Umesh Kumar
Dec 6, 2018 · 4 min read

AWS re: Invent 2018 had a lot of new services to be called COOL, well if you have satellite( :) ), you don’t need ground datacenter to process data. (ground station). Combination of Robomaker and Alexa can be groundbreaking if used properly. A whole lot of things to talk about. Today, I am writing about a rather less fancy service they launched (CISCO, Where are you), “AWS Transit-Gateway”.

AWS VPC has been one of the strong networking backbone for EC2 to perform the way it does but VPC capabilities don’t always cater to the networking requirements enterprises ask. They always need a central gateway where a firewall has to know & manage what packets are flowing in the environment and how. Ultimately enterprises used third party solutions like CISCO CSR router to achieve this. Read about the earlier AWS Solution — Transit VPC

let’s discuss AWS Transit-gateway and how it works. Below image explains pretty much what it is .

You simply connect each Amazon VPC or VPN or Direct Connect(coming soon) to the AWS Transit Gateway and it will route traffic to and from each VPC or VPN or Direct Connect.

Let’s get to the working of AWS Transit-Gateway.

We had a customer in the past where we deployed CISCO CSR to achieve the transitive nature of the network. They had 4 different external apps hosted in 4 different VPC which needed to communicate privately with another app on-prem through VPN. Their compliance required was there will be just one endpoint for VPN and all of the traffic between apps has to flow through the firewall sitting at a central location (VPC) on AWS. Let’s see how we would deploy this today using the Transit-Gateway.

  1. We have 2 custom VPC’s with each having one subnet. I have created 1 instance in each VPC(subnet). One of the VM is part of 10.0.0.0/16 network (IP:10.0.1.188) and another one being part of 20.0.0.0/16 network (IP:20.0.1.110)
2 Instance running on different VPCs

2. Transit-Gateway is available under the VPC-Dashboard. We will start by creating our first gateway. Enabling DNS support will be useful as finding the applications with their hostname/FQDN. Click create on the bottom right.

Most of the options are auto selected, based on your use you can uncheck the radio button

3. Let’s create Transit-Gateway Attachments now. These attachments are nothing but the connections to VPC’s. We need to create a different attachment for each VPC with the transit-gateway. Each VPC requires to have a separate attachment.

One important thing to note here is the selection of subnets. We can choose which subnets should participate in the transit-gateway attachment.

4. Once we have created the attachments for both VPC, they will be available in this windows.

We choose attachment type as VPC, If we are connecting with the VPN connection, we have to choose customer gateway and specify tunnel details.

5. Now, If you have checked the “default route table association” in the first step, no need to modify the Default RT at transit gateway end but we need to modify the VPC’s route table and create the route via transit-gateway. Remember to modify the route table for both the VPC.

In the Destination column, specify the network range of other VPC (In our case 20.0.0.0/16 since we are creating routes from 10.0.0.0/16 VPC route table

6. The final step, let’s test out connection and ping the 20.0.0.0/16 network from 10.0.0.0/16 network.

Server 1 in VPC 1 with private IP 10.0.1.188 is able to ping Server 2 in VPC 2 with private IP 20.0.1.110

BOOM! No VPC-Perring, We are able to communicate different VPC using the transit-gateway.

Well, interestingly you can share transit gateway with other AWS accounts or AWS Organization using AWS Resource Access Manager

What else about transit-gateway?

BENEFITS

  1. Simplified connectivity
  2. Better visibility and network control
  3. Availability of On-demand network bandwidth

LIMITATIONS

  1. Routing between Amazon VPCs with overlapping CIDRs is not supported.
  2. Spoke VPC can’t refer security group of other spokes connected to the gateway.
  3. Maximum network bandwidth per VPN connection in the transit mesh is limited to 1.25Gbps. You can use ECMP to get higher VPN bandwidth. Bandwidth limit per VPC attachment is 50Gbps burst.

Check this AWSome slide from AWS to understand where transit gateway can be used.

Searce Engineering

We identify better ways of doing things!

Umesh Kumar

Written by

Cloud Architect

Searce Engineering

We identify better ways of doing things!

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade