Successfully reported this slideshow.
Your SlideShare is downloading. ×

[NEW LAUNCH!] Introducing AWS Transit Gateway (NET331) - AWS re:Invent 2018

Ad

© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IntroducingAWSTransitGateway
Steve Seymour
Princ...

Ad

© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
A new service that allows customers to interconn...

Ad

© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Check these out next

1 of 110 Ad
1 of 110 Ad

[NEW LAUNCH!] Introducing AWS Transit Gateway (NET331) - AWS re:Invent 2018

Download to read offline

To deliver your applications to millions of users you need to scale your network across thousands of VPCs. AWS Transit Gateway helps scale your workloads and vastly simplifies how you connect your AWS networks. AWS Transit Gateway also makes it easier to connect your on-premises networks across those VPCs. Using secure operational controls, you can implement and maintain centralized policies to connect Amazon VPCs with each other and with your on-premises networks. This session will enable you to get started quickly and get an insight into the various capabilities that AWS Transit Gateway introduces.

To deliver your applications to millions of users you need to scale your network across thousands of VPCs. AWS Transit Gateway helps scale your workloads and vastly simplifies how you connect your AWS networks. AWS Transit Gateway also makes it easier to connect your on-premises networks across those VPCs. Using secure operational controls, you can implement and maintain centralized policies to connect Amazon VPCs with each other and with your on-premises networks. This session will enable you to get started quickly and get an insight into the various capabilities that AWS Transit Gateway introduces.

Advertisement
Advertisement

More Related Content

Slideshows for you

Similar to [NEW LAUNCH!] Introducing AWS Transit Gateway (NET331) - AWS re:Invent 2018

