN you assign (65000–65534). That's the gateway's local BGP ASN, not a public ASN you hold at a RIR — to announce your own public prefixes, see BYOIP. You then advertise all of your subnets or just selected ones, with Regional or Global routing scope.
Is the traffic private?
Yes — interconnect rides Layer-3, BGP-routed private connect over the network fabric, off the public internet.
How many border gateways can a VPC have?
One per region within the VPC — it's the VPC's single BGP edge in that region.