---
title: "Connect a server in a C-DC to a dedicated server in a different pool"
sidebar_label: "Connect a server in a C-DC to a dedicated server in a different pool"
sidebar_position: 2
description: "How to connect a dedicated server in a C-DC and a dedicated server from another pool over a private network"
---
import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import ConnectDedicatedNetworkToGlobalRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/global-router/connect-dedicated-network-to-global-router.mdx'
import CreateGlobalRouter from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/global-router/create-global-router.mdx'
# Connect a server in a C-DC to a dedicated server in a different pool
You can connect a server in a [C-DC](/certified-data-center-segment/about/about-certified-data-center-segment.mdx) and a [dedicated server](/dedicated/about/about-dedicated.mdx) that are in different [pools](/infrastructure/locations.mdx#pool). Connectivity is provided over a private network via a [Selectel Global Router](/global-router/about-global-router.mdx).
## How it works \{#principle-of-operation}
A dedicated server in a C-DC connects to the Global Router through a firewall. For this, the firewall behind which the server is located must be connected to private network switches.
A dedicated server in another pool also connects to the Global Router. Dedicated servers, with the exception of some Chipcore Line servers, are connected to private network switches by default.
## Connect a server in a C-DC to a dedicated server in a different pool over a private network \{#create-private-network-cdc-to-dedicated-different-pool}
1. [Connect the firewall to the private network](#connect-firewall-to-local-network).
2. [Create a Global Router](#create-global-router).
3. [Connect the network and subnet to the router for the dedicated server VLAN outside the C-DC](#connect-network-and-subnet-to-router-up-to-dedicated-server-vlan).
4. [Connect the network and subnet to the router for the C-DC](#connect-network-and-subnet-to-router-up-to-cdc).
5. [Configure the firewall in the C-DC](#configure-firewall).
6. [Configure the dedicated server outside the C-DC](#configure-dedicated-server).
### 1. Connect the firewall to the private network \{#connect-firewall-to-local-network}
1. [Create a ticket](https://my.selectel.ru/tickets/create/) to connect the firewall in the C-DC to the private network. In the ticket, specify:
* the firewall number in the C-DC; you can view it in the [Control panel](https://my.selectel.ru/network/firewalls/): in the top menu, click **Products** → **Firewalls** → firewall page;
* the port number on the firewall for connecting to the private network switch.
2. Wait for a Selectel employee to confirm that the firewall in the C-DC has been connected to the private network.
### 2. Create a Global Router \{#create-global-router}
### 3. Connect the network and subnet to the router for the dedicated server VLAN outside the C-DC \{#connect-network-and-subnet-to-router-up-to-dedicated-server-vlan}
### 4. Connect the network and subnet to the router for the C-DC \{#connect-network-and-subnet-to-router-up-to-cdc}
1. In the [Control panel](https://my.selectel.ru/network/localnetwork/l3_list/), in the top menu, click **Products** and select **Global Router**.
2. In the **Selectel Global Router** section, open the router page → **Networks**.
3. Click **Create network**.
4. Enter a network name. It will only be used in the Control panel.
5. Select the **Servers and Hardware** service.
6. Select a [pool](/infrastructure/locations.mdx#pool).
7. Select a VLAN.
8. If you want to create a network for the internal VLAN segment (Q-in-Q), specify its tag — a number from 2 to 4094.
9. Enter a subnet name. It will only be used in the Control panel.
10. Enter a CIDR — the IP address and mask of the private subnet. The subnet must meet the following conditions:
* belong to the RFC 1918 private address range: `10.0.0.0/8`, `172.16.0.0/12` or `192.168.0.0/16`;
* have a size of at least `/29`, as three addresses will be occupied by Selectel network equipment;
* not overlap with other subnets added to this router — there must be no identical IP addresses in the subnets of one router;
* if a Managed Kubernetes cluster on cloud servers is to be included in the Global Router network, the subnet must not overlap with the ranges `10.10.0.0/16`, `10.96.0.0/12`, `10.250.0.0/16` and `10.251.0.0/24`. If a cluster on dedicated servers is included in the network — with the ranges `10.10.0.0/16`, `10.222.0.0/16`, `10.250.0.0/16`, `10.251.0.0/24` and `172.250.0.0/14`. These subnets are used for internal Managed Kubernetes addressing, and using them may lead to conflicts in the Global Router network.