Advertisement

More from Amazon Web Services

Advertisement

[NEW LAUNCH!] Introducing AWS Transit Gateway (NET331) - AWS re:Invent 2018

  1. 1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. IntroducingAWSTransitGateway Steve Seymour Principal Solutions Architect AWS N E T 3 x x Thomas Spendley General Manager – Transit Gateway & VPN AWS @sseymour
  2. 2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. A new service that allows customers to interconnect thousands of Virtual Private Clouds (VPCs) and on-premises networks.
  3. 3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  4. 4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWSTransitGateway • Interconnecting VPCs at scale • Consolidating edge connectivity • Flexibility with routing domains
  5. 5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. InterconnectingVPC’satscale - Peering AWS Cloud
  6. 6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. InterconnectingVPC’satscale - Peering AWS Cloud
  7. 7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. InterconnectingVPC’satscale –TransitGateway AWS Cloud
  8. 8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Consolidating EdgeConnectivity – MultipleVPN’s On-Premise AWS Cloud
  9. 9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Consolidating EdgeConnectivity – MultipleVPN’s On-Premise AWS Cloud
  10. 10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Consolidating EdgeConnectivity –SingleVPN’s On-Premise AWS Cloud
  11. 11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Consolidating EdgeConnectivity – ResilientVPN’s? On-Premise AWS Cloud
  12. 12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Consolidating EdgeConnectivity – ResilientVPN’s On-Premise AWS Cloud
  13. 13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Consolidating EdgeConnectivity – ResilientVPN’s On-Premise AWS Cloud
  14. 14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  15. 15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Scenario • Multiple VPC’s • Any to any communication • Sharing a single VPN Connection On-Premise AWS Cloud
  16. 16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. FourVPC’s
  17. 17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. CreateaTransitGateway
  18. 18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. CreateaTransitGateway
  19. 19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. CreateVPCAttachments
  20. 20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. CreateVPCAttachments
  21. 21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. ViewVPCAttachments
  22. 22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. TransitGatewayRouteTable
  23. 23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. UpdateVPC RouteTables
  24. 24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. TestConnectivity
  25. 25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. CreateaVPNAttachment
  26. 26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Download theConfiguration
  27. 27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Complete –VPNUP
  28. 28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Complete –VPCto theCGW viaVPN
  29. 29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Complete – viewfromtheCGW
  30. 30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. CLIexample – awsec2create-vpn-connection • --customer-gateway-id • --type • --transit-gateway-id • --options • StaticRoutesOnly • TunnelOptions • TunnelInsideCidr • PreSharedKey • TunnelInsideCidr • PreSharedKey Just the same as a VGW based VPN!
  31. 31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  32. 32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWSTransitGatewaykeyconcepts 1) Attachments 2) Route Tables i. Association ii. Propagation
  33. 33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments
  34. 34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments–VPC’s att-red att-blue
  35. 35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments– ‘associated& propagated route table’ att-red att-blue
  36. 36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments– ‘associated& propagated route table’ att-red att-blue
  37. 37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments– ”associated”route table att-red att-blue
  38. 38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments– “propagation” of routes att-red att-blue
  39. 39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments–TGW RouteTableiscomplete att-red att-blue
  40. 40. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Attachments– butwhatabout theVPC’s? att-red att-blue
  41. 41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. TheDefault On-Premise AWS VPN 10.99.99.0/24 via BGP 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP
  42. 42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  43. 43. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. WhatifwehadtwoTGW route tables ?
  44. 44. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Or three? On-Premise AWS VPN
  45. 45. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Routing Domains 10.99.99.0/24 via BGP On-Premise 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP AWS VPN att-red tgw-rtb-c
  46. 46. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Routing Domains 10.99.99.0/24 via BGP On-Premise 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP AWS VPN att-blue tgw-rtb-c
  47. 47. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Routing Domains 10.99.99.0/24 via BGP On-Premise green tgw-rtb-c tgw-rtb-a tgw-rtb-b10.1.0.0/16 via BGP 10.2.0.0/16 via BGP AWS VPN
  48. 48. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Routing Domains On-Premise AWS VPN 10.99.99.0/24 via BGP 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP
  49. 49. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. RouteTables • Enable you to define the ‘next-hop’ (Attachment) • You can place static entries into a route table • You can create ‘blackhole’ routes • Static/Blackhole entries take precedence over propagated routes
  50. 50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. RouteTables • By default, a TGW has one route table • By default, all attachments are associated to the same route table • By default, all attachments propagate to the same route table By default, everything can route to everything
  51. 51. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. RouteTables • You can have multiple route tables in a TGW • Attachments can only be associated with one route table • Attachments can propagate their routes to multiple route tables With configuration you have complete control of routing
  52. 52. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Howtothinkabout Routing • Consider traffic flow in both directions • What decision is made about the ‘next-hop’ • Helps to visualize each hop in the path
  53. 53. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Routing Domains On-Premise AWS VPN 10.99.99.0/24 via BGP 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP
  54. 54. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. On-Premise 10.99.99.0/24 via BGP Followtheroutes … 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP
  55. 55. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise 10.99.99.0/24 via BGP Followtheroutes …
  56. 56. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise 10.99.99.0/24 via BGP Followtheroutes …
  57. 57. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise 10.99.99.0/24 via BGP Followtheroutes …
  58. 58. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise 10.99.99.0/24 via BGP Followtheroutes …
  59. 59. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise Followtheroutes … 10.99.99.0/24 via BGP
  60. 60. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.99.99.0/24 via BGP 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise Followtheroutes …
  61. 61. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. TransitGatewayArchitectures • Any-to-Any – the default • Shared edge connectivity • Isolation?
  62. 62. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise 10.99.99.0/24 via BGP Isolation
  63. 63. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. 10.1.0.0/16 via BGP 10.2.0.0/16 via BGP On-Premise 10.99.99.0/24 via BGP Isolation
