By Matt Simpson, Executive VP
Demystifying Direct Connect and Transit Gateway so you can better understand your AWS networking capabilities.
Ever since AWS Direct Connect launched in 2012, organizations have been embracing dedicated connections to their cloud services—they gained the ability to improve their overall data transfers, increase their network performance, and enhance their data privacy when connecting to AWS. With the introduction of an array of new service features and enhancements, the options for peering with AWS have certainly evolved. Let’s take a look at how this has developed and how you can take advantage of some of the features available.
Back when Direct Connect launched in 2012, connecting to AWS via Layer 2 with Megaport required a VXC that connected to a Virtual Interface (VIF) on the AWS side. At Layer 3, you were required to connect the L2 component to an L3 construct which required establishing a Virtual Private Gateway (VGW). A VGW is the routing target on AWS that connected the VXC through to each VPC. Each AWS VPC and Megaport VXC required 1:1 mapping including separate Border Gateway Protocol (BGP) sessions and VXCs/VIFs to each VGW.
In 2017, AWS released Direct Connect Gateway (DXGW), which gave customers the ability to establish one BGP session for up to ten distinct VPCs within a single AWS account. The service matured over time from ten VPCs from a single account in a single AWS region, then expanded to support connectivity across AWS regions and, most recently, extended across multiple regions and multiple AWS accounts. DXGW also signalled the move from a single standard AWS ASN (7224 in most regions) to a customer defined ASN in the private ASN range (64512 to 65534). VGWs and DXGWs still exist as options for customers with Private VIF peerings today.
It was still possible to peer VPCs (even across accounts/regions) within AWS, however where a DXGW was used, it was only possible to peer from the VIF to the ‘next directly connected’ VPC, and not between VPCs that were not adjacently peered.
In this diagram, assume that VPC ‘A’ is linked directly to a VXC/VIF (via VGW or DXGW), and although VPC ‘B’ and ‘C’ are peered to VPC ‘A,’ they may not communicate directly with the VIF. This is known as Transitive Routing. Some customers would run a virtual appliance (router) in VPC A to work around this constraint (informally known as a ‘Transit VPC’), however, overall design brought with it some complexities.
In late 2018, AWS launched Transit Gateway (TGW). A TGW allowed a ‘full mesh’ of routes to be passed between VPCs and VPN terminations that were not reliant on the VPC peering (with its transitive routing limitations), providing the ability to connect thousands (up to 5000) of VPCs and on-premises networks together, across multiple accounts to a single gateway.
Initially, a TGW was only accessible by customers to connect to associated VPCs via the AWS provided IPSEC VPN service. At launch, this was announced in the following regions: US East (Virginia), US East (Ohio), US West (Oregon), US West (Northern California), EU (Ireland), and AsiaPacific (Mumbai). It has now expanded to include the above as well as AWS GovCloud (US-West), Canada (Central), South America (São Paulo), Africa (Cape Town), EU (Stockholm), EU (London), EU (Frankfurt), EU (Paris), EU (Milan), Middle East (Bahrain), Asia Pacific (Hong Kong), Asia Pacific (Tokyo), Asia Pacific (Singapore), Asia Pacific (Seoul), Asia Pacific (Sydney), Asia Pacific (Beijing), Asia Pacific (Ningxia) regions. This is current as of August 2020.
Transit Gateway for Direct Connect support was announced on 30th April 2019. There are two models customers can use via Direct Connect: Dedicated and Hosted Connection supporting 1, 2, 5, and 10Gbps connections to connect via Direct Connect to TGW.
When TGW via Direct Connect launched, network partners like Megaport connected customers to AWS via the following models: dedicated connections, hosted connections 50 to 500Mbps, and Hosted Virtual Interfaces (VIF). Megaport uses and still supports AWS via the Hosted VIF model. Hosted VIFs allow Megaport to provide customers with flexibility and scalability when connecting to AWS, which include scaling bandwidth in increments of 1Mbps to 5Gbps VXCs where, previously, partners delivering hosted connections were limited to a maximum of 500Mbps per VIF.
On 19th March 2019, AWS announced higher capacity for Direct Connect partners using the Hosted Connection model including higher bandwidth options above 500Mb, supporting higher speed options of 1, 2, 5, or 10Gbps. While Megaport still offers customers the ability to deploy Hosted VIF solutions supporting private and public VIFs, customers also have the flexibility via the same Megaport portal to implement Hosted Connections from 50Mbps to 500Mbps and at the higher tier connections of 1, 2, 5 or 10Gbps required to support Transit Gateway. Currently Megaport has over 20 on-ramp locations enabled with Hosted Connection around the globe, providing customers with more options to reach the AWS network with low latency from their data centre with geographically diverse connections.
Please note there are some factors to consider when choosing Megaport’s AWS Direct Connect Partner models Hosted VIF vs Hosted Connections.
When a customer would like to promote their TGW to be accessible over a Direct Connect sub 1Gbps, it is possible (in all regions) to use a Public VIF (Hosted VIF or Hosted Connection) across a Megaport VXC service. The AWS IPSEC VPN service via Public VIF will require you to use either your own public IP space to perform the public peering, or you can use Megaport Cloud Router (MCR) to provide the public peering IPs and NAT this back across a VXC that uses RFC1918/private IP space. Traffic will be end-to-end encrypted and also subject to a maximum throughput of 1.25Gbps (AWS VPN limitation). Here is additional information from AWS on this configuration AWS Sub 1G TGW Public VIF.
Watch for updates and we continue to expand our AWS Hosted Connection locations to provide customers additional options to AWS network on-ramps, giving Megaport enterprise customers the optimal path to access their workloads in the cloud with low latency and strategic geographical proximity.
NOTE: This is an update of a post previously published on June 12, 2019.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。