(upbeat music)
- Hi, I'm Simon, a Cloud Support Engineer
here at the AWS office in Cape Town.
Sometimes customers ask me
how they can migrate their site-to-site VPN
from a virtual private gateway to a transit gateway.
I tell them the transit gateway allows you to attach VPCs,
direct connect gateways, and VPNs for interconnectivity.
I'll show you how you can modify
your existing site-to-site VPN's target
from a virtual gateway to a transit gateway.
Let's get started.
After logging into the AWS Management Console,
navigate to VPC Console.
In the navigation panel on the left,
go to Transit Gateway,
choose Create Transit Gateway.
From here you can give your Transit Gateway
a name and description.
I'll name mine TGW-1.
If you plan on migrating a dynamic VPN,
you must add your BGP ASN number here.
Keep this the same as your previous
site-to-site VPN AS number,
so that you can avoid reconfiguring your customer gateway.
Make sure you enabled Auto accept shared attachments
to enable automatic acceptance of cross account attachments.
Choose Create Transit Gateway and click Close.
Now we need to attach
your newly created transit gateway to your VPC.
Go to Transit Gateway Attachments in the navigation panel,
and then select Create Transit Gateway Attachment.
From the drop down menu for Transit Gateway ID,
you can select your recently created transit gateway.
Set your attachment type as VPC,
and provide a name tag for your attachment,
I'll name mine VPC-1-Attachment.
From the VPC ID drop down you can select
the VPC you want to attach to the transit gateway,
and then select the subnets you want
the transit gateway ENIs to reside.
Choose Create Attachment and then Close.
You've now successfully created your transit gateway,
and attached it to your VPC.
And now to migrate your existing site-to-site VPN
away from the virtual private gateway
to your new transit gateway.
If you're using a static VPN,
the first step is to remove
the static routes from the VPN itself.
In the navigation pane,
choose Site-to-Site VPN Connection.
Highlight your VPN, and then select static routes
from the navigation pane.
Select Edit, and remove the existing routes.
It's best practice to keep a copy of these routes,
because you'll be adding them to the transit gateway later.
Choose Save, and then Close to commit your changes,
and return to the Site-to-Site pane.
Now, you'll modify your VPN targets.
Your VPN should still be highlighted,
so you can navigate to Actions, Modify VPN Connection.
Under Change Target,
choose the drop down menu next to the Target Type,
and then select Transit Gateway.
Under the drop down menu for Target Transit Gateway ID,
locate and select Transit Gateway.
Save your changes.
Choose Close.
You're returned to the Site-to-Site pane.
Now you'll see your transit gateway
is referenced in your VPN details,
and your VPN state is set to modify.
This takes a few moments to update.
When the state of your VPN shows available,
you can navigate to the Transit Gateway Attachments
in the navigation pane.
Now you'll see your VPN as an attachment
to your transit gateway.
You can name your attachment here by editing the name field,
I will name mine VPN-1-attachment.
The routes that you previously removed from the VPN
can now be added to the transit gateway.
Navigate to the Transit Gateway Route Table pane.
Make sure that your transit gateway is highlighted,
and then, select routes.
Choose Create Routes.
under CIDR, add the IP range of your on premise network.
Select the drop down menu under Choose attachment,
and then select your VPN.
Select Create route.
Choose Close, and return to
Transit Gateway Route Tables navigation pane.
Don't be surprised if your route state is black hole,
as the process of modifying your target
drops the tunnel briefly.
Make sure that you're sending interesting traffic
from the customer gateway to reestablish the VPN.
When the tunnel is established,
the routes state changes to active.
Now we'll edit the routes within the VPC,
and point them to the transit gateway.
If you propagating routes, this step is unnecessary.
Select Route Tables in the navigation panel.
Highlight your route table.
Then in the Routes tab, select Edit Routes.
Select the routes for the VPN,
and then choose the Target drop down menu.
Under the Target drop down menu,
remove the virtual gateway, choose Transit Gateway,
and then select your transit gateway.
Choose Save Routes, and then Close.
You've now successfully migrated your VPN
from a virtual private gateway to a transit gateway.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(upbeat music)