  64. 64. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. OtherTransitGatewayArchitectures • Any-to-Any – the default • Shared edge connectivity • Isolated VPC’s • Shared VPC’s • Multiple Transit Gateway’s on a VPC • Direct Connect (using VPN over Public Virtual Interfaces) • High Bandwidth VPN connectivity – more than 1.25Gbps • Centralized egress Firewalls or NAT Gateways • Centralized access to Interface Endpoints / PrivateLink • Using VPN to inject routes and ECMP over appliances Thursday, November 29th NET402 : Transit Gateway : Reference Architectures for Many VPC’s 12:15 – 13:15 | Mirage, Mirage Events Center B
  65. 65. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  66. 66. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. VPCAttachment • Transit Gateway is a Regional Object • Single target for VPC Route Tables • However – you need to identify the AZ’s you are using • Which subnets should you use? • One per AZ • Create new subnets • Allows granular control of ‘next-hop’ for traffic entering the VPC • Can use existing subnets if needed
  67. 67. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Region
  68. 68. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Region Subnet Subnet Subnet PUBLIC
  69. 69. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Region Subnet Subnet Subnet Subnet Subnet Subnet PRIVATE
  70. 70. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet Subnet Subnet Subnet Subnet Subnet Subnet CONNECTIVITY
  71. 71. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet Subnet Subnet Subnet
  72. 72. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet Subnet Subnet Subnet
  73. 73. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet Subnet Subnet Subnet
  74. 74. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet Subnet Subnet Subnet
  75. 75. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet Subnet Subnet Subnet
  76. 76. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  77. 77. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet Subnet Subnet Subnet
  78. 78. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Region Subnet Subnet Subnet Subnet Subnet Subnet Subnet 50 10.1.0.0/24 SubnetSubnet TGW
  79. 79. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Theviewfrom aVPC VPC – 10.1.0.0/16 Subnet Region Subnet Subnet Subnet Subnet Subnet Subnet Subnet TGW Subnet 50 10.1.0.0/24
  80. 80. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nexthop routing – NATGateway • What about specifying a target of the NAT Gateway in the Connectivity Route Table? VPC – 10.1.0.0/16 SubnetSubnet static
  81. 81. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nexthop routing – NATGateway • What about specifying a target of the NAT Gateway in the Connectivity Route Table? VPC – 10.1.0.0/16 SubnetSubnet
  82. 82. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nexthop routing – NATGateway • Return path? VPC – 10.1.0.0/16 SubnetSubnet
  83. 83. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Inbound routing -Nexthop • Consider AZ Independence • Separate ‘inbound’ route table for each TGW attached subnet • Separate Target per AZ
  84. 84. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Route53Resolver,Interface Endpoints & PrivateLink VPC – 10.2.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet
  85. 85. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Route53Resolver VPC – 10.2.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet
  86. 86. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. VPCInterface Endpoints VPC – 10.2.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet
  87. 87. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. PrivateLinkEndpoints VPC – 10.2.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet
  88. 88. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Route53Resolver,Interface Endpoints & PrivateLink VPC – 10.2.0.0/16 Subnet Region Subnet Subnet TGW Subnet Subnet Subnet
  89. 89. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. NextHop Routing – InterfaceEndpoints & PrivateLink • No routing configuration required! • The endpoints are within the VPC CIDR Range • DNS needs to resolve to the Interface Endpoints • Consider using Route 53 Resolver Endpoints
  90. 90. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nexthop routing – “Middle Box” • Inbound Route table with a target of an EC2 ENI • Middle box hosted in a different subnet • Outbound Route table with target of TGW • Single Point of failure! • Could match the NAT-GW pattern and deploy AZI • Traffic flow may be asymmetric!
  91. 91. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nexthop routing – “Middle Box” VPC – 10.1.0.0/16 SubnetSubnet tgw M eni-M
  92. 92. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS VPN Alternatively– useVPN VPC AWS VPN
  93. 93. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  94. 94. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. VPNAttachments • Standard AWS VPN configuration options • Dynamic (BGP) • Static • Download configuration examples via Console • Equal Cost Multi-Pathing (ECMP)
  95. 95. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Whatis ECMP? • Multiple VPN Connections – each supports 1.25Gbps • Advertise the same IP Prefix over all connections • This creates Multiple paths – with the same ‘cost’ • Equal Cost Multi-Pathing • Enables scaling up of VPN bandwidth • Used for connectivity to on-premises networks • Used for middle-box, marketplace appliances / service insertion
  96. 96. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. DNS • DNS Resolution is supported for all VPC’s attached to the TGW • Supports resolving ‘public’ DNS names to Private IP’s • Route 53 Resolver Endpoints
  97. 97. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-Account process • Owner creates a Transit Gateway • Using Resource Access Manager (RAM) - creates a resource share • Include the Transit Gateway in the resource share • Specify the principals who can use it • Specific AWS accounts • Accounts within a particular AWS Organization or OU
  98. 98. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Multi-Account process • Participant creates an Attachment against the shared Transit Gateway • Owner accepts attachment (or auto-accept) Note – The participant cannot modify route tables
  99. 99. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. ResourceAccessManager (RAM)
  100. 100. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Integration withotherAWSServices Flow logsVPN Connection
  101. 101. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Pricing • Billed per hour, per attachment • For Multi-account configurations, billing starts when the attachment is accepted. • Data processing charges apply for each gigabyte sent from an Amazon VPC or AWS Site-to-Site VPN to the AWS Transit Gateway. $
  102. 102. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Region availability Available now in – • US East (N. Virginia) • US East (Ohio) • US West (N. California) • US West (Oregon) • EU (Ireland) • Asia Pacific (Mumbai) Other regions coming soon!
  103. 103. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Limits Number of AWS Transit Gateway attachments 5,000 Number of Routes 10,000 Number of Route Tables 20
  104. 104. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
  105. 105. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Future Plans • Direct Connect Gateway Attachments • Transit Gateway Inter-Region Peering • Additional advanced routing features
  106. 106. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWSTransitGateway • Easier connectivity • Better visibility and control • On-demand bandwidth • Routing • Edge connectivity • Feature interoperability • Monitoring • Security
  107. 107. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Wednesday, November 28th NET209-L : Leadership Session: Networking 13:00 – 14:00 | Venetian, Level 2, Venetian E Relatedbreakouts Thursday, November 29th NET402 : Transit Gateway : Reference Architectures for Many VPC’s 12:15 – 13:15 | Mirage, Mirage Events Center B Friday, November 30th NET304 : AWS VPN Solutions 10:45 – 11:45 | Venetian, Level 2, Venetian F
  108. 108. Thank you! © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Steve Seymour @sseymour Thomas Spendley
  109. 109. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

