Managing connectivity between many Amazon Virtual Private Clouds (VPCs) and on-premises networks can be operationally complex and costly. In this tech talk, we will discuss how AWS transit gateway simplifies network architecture, reduces operational costs and improves security. We will also discuss best practices for designing and monitoring a global network using AWS transit gateway and Network Manager.

1. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWSTransit Gateway
Benefits and Best Practices
Nitin Ashok - Technical Account Manager, AWS
Rodrigo Balan - Technical Account Manager, AWS

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
• Motivation for AWS Transit Gateway
• Key Features and Benefits
• Common Use Cases
• Sample Reference Architecture
• Transit Gateway Network Manager
• Best Practices

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Motivation for AWS Transit Gateway

4. © 2020, Amazon Web Services, Inc. or its Affiliates.
What do customers want to do?
Interconnect VPCs and
on-prem networks
Globally scale out
connectivity across regions
Simplify network
configuration and
management

5. © 2020, Amazon Web Services, Inc. or its Affiliates.
What challenges are they facing?
Complex point-to-point
peering does not scale
VPN Bandwidth limitations Monitoring and
Management of routing
configurations is time
consuming

6. © 2020, Amazon Web Services, Inc. or its Affiliates.
VPN connectionCustomer
gateway
AmazonVPC AmazonVPC
AWS Direct Connect
Gateway
VPC peering
VPC peering VPC peering
AmazonVPC AmazonVPCVPC peering
VPN
connection
VPN connection
VPC peering
Before AWSTransit Gateway

7. © 2020, Amazon Web Services, Inc. or its Affiliates.
Before AWSTransit Gateway
VPN
WAN
AWS Direct
Connect
Transit VPC
Dev Prod Dev Prod Dev Prod
Dev Prod Dev Prod Dev Prod

8. © 2020, Amazon Web Services, Inc. or its Affiliates.
Introducing AWSTransit Gateway
Easily interconnect thousands of
VPCs and on-premise networks
On-Premise
Data Center
AWSVPCAWSTransit
Gateway

9. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWSTransit
Gateway
AmazonVPCAmazonVPC
AmazonVPCAmazonVPC
Customer
gateway
VPN
connection
AWS Direct
Connect Gateway
With AWSTransit Gateway

10. © 2020, Amazon Web Services, Inc. or its Affiliates.
Key Features and Benefits

11. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWSTransit
Gateway
Centralized routing polices acrossVPCs and on-premises
Scales to support thousands ofVPCs across multiple accounts
Flexible segmentation and routing rules
Horizontally scalable
Increase connectivity throughput with multiple VPN connections
Simplified management and network visibility
PeerTransit Gateways to provide inter-region VPC connectivity
AWSTransit Gateway: Key Features
Route Multicast traffic betweenVPCs in the same region

12. © 2020, Amazon Web Services, Inc. or its Affiliates.
• Centrally interconnect multipleVPCs across accounts
• One central connection point forVPN and Direct Connect
• Reduce or eliminate need for peer to peer networking
• IncreaseVPN throughput via ECMP routing
• Peer AWSTransit Gateway across regions
• Leverage the AWS Global Network for low latency cross-region
connectivity
• Regional construct reduces blast radius
• Reduces time to configure on-premises connectivity to AWS
• Easily monitor and manage from a central point
• Integrated with CloudWatch andVPC Flow Logs
• Leverage existingVPC security groups and network access control lists
• Centrally manage the networks built aroundTransit Gateways using
Transit Gateway Network Manager
Simplified
Networking
Global
Connectivity
Easy
Manageability
AWSTransit Gateway: Benefits

13. © 2020, Amazon Web Services, Inc. or its Affiliates.
Common Use Cases

14. © 2020, Amazon Web Services, Inc. or its Affiliates.
Use Case – Interconnecting Geographically Dispersed On-
Premise andVPC resources
• Customer with multipleVPCs
• Build applications that span a large number of
VPCs
• Share network services (DNS, Active
Directory, Firewall, IDS)
• Reduce management overhead

