What are the technical requirements for virtual interfaces to public AWS services such as Amazon EC2 and Amazon S3?
- A public or private ASN. If you are using a public ASN, you must own it. If you are using a private ASN, it must be in the 64512 to 65535 range.
- A new unused VLAN tag that you select
- Public IPs (/30) allocated by you for the BGP session
* VLAN are in customer's DC
* VIF are in AWS VPC
-
A public or private ASN. If you are using a public ASN you must own it. If you are using a private ASN, it must be in the 64512 to 65535 range.
-
A new unused VLAN tag that you select
-
The VPC Virtual Private Gateway (VGW) ID . [ PUBLIC VIF doesn't need a VGW]
-
AWS will allocate private IPs (/30) in the 169.x.x.x range for the BGP session and will advertise the VPC CIDR block over BGP. You can advertise the default route via BGP.
BGP peers in US regions adventises the public prefixes, so that the DX Connection in a region know the routes to
- AWS Public endpoints in another US region
- 8100 - prefix is local region
- 200 - prefix is local continent
- 9100 - you advertise to local AWS region
- 9200 - you advertise to local AWS continent
Note: Dx is prefered over the ipsec route in a route table
Push and Pop - applies to the S-tag (supplier tag)
* 802.3 - ETHERNET
* 802.1Q - VLAN [Layer 2]
Use case of QinQ with AWS DX
- The colo site is very far and so you are using a telco providers backbond network to reach the colo site.
- Data packets are tag with the customer's VLAN id (C-tag)
- The same packet is tagged with the service provider tag (S-tag) while traversing through the telco's shared backbone network
- At the colo site the S-tag is stripped and data packet is left with the C-tag to target the specific VLAN
- Private hosted zones - have to linked/associated with VPC.
- The VPC's can be in the same or different account.
- Use the below command to link a VPC
create-vpc-association-authorization
associate-vpc-with-hosted-zone
.0 - network
.1 - router
.2 - DNS
.3 - reserved by AWS
last address -- broadcast address
Cost for Data Transfer
IPv6 VPC CIDR: /56 and IPv6 SUBNET CIDR: /64
ECMP - Equal Cost Multipathing [gist: use all the available routes instead of routing only via the preferred route] Ref: https://www.youtube.com/watch?v=KICp-9yXOT0
- Each VPN connection have 2 tunnels
- Each tunnels have 2 SA's (security assertions). Hence 4 SA's for each VPN connection.
VPN Evolutions:
VPN Site-Site VPN --> Transit VPC (deploy EC2 based client VPNs) --> Transit Gateways
* Must have resources to
1. Authenticate
2. Authorize
- Site to Site VPN
- OpenVPN based client VPN
local route is prefered over specific route in a vpc
traffic from VPC and DX -- A more specific route is selected e.g: /24 as against /16 network