Editor's Notes

  • STEVE
    Good morning – welcome to this session on the newly announced AWS Transit Gateway.
    My name is Steve Seymour, I’m a Principal Solutions Architect at AWS and one of our Networking Specialists.
    This is Thomas Spendley, he is the General Manager for Transit Gateway and our VPN Service.
    Lets get this out of the way now. This is a Networking session. It’s going to involve Routes and that’s the correct way to say it. I feel though that with Thomas co-presenting his own service with me up here, I should show some respect and at least try to say rowte a few times. We’ll see!
    We are both looking forward to sharing the details about a new service that the team have been working on for quite a while and that we know our customers will be excited to use.
  • STEVE
    So lets jump into it.
    You may have seen that we have some new Icons – and if not, I think you can decipher the meaning here.
    If you take the AWS Cloud and need the ability to provide full routing functionality – the result is AWS Transit Gateway.
    This was announced last night by Peter in his Monday night session and is now generally available for use.
    It’s a new service that allows customers to interconnect thousands of VPC’s and on-premises networks.
  • THOMAS
    Ok, so what is Transit Gateway
  • THOMAS
    - AWS Transit Gateway is not a physical device – it’s a fully distributed and managed AWS Service.
    - It has the capabilities you’d expect to see in order to interconnect thousands of VPC’s, cross accounts, at scale.
    - It allows you to make very simple or very complex routing decisions based your requirements.
    - It can also help simplify how you share connectivity from your on-premises environments to your VPCs, for example using AWS VPN.
    - It provides flexibility with the use of multiple route tables – creating the concept of routing domains which we will talk about more later.
  • STEVE
    Ok, so lets examine at a very high level how Transit Gateway could immediately help with some of the Architectures we see you as our customers deploying.
    Firstly, lets consider a scenario where you have multiple VPC’s deployed – in the same or in multiple accounts
  • STEVE
    Assuming you wanted all 4 of these VPC’s to communicate with each other, you would use VPC Peering to build a full mesh of connectivity between them. This doesn’t introduce any bandwidth limits and is very simple to setup – but you can see that even with just four VPC’s, we have 6 Peering connections to create, accept and configure routing for.
  • STEVE
    When we introduce Transit Gateway into this scenario, it’s as simple as attaching all four VPC’s to the Transit Gateway and they can all reach each other. Further more, we can keep adding VPC’s with a single attachment API call and join them into this fully routed environment.
  • STEVE
    Lets take that same scenario with the full mesh peering and extend that to connect back to an on-premises network via VPN. We are showing a single Customer Gateway – a router – here.
  • STEVE
    Well, we need to create an AWS VPN Connection from a VGW from each VPC back to the customer gateway.
    Of course, each VPN Connection is two tunnels for resilience but I’m showing a single line here representing that because all the tunnels are terminating on the same customer gateway.
    As we add more VPC’s to the environment, we now need to create more VPN tunnels – which adds increased complexity and configuration requirements for your network.
  • STEVE
    Now, with the Transit Gateway, this is hugely simplified. We can simply create a single VPN Connection (still two tunnels) from the customer gateway to the transit gateway and have full access to all of the VPC”s that are attached.
  • STEVE
    But of course, if there are two tunnels with resilience on the AWS side, the best practice deployment is to build resilience on the customer gateway side of the VPN’s too.
  • STEVE
    … which of course means two customer gateways and another VPN connection per VPC.
    This is quickly multiplying for a relatively simple scenario here with just four VPC’s and two Customer Gateways.
  • STEVE
    As you might have guessed by now, this becomes much simpler with the Transit Gateway where you simply add one additional VPN connection to have that full resilient connectivity to all of your VPC’s in the region.
  • THOMAS