15. © 2020, Amazon Web Services, Inc. or its Affiliates.
Use Case – Edge Consolidation
• Share a commonVPN or Direct
Connect Gateway (DXGW) across VPCs
• Reduce time to connect on-premises
resources to multipleVPCs
• No additional customer network
changes required when adding aVPC
to AWSTransit Gateway

16. © 2020, Amazon Web Services, Inc. or its Affiliates.
Use Case – Digital security and threat intelligence
• SharedVPC hosts security tools
• Web application Firewall (WAF), Data
Loss Prevention (DLP), Intrusion
Detection / Protection (IDS/IPS)
• Scales out over native AWS Services

17. © 2020, Amazon Web Services, Inc. or its Affiliates.
Sample Reference Architecture

18. © 2020, Amazon Web Services, Inc. or its Affiliates.
Development Production
Internet
Outbound
URL filtering
NAT gateway
DLP / Proxy
Edge services
WAF / ADC
SD-WAN
VPN / Firewall
IDS / IPS
Firewall / NGFW
Inline services
Shared services
Authentication &
Monitoring
VPN Direct Connect
Account Account Account Account
Administrative accounts
(logging, AWS Organizations,
billing, landing zone)
IAM, Cross-account roles
Route
tables
Route
tables
Transit Gateway
East-West +
North-South
AWSTransit Gateway Reference Architecture
Testing
VPC VPC VPC VPC
VPC
VPC
VPC

19. © 2020, Amazon Web Services, Inc. or its Affiliates.
Transit Gateway Network Manager

20. © 2020, Amazon Web Services, Inc. or its Affiliates.
AWSTransit Gateway: Network Manager
Benefits ofTransit Gateway Network Manager
• Centralize management and monitoring of
networking resources and connections to
remote branch offices
• Define, visualize and manage networks
globally
• Use Route Analyzer to verify routing
configurations
• Integrate with third party SD-WAN solutions
including Cisco, Aruba, Silver Peak and
Aviatrix
• No additional fees for usingTransit Gateway
Network Manager

21. © 2020, Amazon Web Services, Inc. or its Affiliates.
Best Practices

22. © 2020, Amazon Web Services, Inc. or its Affiliates.
Best Practices: Migrate fromTransitVPC to AWSTransit
Gateway
TGW MigratorTool:
• Provides a seamless migration path from the transitVPC solution to AWSTransit Gateway.
Prerequisites:
• TheVPCs cannot have overlapping CIDRs
• You cannot have identical routes pointing to two differentVPCs
• Verify that you have permissions required to work with transit gateways

23. © 2020, Amazon Web Services, Inc. or its Affiliates.
Best Practices: AWSTransit gateway design best practices –
Part 1
• Limit the number of transit gateway route tables unless
your design requires multiple transit gateway route tables
• You do not need additional transit gateways for high
availability, because transit gateways are highly available
by design
• Enable route propagation forAWS Direct Connect gateway
attachments and BGP Site-to-SiteVPN attachments
• Use Border Gateway Protocol (BGP) Site-to-SiteVPN
connections. If your customer gateway device or firewall
for the connection supports multipath, enable the feature

24. © 2020, Amazon Web Services, Inc. or its Affiliates.
Best Practices: AWSTransit gateway design best practices –
Part 2
• Use a separate subnet for each transit gatewayVPC
attachment
• Create one network ACL and associate it with all of the
subnets that are associated with the transit gateway
• Associate the sameVPC route table with all of the subnets
that are associated with the transit gateway
• For multiple Region deployments, we recommend that you
use a unique Autonomous System Number (Amazon-side
ASN) for each of your transit gateways

25. © 2020, Amazon Web Services, Inc. or its Affiliates.
Further reading (blog post)
• Zendesk’s Global Mesh Network: How we lowered operational overhead and cost by
migrating to AWS Transit Gateway
• Working with Route Tables in AWS Transit Gateway
• Scaling VPN throughput using AWS Transit Gateway
• Automating AWS Transit Gateway attachments to a transit gateway in a central account
• Advanced Troubleshooting with AWS Transit Gateway Network Manager Route Analyzer
• Migrate from Transit VPC to AWS Transit Gateway