Welcome to 'Back to Basics'. I'm Adrian De Luca.
For growing companies, keeping users connected
to their applications is a foundational service.
Whether they're down the street or on the other side of the planet,
connectivity needs to be seamless and secure.
However, as you move your applications to the AWS Cloud,
your applications live in regions and availability zones.
And connectivity between them happens through Direct Connect
and Virtual Private Network services.
Today, I'm going to show you how to build a global network
using AWS Transit Gateway.
And we're going to learn how we use inter-region peering
to connect your Amazon VPCs.
Let's dive in.
Here's a typical environment.
We have an on-premise data center in San Francisco that we want to connect
to an AWS region in Northern California
through a high speed link due to its heavy data transfer.
And we also have branch offices outside of the metropolitan area
that have less intensive data traffic,
and routing between branches is not allowed.
Just like a traffic cop, routing establishes all the rules
for the TCP/IP traffic.
While using point-to-point connections can be easy to configure,
as your network grows over time it becomes costly
and difficult to maintain.
This is where AWS Transit Gateway comes in.
It allows you to connect Amazon VPCs,
AWS accounts, and on-premise networks
to a single gateway.
And with inter-region peering support
makes it not only easy to manage, but support multiple connection types
like software-defined wide area networks or SD WANs.
We start by creating a resilient pair of high bandwidth
low latency connections between the on-premise data center
and the AWS region.
A dedicated gigabit connection with AWS Direct Connect
is an ideal service for this.
Configuring two transit virtual interfaces
or TVIFs for each Direct Connect connection,
associating it to the gateway and then attaching it
to the AWS Transit Gateway in San Francisco AWS region.
Here we use the border gateway protocol
or BGP to announce the on-premise gateways,
specifying the allowed prefixes.
Branches are typically connected to the internet
through business-grade services like cable or fiber.
This not only keeps the cost down, but provides the most efficient way
to provide access to public websites.
Using a full-duplex connection and a pair of gateways deployed
in the branch that supports IPSec VPN,
you create an accelerated site-to-site VPN connection.
This ensures that it terminates
to the closest possible AWS edge location.
It's important to have two site-to-site VPN tunnels
that connect back to the AWS region
for higher availability.
In the branch office gateway configuring equal cost multi-pathing
or ECMP is also a good idea to balance traffic between them.
And finally, advertising the on-premise prefixes
to the AWS region using the BGP as path attribute.
Then in the Amazon VPCs Transit Gateways
associate the default routing table to the Transit Gateway IDs
for each VPN.
This ensures that you establish a reliable and secure connection
back to the AWS region.
So far you've connected your on-premise data center
and branch offices to an AWS region.
But what about if you want to connect for the flung location,
say in another country.
Here is where you use AWS Transit Gateway's
inter-region peering.
Not only is it a highly scalable cloud router,
but it can consolidate connectivity
between Direct Connect's VPNs and VPCs between different AWS regions.
It even supports multicast for content streaming.
And here you have the benefit of using AWS's Backbone.
Taking away the need to deal with international network suppliers.
Lets say, you want to deploy workloads in London
that need connectivity back to San Francisco.
This is simply a matter of configuring inter-region peering support
in AWS Transit Gateway.
By configuring two of them
with different autonomous system numbers
or ASNs, we use BGP to identify each router.
Well, each route propagation is not available today
between Transit Gateways, we can create route tables
for each attachment to enable it to make a forwarding decision.
You can add entries to the route table manually,
using static routes or dynamically to each of the attachment routes.
Remember, there are fixed ally costs
for Transit Gateway VPN, Direct Connect,
and traffic leaving the AWS network.
So only configure the network connections that you need.
And if you have a lot of branch offices,
you may want to consider using an SD-WAN
with one of our interconnect partners.
Monitoring traffic is important to maintaining a healthy global network.
AWS Transit Gateway Network Manager
allows you to track things like bytes in and out,
packets in and out, and packets dropped.
Keeping an eye on all your network connections
helps you not only identify events, but also plan for future capacity.
So, there you have it. A global network all enabled
by the AWS Cloud.
Check out the links below for more details.
Have fun building your network. See you next time.