    TRANSITION - Ok, so I think you have the concepts – lets move from theory into practice and see what it will take to build the components of a Transit Gateway.
  • THOMAS
    - In this scenario we have four VPC’s that are being used for development - each needing to communicate with each other.
    - The whole environment needs to be connected back to our on-premise network perhaps to reach a code repo or be available for users to test against.
    - We may need to tear down these VPC’s and create new ones on the fly and don’t want to have the potential delays of building out new VPN’s or re-configuring of our VPN router.
  • THOMAS
    Lets start by simply creating four VPC’s in our development account – all within the 10/8 range – 10.1, 10.2, 10.3 and 10.4.
    These VPC’s have been created with subnets in two availability zones.
  • THOMAS
    The first step therefore is to create the new Transit Gateway itself.
    You can find this in the VPC console and other than providing a name, we are going to leave all of the defaults for this – our first Transit Gateway.
  • THOMAS
    -Now once the TGW has been successfully created, we see it’s state as available.
    -The one thing to remember is that Transit Gateway is a regional object, it’s highly available and created without single points of failure.
    -If you were in some of the sessions last year – you might be familiar with the ‘HyperPlane’ technology we mentioned – well Transit Gateway is built using that same scalable and highly available building block.
  • THOMAS
    -Next, we need to attach our VPC’s. As you can see, this is as simple as choosing the TGW and then providing a subnet for each availability zone.
    -It is important to remember that TGW is a regional object with Zonal attachments. You only need to connect only ONE subnet for each availability zone in that VPC.
  • THOMAS
    We repeat that attachment process three more times – one per VPC – very quick and simple.
  • THOMAS
    So if we now take a look in the console, we can see all four VPC attachments now in the available state and the various default parameters being applied to each attachment at the bottom.
  • THOMAS
    -Lets jump over to the Transit Gateway Route Table section and take a look there.
    -What you should immediately see is that the CIDR ranges for our VPC’s are all listed with their associated attachment ID.
    -This confirms that the transit gateway has a route to each of those VPC’s.
  • THOMAS
    -Finally, we always need to consider the return path so lets update the route tables in each of our VPC’s to send traffic for all 10/8 networks via the newly attached TGW.
    -Just like other target types, you simply enter the TGW ID into the target field and you are good to go.
  • THOMAS.
    -Now, to prove this is working, I launched an EC2 instance in each of our VPC’s – I put them in the first subnet with .50 as the last octet to keep things simple.
    -I then logged into the 10.1 EC2 instance and pinged the other three – as you can see, all of them responded.
    -These are real screen shots from a real deployment.
    - It really did only take the steps I’ve went through to establish any-to-any connectivity.
  • THOMAS
    -Now in our original scenario, we talked about the requirement to connect to an on-prem network via VPN.
    -As you might have noticed, this is simply another attachment type.
    -We choose VPN and then select either an existing defined Customer Gateway or a new one.
    -The definition of the Customer Gateway identifies the remote IP Address and AS Number for BGP.
  • THOMAS
    After it’s created, we switch to the VPN console and simply download our configuration template as normal and apply it to our on-premise router.
  • THOMAS
    Looking back at the Transit Gateway Route table, once the VPN Tunnels come up and BGP is established, we see the new 10.99 prefix present in the route table that is coming from our on-prem network via VPN
  • THOMAS
    -Jumping back to our test EC2 instance in the 10.1 VPC, we see we can now ping an on-premise host through the VPN using it’s 10.99 address.
    -We don’t need to do any other configuration here, it’s simply immediately reachable.
  • THOMAS
    From the Customer Gateway – which is the on-prem router - if we take a look at it’s BGP route table, we can see the CIDR range being received for each of the attached VPC’s and two paths via the two tunnels that are automatically created for an AWS VPN Connection.
  • THOMAS
    -As you’d expect, all of the actions we just did in the console can be done via the AWS Command Line interface or direct via our API’s.
    -I’m showing you the
    existing VPN connection API call – all that’s changed is that you can now pass it a Transit Gateway parameter rather than a Virtual Private Gateway.
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE

