View a markdown version of this page

AWS Site-to-Site VPN to AWS Transit Gateway (Public VIF) - Traffic Encryption Options in AWS Direct Connect
Site-to-Site VPN over Direct Connect public VIF to Transit Gateway architectureFurther readingDiagram history

AWS Site-to-Site VPN to AWS Transit Gateway (Public VIF)

Publication date: March 5, 2025 (Diagram history)

This method achieves traffic encryption by combining the benefits of the end-to-end secure IPSec connection with the low latency and consistent network experience of AWS Direct Connect when reaching resources in your Amazon VPCs through AWS Transit Gateway. This approach is suitable for customers that need to reach multiple VPCs in their AWS environment.

Site-to-Site VPN over Direct Connect public VIF to Transit Gateway architecture

Architecture diagram showing traffic encryption using AWS Site-to-Site VPN over a Direct Connect public VIF to reach multiple VPCs through AWS Transit Gateway.

Configuration steps:

  1. Create an AWS Direct Connect connection. For dedicated connections, set up a cross-connect between the AWS device and your device (or partner device) at the location. For hosted connections, you must accept the connection before you can use it.

  2. Once the connection is established, create an AWS Direct Connect public virtual interface. Configure your customer gateway to bring up the VIF.

  3. Once the BGP peer on the VIF is established, AWS advertises its public IP range to the customer gateway device over the public VIF.

  4. Create an AWS Site-to-Site VPN and choose your AWS Transit Gateway instance as the VPN concentrator for the AWS side.

  5. Configure the customer gateway with the VPN parameters to bring up the AWS VPN connection and route traffic destined to the Transit Gateway through the AWS VPN connection.

Sample traffic flow:

  1. A client located in the corporate network needs to route network traffic to the IP address of an Amazon Elastic Compute Cloud (Amazon EC2) instance in the spoke VPC A, and routes the traffic through the customer gateway.

  2. The customer gateway determines that the best route to the VPC is through the AWS Site-to-Site VPN tunnel. The traffic is encrypted based on cryptographic parameters for the IPSec tunnel, with the destination of the encrypted packet being the AWS VPN endpoint public IP address.

  3. The customer gateway determines that the best route to the AWS VPN endpoint public IP address is through the Direct Connect public VIF.

  4. The AWS VPN endpoint attached to the Transit Gateway receives the encrypted IPSec traffic and forwards it to the Transit Gateway.

  5. The traffic is decrypted, forwarded to the spoke VPC A, and routed to the Amazon EC2 instance.

  6. Return traffic from the Amazon EC2 instance to the corporate network follows a reverse but identical path.

Further reading

For additional information, see the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

March 5, 2025

Initial publication

Reference architecture diagram first published.

March 5, 2025

Initial publication

Reference architecture diagram first published.

March 5, 2025

Initial publication

Reference architecture diagram first published.

March 5, 2025

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.