AWS Direct Connect Deep Dive PDF

AWS Direct Connect Deep Dive
Steve Seymour
Principal Specialist Solutions Architect, AWS
@sseymour
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is AWS Direct Connect ?
AWS Direct Connect
• Dedicated, private connection into AWS

• Create private (VPC) or public virtual interfaces to AWS
• Reduced data-out rates (data-in is free)
• Consistent network performance
• Option for redundant connections
• Work with Multiple AWS Regions
• Multiple AWS accounts can share a connection
• Uses BGP to exchange routing information over a VLAN
• HIPAA Eligible Service
The Toolbox
Virtual Private Cloud VPN Connections
Route Tables Customer Gateway
Internet Gateway AWS Direct Connect
Virtual Private Gateway Direct Connect Gateway
The Toolbox
Virtual Private Cloud
AWS Direct Connect
Virtual Private Gateway Direct Connect Gateway
Global Infrastructure
18 Regions
114 Edge
Locations
54 AZs
Region & No. of Availability Zones
New Region (coming soon) © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Direct Connect
84 Direct Connect Locations (June 2018)
Direct
84 Connect
Locations
AWS Region
Direct Connect
Location
Terminology for physical connections
• Dark fiber, DWDM

• Leased line
• Ethernet private line
• Pseudo-wire
• Point-to-point circuit
• LAN extension
• MPLS/VPLS/IP-VPN/L3-VPN
• MetroE, L2 link, eline, QinQ, EoMPLS
Physical connection
• Cross connect at the location
• Single mode fiber

- 1000Base-LX or 10GBASE-LR
• Potential onward delivery via Direct Connect Partner
• Customer router
1 G/10 G dedicated vs. hosted connections
• 1 G/10 G dedicated ports—‘regular connections’

• Full port speed available to you
• Supports multiple virtual interfaces
• Hosted connections—sub-1G (50 Mbps–500 Mbps)

• Provided on a partner interconnect
• Each hosted connection has defined bandwidth and VLAN
• Each hosted connections supports a single virtual interface
At the Direct Connect Location
Demarcation
AWS Backbone Cross Customer Access Customers Network Access

Network Connect Router Circuit Backbone Circuit
Direct Connect Location

Colocation
Customer
`
Network
AWS Direct Customer

Connect Router
Routers
CORP
Dedicated Port via Direct Connect Partner
Demarcation
AWS Backbone Cross Partner Partner Access Customer

Network Connect Equipment Network Circuit Router

Colocation
Partner Network
AWS Direct
Connect
Routers
CORP
At the Direct Connect Location – via MPLS
Demarcation
AWS Backbone Cross Provider Partner MPLS Access

Network Connect Edge Core Circuit to CE

Colocation
MPLS Core
` ` CE Router
AWS Direct Partner `
Connect PE Router
Routers
CE Router
CORP
Direct Connect—physical connectivity
1) Customer presence in the same DX location
2) Circuit between customer data center and DX location
2) Circuit between customer data center and DX location
3) Service provider network extending to DX location
Direct Connect—resilient & diverse paths
Direct Connect Location 1
AWS Direct
Connect Routers
AWS Direct
Connect Routers
AZ Transit
AWS Direct
Connect Routers
AZ AZ AZ
AZ Transit
AWS Direct
Connect Routers
AZ Transit
AWS Direct
Connect Routers
AZ AZ AZ
AZ Transit
AWS Direct
Connect Routers
Single Direct Connect Location – 2 Connections

Colocation
Service Provider
Network
AWS Direct Customer

Connect Routers
Routers
CORP
Multiple Direct Connect Locations
Colocation
AWS Direct Customer

Connect Routers Routers
Service Provider
Direct Connect Location 2 Network
Colocation
AWS Direct Customer

Connect Routers Routers
CORP
Ordering Process
How to order AWS Direct Connect
1. Select Your Region
2. Create a Connection
3. Receive LOA-CFA
4. Cross Connect
5. Create Virtual Interface
6. Configure Customer Router

3. Receive LOA-CFA
4. Cross Connect

3. Receive LOA-CFA
4. Cross Connect

3. Receive LOA-CFA
4. Cross Connect

3. Receive LOA-CFA
4. Cross Connect

3. Receive LOA-CFA
4. Cross Connect

Link Aggregation Groups (LAGs)
• Multiple 1 G or 10 G ports—but treat them like a single managed connection
• Ports need to be on the same AWS Direct Connect Router (visible in the console)
• A group of ports will be configured and managed as a single connection
• Traffic will load balance across these links, per flow
Link Aggregation Groups (LAGs)
Virtual Interfaces
Public vs. private virtual interfaces
• 802.1Q VLAN & eBGP Session
• Private VIF: connects you to a virtual private cloud (VPC)

