This document discusses using AWS Direct Connect to design a network architecture for multiple traffic streams. It describes a use case of a company with multiple AWS accounts that wants to segregate traffic at the network level. A Direct Connect solution is proposed that involves creating a Direct Connect gateway for each account and attaching virtual interfaces from multiple AWS regions to allow separation of traffic while reducing management overhead. The document provides examples of how to set up Direct Connect, connect other accounts, and implement high availability using a second Direct Connect connection.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Designing Network Architectures with Direct
Connect for Multiple Traffic Streams
Sohaib Tahir
Solutions Architect
AWS/SLG
A R C 4 0 6

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
400 Level-Expert:
Sessions are for attendees who are deeply familiar with the topic, have implemented a
solution on their own already, and are comfortable with how the technology works across
multiple services, architectures, and implementations

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Existing knowledge
NET201 – Creating Your Virtual Data Center: VPC Fundamentals and Connectivity Options

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Existing knowledge
NET301 – Extending Data Centers to the Cloud: Connectivity Options and Considerations for Hybrid
Environments
… where they explain how to use VPN & DX?

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The difference between …
DXIPsec VPN

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Example Corp’s use-case:
Example Corp has multiple AWS accounts
Production, Non-Prod and PCI
Want to keep traffic segregated at Network
Minimum management and config overhead
Ability to scale and extend over time
Design highly resilient Hybrid Network

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPN based solution
• VPN connection to each VPC
• Example Corp would achieve traffic segregation
• But think about inherent VPN characteristics
• Number of VPNs = No of VPCs
• Management and configuration of each tunnel
• Scalability would mean more work
• Layer it with redundancy = More complexity

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Direct Connect Solution
• Dedicated, private connection into AWS
• Create private (VPC) or public virtual interfaces to AWS
• Reduced data-out rates (data-in is free)
• Consistent network performance
• Option for redundant connections
• Work with Multiple AWS Regions
• Multiple AWS accounts can share a connection
• Uses BGP to exchange routing information over a VLAN
How can all this meet Example Corp requirements? Lets explore that.

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Public VIF
Colocation Facility – e.g., Equinix SV1
Private VIF VLAN B
VLAN A
AWS Direct
Connect POP
Customer or
Partner Cage
Service Provider
Network
AWS Direct Connect—what’s that?
On-Premises

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Building AWS Direct Connect Solution
• Direct Connect Gateway
• Per each account
• Attach VGWs from multiple AWS Regions
Account

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Direct Connect Solution for Prod Account
• The owner account setup
• A Public VIF
• A Private VIF

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Connecting other accounts
Private Hosted VIFs/VLAN for other accounts
Benefits
• Number of BGP connections = Number of accounts
• In this case configuration is reduced by half
Hosted VIF
VLAN2
Hosted VIF
VLAN3

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Putting it all together
Connect VPCs using VPC Peering

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
HA or Multi-Site Design
Similarly, a second DX can be added
with three additional VIFs to DXGWs

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
HA or Multi-Site Design
Similarly, a second DX can be added
with three additional VIFs to DXGWs

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Announced this week: Transit Gateway

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Summary
• A VIF + Direct connect Gateway per account to achieve
separation of traffic.
• Only 3 BGP connections to configure (4 including Public
VIF)
• Inter-VPC Connectivity using VPC peering.
• Each account can scale up to 10 VPCs/DXGW
• For HA, 3 additional VIFs from a second DX

22. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sohaib Tahir
sohaibt@amazon.com

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Related breakouts
Friday, November 30
NET403 – AWS Direct Connect: Deep Dive
10:45 – 11:45 a.m. | Mirage, Mirage Event Center B, T2

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.