AWS Direct Connect | Using AWS Direct Connect with Amazon Virtual Private Cloud

Question 1

Will cloudhub still work in my VGW? (note also impacts VPN)

Using AWS Direct Connect with Amazon Virtual Private Cloud

AWS Direct Connect | Networking & Content Delivery

Answer 1

It will only work for like for like traffic. You can’t send v4 traffic out a v6 interface, for example. Translation between IPv4 and IPv6 is not supported.

Question 2

What are the technical requirements for virtual interfaces to VPCs?

Using AWS Direct Connect with Amazon Virtual Private Cloud

AWS Direct Connect | Networking & Content Delivery

Answer 2

This connection requires the use of Border Gateway Protocol (BGP). You will need the following information to complete the connection:

A public or private ASN. If you are using a public ASN you must own it. If you are using a private ASN, it must be in the 64512 to 65535 range.

A new unused VLAN tag that you select

The VPC Virtual Private Gateway (VGW) ID

AWS will allocate private IPs (/30) in the 169.x.x.x range for the BGP session and will advertise the VPC CIDR block over BGP. You can advertise the default route via BGP.

Question 3

How does AWS Direct Connect differ from an IPSec VPN Connection?

Using AWS Direct Connect with Amazon Virtual Private Cloud

AWS Direct Connect | Networking & Content Delivery

Answer 3

A VPC VPN Connection utilizes IPSec to establish encrypted network connectivity between your intranet and Amazon VPC over the Internet. VPN Connections can be configured in minutes and are a good solution if you have an immediate need, have low to modest bandwidth requirements, and can tolerate the inherent variability in Internet-based connectivity. AWS Direct Connect does not involve the Internet; instead, it uses dedicated, private network connections between your intranet and Amazon VPC.

Question 4

Can I use AWS Direct Connect and a VPN Connection to the same VPC simultaneously?

Using AWS Direct Connect with Amazon Virtual Private Cloud

AWS Direct Connect | Networking & Content Delivery

Answer 4

Yes. However, only in fail-over scenarios. The Direct Connect path will always be preferred, when established, regardless of AS path prepending.