Explain AWS Direct Connect. What are the connection types and virtual interfaces?
Show the answer
Say this first
Direct Connect is a private Ethernet connection from your router to AWS at a Direct Connect location. A dedicated connection is a physical port, typically 1, 10 or 100 Gbps; a hosted connection is a slice sold by a partner. Over it you run 802.1Q virtual interfaces, each with its own BGP session: a private VIF to reach VPCs, a public VIF to reach AWS public endpoints, and a transit VIF to reach transit gateways through a Direct Connect gateway.
Go deeper
Connection types
- Dedicated: a cross-connect to an AWS router port in a colocation facility. You order it, get a Letter of Authorization (LOA-CFA), and have the cross-connect run.
- Hosted: a partner already connected to AWS provisions a VLAN for you at a fixed bandwidth, from as little as 50 Mbps.
Virtual interfaces
| VIF | Reaches | Attaches to |
|---|---|---|
| Private | VPC private addresses | A VGW, or a Direct Connect gateway |
| Transit | Many VPCs via transit gateways | A Direct Connect gateway associated with TGWs |
| Public | AWS public service addresses (S3, DynamoDB, public endpoints) | AWS public prefixes, needs public IPs |
A Direct Connect gateway is a global object: one private or transit VIF can reach VGWs or TGWs in many regions. It does not route VPC to VPC through itself.
Rules that cause outages
- BGP is mandatory on every VIF.
- A private VIF accepts at most 100 prefixes from you. Advertise more and the BGP session goes down. Summarize.
- Direct Connect is not encrypted. MACsec is available on some dedicated connections; otherwise run IPsec over it.
Redundancy
One connection is a single point of failure. AWS's guidance for critical workloads is connections at two separate Direct Connect locations, each on separate devices, with BFD for fast failover and a VPN as an optional last resort.
They will ask next
How do you make on-prem prefer one of two Direct Connect connections?
For AWS-to-on-prem traffic, use AS path prepending or more specific prefixes on the preferred link; AWS also honours a set of local preference BGP communities on private and transit VIFs. For on-prem-to-AWS traffic, set local preference on your routers.
What is a LAG on Direct Connect?
Several dedicated connections of the same speed at the same location bundled with LACP into one logical connection. It adds bandwidth and link redundancy, not location redundancy.
Traps
- Advertising a full internal routing table over a private VIF and dropping the session.
- Calling Direct Connect secure because it is private.