… via Direct Connect Gateway to any AWS region
• Public VIF: connects you to public AWS services

… located in any AWS region (except China)
… and anyone else using AWS public IPs
… and managed VPN public IPs
Virtual interfaces (VIFs)
• Public or private
• VLAN & IPs
• VLAN & IPs
• BGP
Private Virtual interfaces
• VLAN & IPs
• BGP
Connect to either—
• A Direct Connect Gateway
Or
• A Virtual Private Gateway
IPv6 over Direct Connect
• IPv6 on Direct Connect—Amazon supplied /125 CIDR

• Accept /64 or shorter prefixes
• Additional peering session on the same VIF for IPv6
• Supported on both public and private VIFs
• IPv6 is supported in VPC
A Private Virtual Interface on 1Gbps Direct Connect
EU-CENTRAL-1
10.3.0.0/16
Direct Connect
Location
Direct Connect (Munich) Customer
Gateway Router
VGW
VLAN + eBGP Session
Virtual Interface 1Gbps
EU-CENTRAL-1
10.3.0.0/16
Direct Connect
Location
Gateway Router
VGW
VLAN + eBGP Session
EU-CENTRAL-1
10.3.0.0/16
Direct Connect
Location
Gateway Router
VGW
VLAN + eBGP Session
EU-CENTRAL-1
10.3.0.0/16
Direct Connect
Location
Gateway Router
VGW
VLAN + eBGP Session
EU-CENTRAL-1
10.3.0.0/16
Direct Connect
Location
Gateway Router
VGW
VLAN + eBGP Session
1 G/10 G dedicated connections
Your Account
Direct Connect Connection

‘Regular Connection’
dxcon-xxxxxx
Port Speed: 1 or 10 Gbps
Your Account
Direct Connect Connection Virtual Interface

dxvif-xxxxxx
‘Regular Connection’ VLAN: 101
dxcon-xxxxxx
Your Account

dxvif-xxxxxx
dxcon-xxxxxx
Port Speed: 1 or 10 Gbps Virtual Interface
dxvif-xxxxxx
VLAN: 102
Your Account

dxvif-xxxxxx
dxcon-xxxxxx
Port Speed: 1 or 10 Gbps Virtual Interface
dxvif-xxxxxx
VLAN: 102
Virtual Interface
dxvif-xxxxxx
VLAN: 103
1 G/10 G dedicated connections, hosted VIF
Your Account Your Other Account
Direct Connect Connection Hosted Virtual Interface

dxvif-xxxxxx
dxcon-xxxxxx
1 G/10 G dedicated connections, hosted VIFs
Your Account Your Other Account
Direct Connect Connection Hosted Virtual Interface

dxvif-xxxxxx
dxcon-xxxxxx
Another Account
Hosted Virtual Interface

dxvif-xxxxxx
VLAN: 102
Hosted connections (sub-1 G)
Partner Account Your Account
’Hosted Connection’
Interconnect dxcon-xxxxxx
VLAN: 101
Port Speed: 50-500 Mbps
’Hosted Connection’ Virtual Interface

Interconnect dxcon-xxxxxx dxvif-xxxxxx
VLAN: 101 VLAN: 101

Interconnect dxcon-xxxxxx dxvif-xxxxxx
VLAN: 101 VLAN: 101

dxcon-xxxxxx dxvif-xxxxxx
VLAN: 102 VLAN: 102
Border Gateway Protocol (BGP)
What is BGP?
• TCP-based protocol on port 179

• BGP neighbors exchange routing information—prefixes
• More specific prefixes are preferred
• Uses Autonomous System Numbers—ASNs
• iBGP—between peers in the same AS
• eBGP—between peers in different AS
• AS_PATH—measure of network “distance”
• Local preference—weighting of identical prefixes
Public virtual interface
• Provides access to Amazon public IP addresses
• Requires public IP addresses for BGP session