11. Enter the gateway IP or leave the first address of the subnet, which is assigned by default. Do not assign this address to your devices, so as not to disrupt network operation.
12. Enter service IPs or leave the last addresses of the subnet, which are assigned by default. Do not assign these addresses to your devices, so as not to disrupt network operation.
13. Click **Create network**.
14. Optional: check the network topology on the Global Router. In the [Control panel](https://my.selectel.ru/network/localnetwork/l3_list), in the top menu, click **Products** → **Global Router** → router page → **Network map**.
15. If you specified a Q-in-Q tag in step 8, ensure that you have [configured Q-in-Q](/dedicated/networks/q-in-q.mdx). When configuring, use the subnet you specified in step 10.
### 5. Configure the firewall in the C-DC \{#configure-firewall}
FortiGate
1. [Connect to FortiGate via the GUI](/firewalls/fortigate/connect-to-firewall.mdx).
2. Create and configure a private interface with a dedicated subnet:
2.1. Go to the **Network** → **Interfaces** section.
2.2. Click **Create New** → **Interface**.
2.3. In the **Address** field, enter an IP address from the private subnet that you [connected to the Global Router for the C-DC](#connect-network-and-subnet-to-router-up-to-cdc), for example `192.168.100.2/28`.
3. Add a static route to the subnet that you [connected to the Global Router for the dedicated server VLAN outside the C-DC](#connect-network-and-subnet-to-router-up-to-dedicated-server-vlan):
3.1. Go to the **Network** → **Static Routes** section.
3.2. Click **Create New** → **IPv4 Static Route**.
3.3. In the **Destination** field, enter the destination subnet—the subnet that you [connected to the Global Router for the dedicated server VLAN outside the C-DC](#connect-network-and-subnet-to-router-up-to-dedicated-server-vlan).
3.4. In the **Gateway Address** field, enter the gateway—the IP address that you assigned to the Global Router when [connecting the network for the C-DC](#connect-network-and-subnet-to-router-up-to-cdc) in step 11.
3.5. In the **Interface** field, specify the local interface that you created in step 2.
4. Configure a security policy that will allow traffic from the dedicated server outside the C-DC to the dedicated server in the C-DC:
4.1. Go to **Policy & Objects** → **Firewall Policy**.
4.2. Click **Create New**.
4.3. Enter a policy name.
4.4. In the **Incoming Interface** field, select the interface for which you configured the IP address in step 2.
4.5. In the **Outgoing Interface** field, select the interface to which the dedicated server in the C-DC is connected.
4.6. In the **Source** field, enter another IP address from the same private subnet that you configured on the firewall in step 2. This address will be used on the dedicated server outside the C-DC.
4.7. In the **Destination** field, enter the IP address of the dedicated server in the C-DC.
4.8. Click **Save**.
5. Configure a security policy that will allow traffic from the dedicated server outside the C-DC to the dedicated server in the C-DC:
5.1. Go to **Policy & Objects** → **Firewall Policy**.
5.2. Click **Create New**.
5.3. Enter a policy name.
5.4. In the **Incoming Interface** field, select the interface to which the dedicated server in the C-DC is connected.
5.5. In the **Outgoing Interface** field, select the interface for which you configured the IP address in step 2.
5.6. In the **Source** field, enter the IP address of the dedicated server in the C-DC.
5.7. In the **Destination** field, enter the IP address that will be used on the dedicated server outside the C-DC.
5.8. Click **Save**.
### 6. Configure the dedicated server outside the C-DC \{#configure-dedicated-server}
1. Assign an IP address from the subnet that you [connected to the global router to a server outside the A-DC](#connect-network-and-subnet-to-router-up-to-dedicated-server-vlan). Use the [Configure a private network interface](/dedicated/networks/configure-network-interface-on-server.mdx#configure-network-interface-of-private-network) subsection of the [Configure a network interface on a server](/dedicated/networks/configure-network-interface-on-server.mdx) guide.
2. [Add a static route](/global-router/create-network/create-global-router-network.mdx#write-routes-on-devices) on the network interface you configured in step 1. In the route, specify:
* destination subnet — the subnet that you [connected to the global router to the A-DC](#connect-network-and-subnet-to-router-up-to-cdc);
* gateway — the IP address on the global router from the subnet that you [connected to the global router to a server outside the A-DC](#connect-network-and-subnet-to-router-up-to-dedicated-server-vlan).