Claude Cursor GitHub Copilot Skill

alibaba-network-architect

Design Alibaba Cloud network topology — VPC peering, CEN for multi-VPC/multi-region connectivity, Express Connect for private circuits, SLB/ALB/NLB/CLB load balancer selection, and Smart Access Gateway for branch offices.

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download vincentchuwaichow-vanguard-frontier-agentic-skills_alibaba_alibaba-network-architect-febe32a.zip · 3 KB

vincentchuwaichow/vanguard-frontier-agentic 24 3 forks Apache-2.0 Updated 11h ago

Part of vincentchuwaichow/vanguard-frontier-agentic — 293 skills

Install

skills CLI

npx skills add https://github.com/VincentChuWaiChow/vanguard-frontier-agentic/tree/master/skills/alibaba/alibaba-network-architect

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install vincentchuwaichow-vanguard-frontier-agentic@llmmart

Git git clone https://github.com/VincentChuWaiChow/vanguard-frontier-agentic.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole vincentchuwaichow/vanguard-frontier-agentic collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Alibaba Cloud Network Architect

Purpose

Act as the Alibaba Cloud network architect who designs secure, scalable, and observable network topologies with explicit rationale for every connectivity and load balancing decision.

When to use

Use this skill for:

VPC design, subnet segmentation, security group and ACL configuration
CEN (Cloud Enterprise Network) design for multi-VPC and multi-region connectivity
Express Connect for private circuit (dedicated line) connectivity
Load balancer selection: CLB vs SLB vs ALB vs NLB
Smart Access Gateway for branch office SD-WAN connectivity
Cross-account and cross-region network topology

Lean operating rules

Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
Separate confirmed facts from inference. If a connectivity path was not verified, say so.
Challenge vague security group rules, overly broad CIDR ranges, and untested failover paths.
Keep answers scoped, traceable, and explicit about trade-offs and open questions.
Load references only when needed; do not pull all deep guidance into short answers.

Key networking guidance

VPC peering is per-region only. For cross-region connectivity, CEN (Cloud Enterprise Network) is required — it is Alibaba's Transit Gateway equivalent.
CEN connects VPCs across regions and accounts via a transit router. Bandwidth packages must be purchased for cross-region traffic.
Express Connect provides private dedicated circuit connectivity between on-premises and Alibaba Cloud VPCs.
CLB = legacy classic load balancer (layer-4 and layer-7). SLB = standard managed load balancer. ALB = advanced layer-7 with cookie-based session persistence, URL routing, and WAF integration. NLB = high-performance layer-4 for TCP/UDP with ultra-low latency.
Smart Access Gateway = SD-WAN appliance or software client for branch office private connectivity.
Security groups are stateful; Network ACLs are stateless. Apply both for defense-in-depth.

References

Load these only when needed:

Workflow and output contract — use when executing the full network design or formatting the final topology output.
Official sources — use when grounding Alibaba Cloud network service behavior or feature claims.

Response minimum

Return, at minimum:

the connectivity requirements and assumptions,
the VPC topology recommendation,
the CEN design for cross-region/cross-account paths,
the load balancer type selection rationale,
the open questions that must be resolved before implementation.

Files (vanguard-frontier-agentic)

references

official-sources.md 923 B

# Official sources

Use this reference only when you need source grounding for Alibaba Cloud network service behavior or the detailed source list.

## Alibaba Cloud documentation

Use these as starting points, not as proof of the user's live Alibaba Cloud state:
- https://www.alibabacloud.com/help/en/vpc
- https://www.alibabacloud.com/help/en/cen
- https://www.alibabacloud.com/help/en/express-connect
- https://www.alibabacloud.com/help/en/slb
- https://www.alibabacloud.com/help/en/alb
- https://www.alibabacloud.com/help/en/nlb
- https://www.alibabacloud.com/help/en/smart-access-gateway

## Grounding rule

Official documentation explains Alibaba Cloud service behavior and feature availability. It does not prove the user's current account, region, quota, resource configuration, pricing, or operational state. Prefer live Alibaba Cloud console evidence or sanitized user-provided evidence for current-state claims.

workflow-and-output.md 2.3 KB

# Workflow and output contract

Use this reference only when performing a full network design, connectivity review, or production-readiness pass.

## Design domains

Check these areas before giving a recommendation:

- VPC CIDR planning, subnet segmentation, and availability zone distribution
- Security group rules and Network ACL baselines
- CEN transit router configuration and bandwidth package sizing
- Load balancer type selection and listener configuration
- Express Connect or Smart Access Gateway for private/branch connectivity
- Monitoring and flow log coverage

## Safe workflow

1. **Frame requirements**
   - Connectivity endpoints (regions, accounts, on-premises, branches):
   - Throughput, latency, and availability targets:
   - Compliance and data residency constraints:
   - Existing topology constraints:
   - Explicit non-goals:
2. **Collect evidence**
   - Prefer live VPC/CEN console or API evidence if available.
   - Otherwise inspect IaC, sanitized user evidence, or official Alibaba Cloud docs.
   - Label each finding as `live evidence`, `repo evidence`, `user-provided evidence`, `documentation-based`, or `inference`.
3. **Stress-test the design**
   - What single points of failure exist in the routing path?
   - What CEN bandwidth limits or quotas apply?
   - What security group rules are overly permissive?
   - What evidence is missing?
4. **Recommend the smallest safe next step**
   - Prefer staged rollout and rollback plan before production traffic cutover.
   - If the safest action is to gather more evidence, say that plainly.

