Introducing AWS Transit Gateway

Size: px

Start display at page:

Download "Introducing AWS Transit Gateway"

Ami Boone
5 years ago
Views:

1 Introducing AWS Transit Gateway Nick Matthews Principal Solutions Architect Mohamed Hassan Senior Product Manager EC2 Networking,

2 What is Transit Gateway?

3 Introducing AWS Transit Gateway A gateway that provides simple, scalable, and secure connectivity across networks

4 Before Transit Gateway Connecting large number of VPCs in a mesh is challenging to manage Connecting on-premises networks to each new VPC can take weeks to months to implement due to customer's internal processes Complex configurations are prone to human error

5 AWS Transit Gateway

6 Getting Started with Transit Gateway

7 Scenario AWS Cloud Connecting Multiple VPC s Any to any communication Sharing a single VPN Connection On-Premise

8 Four VPC s

9 Create a Transit Gateway

10 Create a Transit Gateway

11 Create VPC Attachments

12 Create VPC Attachments

13 View VPC Attachments

14 Transit Gateway Route Table

15 Update VPC Route Tables

16 Scenario AWS Cloud Connecting Multiple VPC s Any to any communication Sharing a single VPN Connection On-Premise

17 Test Connectivity

18 Scenario AWS Cloud Connecting Multiple VPC s Any to any communication Sharing a single VPN Connection On-Premise

19 Create a VPN Attachment

20 Download the Configuration

21 Complete VPN UP

22 Complete VPC to the CGW via VPN

23 Complete view from the CGW

24 Transit Gateway Basics

25 A t t a c h m e n t The connection from a Amazon VPC and VPN to a TGW A s s o c i a t i o n The route table used to route packets coming from an attachment (from an Amazon VPC and VPN) P r o p a g a t i o n The route table where the attachment s routes are installed

26 Attachments VPC s

27 Attachments VPC s 10.1 VPC att-red att-blue

28 Attachments associated route table 10.1 VPC att-red att-blue

29 Attachments propagation of routes 10.1 VPC att-red att-blue

30 Attachments associated & propagated route table att-red att-blue

31 Attachments TGW Route Table is complete 10.1 VPC att-red att-blue

32 Attachments VPC s Route Tables 10.1 VPC att-red att-blue

33 The Default VPC 10.1 att-red att-blue On-Premise /24 via BGP /16 via BGP /16 via BGP AWS VPN

34 Routing Domains 10.1 att-blue VPC att-red On-Premise /24 via BGP /16 via BGP /16 via BGP AWS VPN

35 Transit Gateway Use Cases

36 Use Case 1: Shared Services with Transit Gateway VPCs attach to a route table with routes to shared resources Shared resources attach to a route table with routes to all resources VPC Route Destination /8 VPN /16 vpc-att-4xxxx Transit Gateway Shared services + VPN Route Destination /16 vpc-att-1xxxx /16 vpc-att-2xxxx Route Destination /16 vpc-att-3xxxx /16 vpc-att-4xxxx VPN

37 Use Case 2: Outbound Internet with NAT Gateway VPC A VPC B / /16 Spoke route table Route Destination /16 Local /0 tgw-xxxxxxxxx Outbound VPC route table Route Destination /16 Local /8 tgw-xxxxxxxxx /0 igw-xxxxxxxxx Apply SNAT outbound to the internet /0 vpc-att-outbound /16 vpc-att-a /16 vpc-att-b VPC route domain Outbound route domain SNAT SNAT Outbound VPC /16 Transit Gateway SNAT Route Destination /0 ngw-xxxxxxx VPC Attachment route table, per AZ

38 Use Case 3: Outbound services VPC VPC A VPC B / /16 Spoke route table Route Destination /16 Local /0 tgw-xxxxxxxxx Outbound VPC route table Route Destination /16 Local /8 tgw-xxxxxxxxx /0 igw-xxxxxxxxx ECMP VPN Apply SNAT outbound to the internet /0 Outbound VPC VPN /16 vpc-att-a /16 vpc-att-b VPC route domain Outbound route domain SNAT SNAT Outbound VPC /16 Transit Gateway SNAT BGP prefix Next hop /0 Local IP BGP advertisement

39 Use case 4: Edge services VPC: SD-WAN BGP prefix Many prefixes Next hop Local IP VPC A /16 Spoke route table Route /16 Local Destination Edge VPC route table Route /16 Local Destination SNAT Edge VPC / /0 tgw-xxxxxxxxx Can be a summary or default route in each VPC /8 tgw-xxxxxxxxx /0 igw-xxxxxxxxx ECMP VPN SNAT SNAT Only stateful services require NAT Tunnels and BGP Many Prefixes Edge VPC VPN /16 vpc-att-a VPC route domain Edge route domain Use cases: Data Center, Branches, Clients, etc. Transit Gateway

40 Future plans and Conclusion

41 Future Plans Direct Connect Gateway Attachments Transit Gateway Inter-Region Peering Additional advanced routing features

42 AWS Transit Gateway Easier connectivity Edge connectivity Better visibility and control Feature interoperability On-demand bandwidth Monitoring Routing Security

43 FAQ What is the bandwidth Limit for a VPC attachment? How does high availability of Transit Gateway work? Does it work with PrivateLink and Network Load Balancers? What if I am using SD-WAN, how do I connect Transit Gateway? Should I use multiple Transit Gateways or routing domains? How does Transit Gateway handle encryption?

44 Related Material Product Page Documentation NET331 : Introducing AWS Transit Gateway (300 Level Deep Dive) NET402 : Transit Gateway : Reference Architectures for Many VPC s

45 Thank you, questions?

AWS Networking Fundamentals

AWS Networking Fundamentals Tom Adamski Specialist Solutions Architect, AWS Traditional Network WAN VPN VPN Fiber Applications Applications AWS Network VPN WAN (AWS Direct Connect) VPN Fiber Applications