    TRANSITION – So, we saw with Transit Gateway you can create routing policies which allow you to build an any-to-any topology and even share a VPN connection with any of those VPCs. But, what if you don’t want east-west traffic between VPCs.
  • STEVE

    - Back to Dave example, how do I get to an instance in the 10.2 VPC?
    I look at my VPC1 route table and see an entry for the 10/8 network back to the Transit Gateway
  • STEVE

    But when I look at the TGW route-table-A, I realize there is no path to the 10.2 network so the packet is dropped.
    As you can see there is no way for the traffic to get to VPC 10.2 through TGW but I was still able to share my VPM connection with both VPCs
  • STEVE

    TRANSITION – while each of the scenarios can get you started, to get into more complex network setups, we have a session with Nick Matthews on Thursday 12:15-1:15. You will learn how to build complex TGW configurations which allow you to 1) Use a 3rd party partner appliances for Packet Inspection 2) Centralize Egress traffic using a NAT gateway 3) Create High Bandwidth VPN connectivity using ECMP / Equal-Cost Multi-Pathing to your on premise network or network appliances in your VPC.
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE

    So lets revisit our earlier explorer …
    She followed the path from the TGW Route table via the attachment and is now in the VPC.
    She actually enters the VPC via one of these ENI’s so when looking for the next hop, it’s actually the route table for those subnets that she consults.
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • STEVE
  • THOMAS

    So, what other features does a Transit Gateway provide?
  • THOMAS

    As I showed you earlier, the process of attaching a VPN connection to a Transit Gateway is simple. All that’s changed is that you now pass a Transit Gateway rather than a Virtual Private Gateway parameter.
    A long time ask from our customers is the ability to deliver greater than 1Gig IPSec bandwidth for AWS VPN.
    With a Transit Gateway, customers can use Equal Cost Multi-Pathing (ECMP) to do that.
  • THOMAS

    Equal-cost multi-pathing is a routing strategy where next-hop packet forwarding is to a single destination occurs over multiple "best paths" 
    By advertising the same IP Prefix over all VPN connections, the Transit Gateway will distribute your traffic across those connections.
    For example, a customer who wants a backup for a 10Gig Direct Connect could establish 8 VPN connections with ECMP to provide equivalent bandwidth.
  • THOMAS

    TRANSITION – Transit Gateway also supports DNS.

    If you have been using DNS resolution for for public names to private addresses over VPC peering, they will continue to work over Transit Gateway attachments.
    Also, with the newly launched Route 53 resolver endpoints service you can manage your DNS infrastructure in a centralized service VPC and access it from the attached VPCs and VPN connections.

  • THOMAS

    TRANSITION – To be able to connect VPCs across multiple accounts, the Transit Gateway uses the newly launched Resource Access Manager (RAM) service. RAM is new a service that enables sharing of AWS resources across different accounts in a centralized way.

    Step 1, the Transit Gateway Owner Enables sharing by creating a resource share in (RAM) and specifies the principals for who can use it.
    It is important to remember that Principals must accept the invitation of this resource share if they’re not in the same organization.
  • THOMAS

    Step 2, the VPC Owner (the Participant) Requests to attach to the Transit Gateway.
    Since the Transit Gateway sharing enabled, the Participant account can call describe-transit-gateways. They would call create-transit-gateway-vpc-attachment to attach their VPCs.
    Step 3, the Transit Gateway Owner Approves or Rejects the attachment request from the Participant.
    The Transit Gateway owner has the ability to see all of these these attachments requests using the describe-transit-gateway-vpc-attachments.