• If you can’t provide them, raise a case with AWS Support
• Public ASN must be owned by customer—private is OK
• Global prefixes is the default for new Public Virtual Interfaces
DX public VIF—AS_PATH & NO_EXPORT
“AWS Public Direct Connect advertises prefixes

with a minimum path length of 3”
“AWS Public Direct Connect announces all public prefixes

with the IANA well-known NO_EXPORT community set”
Public VIF—Global Public Access
How far will customer announcements propagate within AWS ?
You can use the following BGP communities for your prefixes:
7224:9100 Local AWS Region
7224:9200 All AWS regions for a continent (for example, North America–wide)
7224:9300 Global (all public AWS Regions)
Public VIF—Global Public Access
How do I choose what AWS Prefixes to accept?
AWS Direct Connect applies the following BGP communities

to its advertised routes:
7224:8100 Routes that originate from the same AWS Region in which
the AWS Direct Connect point of presence is associated
7224:8200 Routes that originate from the same continent with which
the AWS Direct Connect point of presence is associated
No tag Global (all public AWS Regions)
Public VIF—same region (Ireland)
eu-west-1 (Ireland)
IP 54.239.244.57 /31
BGP AS 7224
Public VIF—same continent (Frankfurt)
eu-west-1 (Ireland)
IP 54.239.244.57 /31
BGP AS 7224
Public VIF—global (Canada)
eu-west-1 (Ireland)
IP 54.239.244.57 /31
BGP AS 7224
AWS Direct Connect Gateway
• Works with Private Virtual Interfaces
• You can attach multiple private virtual interfaces to your Direct Connect gateway from connections
at any Direct Connect location
• You associate a Direct Connect gateway with the virtual private gateway for the VPC
• Connects to one or more VPCs in your account that are located in the same or different regions
• A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway
in any region and access it from all other regions.
Before AWS Direct Connect Gateway
EU-WEST-2
10.3.0.0/16
Direct Connect
Location
(London)
10.3.0.0/16
VGW
via VGW (AS64512)
Virtual Interface
192.168.0.0/16
via CORP (AS65000)
EU-WEST-2
10.3.0.0/16
Direct Connect
Location
Direct Connect (London)
VGW Gateway Virtual Interface
VGW
“Association” “Attachment”
10.3.0.0/16
192.168.0.0/16
via DX GW (AS64512)
via CORP (AS65000)
EU-WEST-2
10.3.0.0/16
VGW
Direct Connect
VGW
Location
“Association”
Direct Connect (London)
Gateway Virtual Interface
“Attachment”
VGW
EU-CENTRAL-1
“Association”
10.4.0.0/16
10.3.0.0/16
VGW 192.168.0.0/16
10.4.0.0/16
via CORP (AS65000)
via DX GW (AS64512)
Direct Connect
Location
EU-WEST-2 (London)
10.3.0.0/16
VGW
VGW Virtual Interface 192.168.1.0/24

“Association” “Attachment” via CORP
Direct Connect (AS65000)
Gateway
VGW
EU-CENTRAL-1 Virtual Interface
“Association”
10.4.0.0/16
“Attachment”
10.3.0.0/16
VGW 10.4.0.0/16 192.168.2.0/24
via DX GW (AS64512) via CORP
(AS65000)
Direct Connect
Location
(Frankfurt)
Private VIF’s - Local Preference Communities
Advertise prefixes to AWS with the following communities :
• 7224:7100—Low preference
• 7224:7200—Medium preference
• 7224:7300—High preference
Local Preference Communities AS65000
Direct Connect
Location
(London) CORP
192.168.1.0/24 - 7224:7300 (High)

192.168.2.0/24 - 7224:7100 (Low)
Virtual Interface
“Attachment”
Direct Connect
Gateway
Virtual Interface
“Attachment”
10.3.0.0/16
10.4.0.0/16
via DX GW (AS64512) 192.168.2.0/24 - 7224:7300 (High)
192.168.1.0/24 - 7224:7100 (Low)
Direct Connect
Location
(Frankfurt)
Local Preference Communities AS65000
Direct Connect
Location
(London) CORP
192.168.1.0/24 - 7224:7300 (High)

192.168.2.0/24 - 7224:7100 (Low)
Virtual Interface
“Attachment”
Direct Connect
Gateway
Virtual Interface
“Attachment”
10.3.0.0/16
10.4.0.0/16
via DX GW (AS64512) 192.168.2.0/24 - 7224:7300 (High)
192.168.1.0/24 - 7224:7100 (Low)
Direct Connect
Location
(Frankfurt)
The rules
• The VPCs to which you connect through a Direct Connect gateway cannot
have overlapping CIDR blocks
• You cannot create a public virtual interface to a Direct Connect gateway
• A virtual private gateway that you associate with a Direct Connect gateway
must be attached to a VPC
• You cannot use a Direct Connect gateway to connect to a VPC in the China
(Beijing) region
• You cannot use a Direct Connect gateway to connect to a VPC in a different

AWS account
Direct Connect Gateway—traffic flows
VGW VGW Virtual Interface

VGW Virtual Interface

VGW “Association” “Attachment”
Direct Connect Gateway—traffic flows
VGW VGW Virtual Interface


