We introduce AWS Transit Gateway and its functionalities, such as routing domains, attachments, and propagation. We offer a hands-on lab for developing an architecture that provides isolation between environments like production and dev environment. Further, we design an Outbound Amazon VPC for centralized internet access for outbound URL filtering, or data loss prevention scenarios. We conclude by demonstrating the integration of AWS Direct Connect gateway with AWS Transit Gateway.

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Simplify and secure your overall
network architecture at scale
Bhavin Desai
Sr. Solutions Architect (Network Specialist)
Amazon Web Services
F N D 3 1 8

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
What is AWS Transit Gateway?
Lab 100: Flat—All Prod Amazon Virtual Private Cloud (Amazon VPCs) full
mesh
Lab 200: Isolated—Prod and Dev VPCs isolation
Lab 300: Shared Services—Isolated Prod and Dev with shared services
VPC
Lab 400: Centralized outbound internet for Prod and Dev VPC
Demo: How AWS Direct Connect gateway and AWS Transit Gateway work

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is the AWS
Transit Gateway?

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Introducing:AWSTransitGateway
AWS Region
AWS Transit Gateway
ENIs
VPN
Routing domain
Routing domain
DX Gateway
Regional service
Scalable
Flexible routing

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
https://tinyurl.com/y3kf2t5f

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Prod

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Flat:All ProdAmazonVPCscommunication
AWS Transit Gateway
Routing domain for Prod
Route Destination
10.0.1.0/24 vpc-att-1xxx
10.0.2.0/24 vpc-att-2xxx

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Prod Dev

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IsolatedProd and DevAmazonVPCs
AWS Transit Gateway Route Destination
10.0.1.0/24 vpc-att-1xxx
10.0.2.0/24 vpc-att-2xxx
Routing domain for Prod
Route Destination
10.0.3.0/24 vpc-att-3xxx
10.0.4.0/24 vpc-att-4xxx
Routing domain for Dev

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Prod
Dev shared services

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IsolatedProdandDevwithsharedservicesAmazonVPC
AWS
Transit
Gateway
Route Destination
10.0.1.0/24 vpc-att-1xxx
10.0.2.0/24 vpc-att-2xxx
10.0.5.0/24 vpc-att-5xxx
Routing domain for Prod Routing domain for Dev Routing domain for shared
services
Route Destination
10.0.3.0/24 vpc-att-3xxx
10.0.4.0/24 vpc-att-4xxx
10.0.5.0/24 vpc-att-5xxx
Route Destination
10.0.1.0/24 vpc-att-1xxx
10.0.2.0/24 vpc-att-2xxx
10.0.3.0/24 vpc-att-3xxx
10.0.4.0/24 vpc-att-4xxx
10.0.5.0/24 vpc-att-5xxx

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Prod and Dev

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Centralizedoutbound internet withNATgateway
10.0.3.0/24
Outbound VPC
AWS Transit Gateway
Spoke VPC route table Outbound VPC route table
VPC attachment route table, per AZ
Apply SNAT
outbound to the
internet
Route Destination
0.0.0.0/0 vpc-att-outbound
Routing domain for
Amazon VPC
Route Destination
10.0.1.0/24 vpc-att-1xxx
10.0.2.0/24 vpc-att-2xxx
Routing domain for
outbound internet
Route Destination
0.0.0.0/0 ngw-xxx
Route Destination
10.0.2.0/24 Local
0.0.0.0/0 tgw-xxx
Route Destination
10.0.3.0/24 Local
10.0.0.0/8 tgw-xxx
0.0.0.0/0 igw-xxx

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DX gatewaywithAWSTransitGateway
Route
tables
Route
tables
AWS Transit Gateway
DX gateway attachment
• DX gateway (DXGW)
• Attach transit virtual interface (VIF) to DXGW
• Associate AWS Transit Gateway to DX gateway
• List the network prefixes that you want to advertise to
on premises
Benefits
• Use dedicated high bandwidth of 1G and 10G DX
connections
• Failover between DX and AWS Site-to-Site VPN
• Connectivity from DX co-locations
WAN

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

19. Thank you!
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bhavin Desai
bhavind@amazon.com

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.