    It is important to remember that while Participants can attach to a Transit Gateway, the can not modify the Transit Gateway route tables.
    This allows for example a Network team to own the Transit Gateway and manage connectivity from on-premise to VPCs while Application teams can attach to a Transit Gateway to leverage shared network resources. They can consume the network but not change it.
  • THOMAS

    TRANSITION – here is how you would create a new resource-share from the RAM console.

    - The first step is to create a new Resource Share itself by providing a name.
    - You would then select the resource you want to share, in this case the Transit Gateway.
    For Principals, you would provide the accounts or OUs you want to enable sharing with.
    It is important to remember here that you can share with any AWS account or your organization.

    We now have a new resource-share that can be centrally managed.

    .
  • THOMAS

    TRANSITION –Transit Gateway is a fully managed service integrate seamlessly with other AWS services like CloudFormation, CloudWatch, Flow Logs

    At launch Transit Gateway will support CloudFormation templates. This allows you to easily automate your network build process.
    Cloudwatch metrics supports traffic counters like packets in /out and dropped packets.
    You can use Flow Logs by enabling flow logs on the attachment ENIs in the VPC.
  • THOMAS

    TRANSITION - as far as Transit Gateway Pricing

    You will be billed hourly for each attachment to a Transit Gateway.
    Hourly billing will also start when the AWS Transit Gateway owner accepts your attachment and it stops when the attachment is deleted.
    Data processing charges apply for each gigabyte sent from an attachment to the Transit Gateway.
    Each partial hour consumed is billed as a full hour.
  • THOMAS

    We are now launched in SIX regions with more to follow by EOY!
  • THOMAS

    TRANSITION – the Transit Gateway was designed to support a large number of attachments and number of routes.

    With 5,000 attachments you can create a large network topology that suits your organizational, customer, or partner needs.
    A VPC can be connected up to 5 Transit Gateways
    You can create up to 20 Route Tables aka Routing Domains which allows you to create routing policies to either Share or Isolate network resources.
  • THOMAS

    TRANSITION – so, what else do we have in the works for Transit Gateway?
  • THOMAS

    You can use Public Direct Connect with AWS VPN to attach to a Transit Gateway
    We are working to provide Private Direct Connect support through Direct Connect Gateway in Q1 2019.
    We will be providing Cross Region support in 2019. This will allow you to build a global network that connects TGW-TGW across regions.
    For example, a branch can establish a private VPN connection to the US East region in N. VA, send traffic to the Asia Pacific region ENCRYPTED out to another private VPN connection to a branch in Mumbai.
    We are planning to support other advanced routing features such as Policy Based Routing, this allows routing decisions based on properties of the packet other than the destination address.
  • THOMAS


    Routing
    AWS Transit Gateways supports dynamic and static layer 3 routing between Amazon Virtual Private Clouds (VPCs) and site-to-site VPN. Routes determine the next hop depending on the destination IP address of the packet, and can point to an Amazon VPC or to a VPN connection.
    Edge connectivity
    You can create VPN connections between your AWS Transit Gateway and on-premises gateways using site-to-site VPN.
    You can create multiple VPN connections that announce the same prefixes and enable Equal Cost Multipath (ECMP) between these connections. By load-balancing traffic over multiple paths, ECMP can substantially increase the bandwidth.
    Amazon VPC feature interoperability
    AWS Transit Gateway enables the resolution of public DNS hostnames to private IP addresses when queried from Amazon VPCs that are also attached to the AWS Transit Gateway.
    An instance in an Amazon VPC can access a NAT gateway, Network Load Balancer, AWS PrivateLink, and Amazon Elastic File System in others Amazon VPCs that are also attached to the AWS Transit Gateway.
    Monitoring
    AWS Transit Gateway provides statistics and logs using AWS services, such as Amazon CloudWatch and Amazon VPC Flow Logs. You can use Amazon CloudWatch to get bandwidth usage between Amazon VPCs and a VPN connection, packet flow count, and packet drop count. You can also enable Amazon VPC Flow Logs on AWS Transit Gateway so you can capture information on the IP traffic routed through the AWS Transit Gateway.
    Security
    AWS Transit Gateway is integrated with Identity and Access Management (IAM), enabling you to manage access to AWS Transit Gateway securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to the AWS Transit Gateway.
  • STEVE
  • STEVE
  • STEVE

×