VGW “Association” “Attachment”
Direct Connect pricing
Data Transfer Out pricing is dependent on—
• The source AWS Region
and
• AWS Direct Connect location
Direct Connect
Location
EU-WEST-2 (London)
10.3.0.0/16
VGW

VGW
EU-CENTRAL-1
“Association”
10.4.0.0/16
VGW
To Direct Connect Location From US East (Ohio), From Canada (Central) From EU Central From Asia Pacific From Asia Pacific From Asia Pacific From South America From Asia Pacific
US East (Virginia), (Frankfurt), (Tokyo) (Seoul), (Mumbai) (Sao Paulo) (Sydney)
US West (N. California), EU West (Ireland), Asia Pacific (Singapore)
US West (Oregon), EU West (London)
AWS GovCloud (US)
165 Halsey Street, Newark, NJ $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Cologix COL2, Columbus, OH $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
CoreSite DE1, Denver, CO $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
CoreSite NY1 & NY2 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
CoreSite One Wilshire $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
CoreSite SV3 - SV7 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
CoreSite VA1 & VA2 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
CyrusOne West I - III, Houston, TX $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Digital Realty ATL1, Atlanta, GA $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
EdgeConneX Portland $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix CH1 - CH2 & CH4 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix DA1 - DA3 & DA6 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix DC1 - DC6 & DC10 - DC11 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix LA1 - LA4 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix SE2 & SE3 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix SE2 & SE3 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Equinix SV1 & SV5 (AWS Gov Cloud) $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Lightower, Philadelphia, PA $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Markley, One Summer Street, Boston, MA $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
PhoenixNAP, Phoenix, AZ $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Pittock Exchange Portland $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
QTS Chicago $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
Switch SUPERNAP 8 $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
TierPoint Seattle $0.020 $0.020 $0.028 $0.090 $0.090 $0.085 $0.150 $0.130
From US East (Ohio), US East From Canada From EU Central (Frankfurt),

(Virginia), US West (N. California), (Central) EU West (Ireland), EU West
US West (Oregon), AWS (London), EU West (Paris)
GovCloud (US)
Telehouse West, London $0.0200 $0.0300 $0.0200
Telehouse Voltaire, Paris $0.0200 $0.0300 $0.0200
Thank You!
Steve Seymour
Principal Specialist Solutions Architect, AWS
@sseymour

AWS Direct Connect Deep Dive PDF

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

AWS Direct Connect Deep Dive PDF

Caricato da

Copyright:

Formati disponibili

AWS Direct Connect Deep Dive

• Dedicated, private connection into AWS

Virtual Private Cloud VPN Connections

Route Tables Customer Gateway

Internet Gateway AWS Direct Connect

Virtual Private Gateway Direct Connect Gateway

Virtual Private Cloud

AWS Direct Connect

Virtual Private Gateway Direct Connect Gateway

• Dark fiber, DWDM

• Cross connect at the location

• Single mode fiber

• Potential onward delivery via Direct Connect Partner

• 1 G/10 G dedicated ports—‘regular connections’

• Hosted connections—sub-1G (50 Mbps–500 Mbps)

AWS Backbone Cross Customer Access Customers Network Access

Direct Connect Location

AWS Direct Customer

AWS Backbone Cross Partner Partner Access Customer

Direct Connect Location

AWS Backbone Cross Provider Partner MPLS Access

Direct Connect Location

AWS Direct Partner `

1) Customer presence in the same DX location

1) Customer presence in the same DX location

2) Circuit between customer data center and DX location

1) Customer presence in the same DX location

2) Circuit between customer data center and DX location

3) Service provider network extending to DX location

Direct Connect Location 2

Direct Connect Location

AWS Direct Customer

AWS Direct Customer

AWS Direct Customer

1. Select Your Region

5. Create Virtual Interface

6. Configure Customer Router

1. Select Your Region

5. Create Virtual Interface

6. Configure Customer Router

1. Select Your Region

5. Create Virtual Interface

6. Configure Customer Router

1. Select Your Region

5. Create Virtual Interface

6. Configure Customer Router

1. Select Your Region

5. Create Virtual Interface

6. Configure Customer Router

1. Select Your Region

5. Create Virtual Interface

6. Configure Customer Router

• Multiple 1 G or 10 G ports—but treat them like a single managed connection

• A group of ports will be configured and managed as a single connection

• Traffic will load balance across these links, per flow

• 802.1Q VLAN & eBGP Session

• Private VIF: connects you to a virtual private cloud (VPC)

• Public VIF: connects you to public AWS services

• VLAN & IPs

• VLAN & IPs

• VLAN & IPs

• A Direct Connect Gateway

• A Virtual Private Gateway