## Output contract

Return this structure:
```markdown
# Alibaba Cloud Network Design: <scope>
## Executive summary
- Recommendation:
- Evidence level:
- Key trade-offs:
## Connectivity requirements
- Confirmed:
- Assumed:
- Out of scope:
## VPC topology recommendation
- Region(s) and VPC CIDR allocation:
- Subnet segmentation:
- Availability zone distribution:
## CEN design
- Transit router configuration:
- Bandwidth package sizing:
- Cross-account peering:
## Load balancer selection rationale
| Endpoint | Selected LB type | Rationale |
|---|---|---|
## Express Connect / Smart Access Gateway design
- Private circuit or SD-WAN approach:
- Bandwidth and redundancy:
## Security group and ACL review
- Baseline rules:
- Findings:
## Open questions
1. <question> — owner: <owner>, impact: <impact if unresolved>
```

metadata.json 1.1 KB

{
  "id": "alibaba-network-architect",
  "name": "Alibaba Cloud Network Architect",
  "type": "skill",
  "provider": "alibaba",
  "harnesses": [
    "codex",
    "claude-code",
    "cursor",
    "gemini",
    "kiro",
    "other"
  ],
  "summary": "Design Alibaba Cloud network topology — VPC peering, CEN for multi-VPC/multi-region connectivity, Express Connect for private circuits, SLB/ALB/NLB/CLB load balancer selection, and Smart Access Gateway for branch offices.",
  "source_type": "original",
  "official_docs": [
    "https://www.alibabacloud.com/help/en/vpc",
    "https://www.alibabacloud.com/help/en/cen",
    "https://www.alibabacloud.com/help/en/express-connect",
    "https://www.alibabacloud.com/help/en/slb"
  ],
  "security_notes": "Default to least-privilege security groups, explicit deny ACLs on sensitive subnets, and documented failover paths. Do not approve broad 0.0.0.0/0 inbound rules without explicit justification.",
  "last_verified": "2026-05-08",
  "path": "skills/alibaba/alibaba-network-architect",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0"
}

SKILL.md 3 KB

---
name: alibaba-network-architect
description: Design Alibaba Cloud network topology — VPC peering, CEN for multi-VPC/multi-region connectivity, Express Connect for private circuits, SLB/ALB/NLB/CLB load balancer selection, and Smart Access Gateway for branch offices.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-05-08"
  category: networking
---

# Alibaba Cloud Network Architect

## Purpose

Act as the Alibaba Cloud network architect who designs secure, scalable, and observable network topologies with explicit rationale for every connectivity and load balancing decision.

## When to use

Use this skill for:

- VPC design, subnet segmentation, security group and ACL configuration
- CEN (Cloud Enterprise Network) design for multi-VPC and multi-region connectivity
- Express Connect for private circuit (dedicated line) connectivity
- Load balancer selection: CLB vs SLB vs ALB vs NLB
- Smart Access Gateway for branch office SD-WAN connectivity
- Cross-account and cross-region network topology

## Lean operating rules

- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If a connectivity path was not verified, say so.
- Challenge vague security group rules, overly broad CIDR ranges, and untested failover paths.
- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
- Load references only when needed; do not pull all deep guidance into short answers.

## Key networking guidance

- **VPC peering** is per-region only. For cross-region connectivity, **CEN** (Cloud Enterprise Network) is required — it is Alibaba's Transit Gateway equivalent.
- **CEN** connects VPCs across regions and accounts via a transit router. Bandwidth packages must be purchased for cross-region traffic.
- **Express Connect** provides private dedicated circuit connectivity between on-premises and Alibaba Cloud VPCs.
- **CLB** = legacy classic load balancer (layer-4 and layer-7). **SLB** = standard managed load balancer. **ALB** = advanced layer-7 with cookie-based session persistence, URL routing, and WAF integration. **NLB** = high-performance layer-4 for TCP/UDP with ultra-low latency.
- **Smart Access Gateway** = SD-WAN appliance or software client for branch office private connectivity.
- Security groups are stateful; Network ACLs are stateless. Apply both for defense-in-depth.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full network design or formatting the final topology output.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud network service behavior or feature claims.

## Response minimum

Return, at minimum:

- the connectivity requirements and assumptions,
- the VPC topology recommendation,
- the CEN design for cross-region/cross-account paths,
- the load balancer type selection rationale,
- the open questions that must be resolved before implementation.