High Availability: Transit VPC — AWS
This blog describes the High Availability aspects of Transit VPC. To know more about Transit VPC basic concepts click here.
There is nothing perfect in this world. If you set up most of your core services in AWS and if there is no redundancy setup there will be a chance of failure. To avoid failure you need to set up some high-availability configurations to make sure that all the time these services are available for everyone from everywhere.
Launching a Cisco CSR 1000v in a single instance is not a best practice. There will be a chance of a failure of the instance. The failures would be like a loss of network connectivity, loss of power to the system, software issues on the physical host, hardware issues on the physical host that impacts network reachability, incorrect networking or startup configuration, exhausted memory, or corrupted file system.
To overcome these cases, you need to configure a multi-AZ setup. For that, you distribute your instances across multiple Availability Zones so that even if one instance fails, you can design your application such that an instance in another Availability Zone can always handle requests (Figure — 1). To know more about Amazon Regions and Availability Zones click here.
Using a multi-AZ setup, you need to configure two AWS-managed VPN connections from every spoke VPC to the VPN appliance in Transit VPC. The customer gateway of the one VPN will be the Elastic IP of the Cisco CSR of AZ 1 and another customer gateway will be the EIP of the Cisco CSR on AZ 2. And from on-premises, you need to initiate two VPN connections. One goes to Cisco CSR in AZ 1 and the other to Cisco CSR in AZ 2 (Figure — 2).
The Cisco CSR will act as active-active and also by default both will be in load-sharing mode.
To know about the AWS-managed VPN setup on Spoke VPCs clicks here.
To know the setup of the VPN connection between Transit VPC and on-premises DC click here.
