Direct Connect & Site-to-Site VPN

Dedicated circuits, hosted connections, virtual interface types (public/private/transit), BGP over Direct Connect, and VPN as failover.

Overview

Overview AWS Direct Connect and Site-to-Site VPN are the two primary mechanisms for establishing private connectivity between on-premises data centers and AWS. They serve different use cases and are frequently deployed together for redundancy.

AWS Direct Connect provides dedicated network connections from your premises to AWS via a physical fiber circuit. Connections are established at one of AWS's Direct Connect locations (co-location facilities operated by partners). You can order a Dedicated Connection (1G or 10G port owned by you) or a Hosted Connection (sub-1G or 1G/10G shared on a partner's port). Direct Connect provides consistent network performance, reduced data transfer costs compared to internet, and higher bandwidth than VPN.

Once the physical connection is established, you create Virtual Interfaces (VIFs) on it. A Private VIF connects to a Virtual Private Gateway or Direct Connect Gateway to access your VPCs' private resources. A Public VIF connects you to AWS public services (S3, DynamoDB, SQS) over the AWS backbone using public IP addresses. A Transit VIF connects to a Direct Connect Gateway attached to a Transit Gateway, enabling connectivity to all TGW-attached VPCs.

AWS Site-to-Site VPN creates IPsec VPN tunnels over the public internet between your on-premises VPN device and an AWS Virtual Private Gateway or Transit Gateway. Each VPN connection consists of two tunnels for redundancy. VPN is faster to provision (minutes vs weeks for Direct Connect), lower cost, and typically used as backup for Direct Connect or as primary connectivity for smaller offices.

BGP is mandatory for Direct Connect and optional but recommended for Site-to-Site VPN. BGP enables dynamic route exchange, making failover between Direct Connect and VPN automatic when properly configured with appropriate route preferences.

Key concepts

Direct Connect Location
A co-location facility (e.g., Equinix, CyrusOne) where AWS has installed Direct Connect routers. Your router must be physically present or connected via a partner in the same facility. AWS provides a Letter of Authorization (LOA) to cross-connect your equipment to the AWS router.
Virtual Interface (VIF) Types
Private VIF: BGP session to VGW or Direct Connect Gateway; exchanges private IP routes for VPC access. Public VIF: BGP session for AWS public IP prefixes; access S3, EC2 APIs, etc. over AWS backbone. Transit VIF: BGP session to a Direct Connect Gateway that is attached to Transit Gateway; enables access to all TGW-connected VPCs.
Direct Connect Gateway
A global resource (not region-specific) that can be associated with multiple VGWs across different regions, or with a Transit Gateway. Allows a single Direct Connect connection to access VPCs in multiple AWS regions. Supports up to 10 VGW associations. Cannot be used for VPC-to-VPC routing (only for on-premises to VPC).
IPsec Site-to-Site VPN
Creates two IPsec tunnels (IKEv1 or IKEv2) between your on-premises VPN device and an AWS VGW or TGW. Tunnels run over the public internet. Each tunnel can carry up to 1.25 Gbps. Both tunnels are active but AWS prefers one; use BGP AS_PATH prepending or LOCAL_PREF manipulation to control which tunnel carries traffic.
BGP Route Preference for Failover
With Direct Connect primary and VPN backup, use BGP route attributes to prefer Direct Connect. For outbound traffic (from on-premises to AWS): advertise more specific routes via Direct Connect or use LOCAL_PREF. For inbound traffic (AWS to on-premises): AWS prefers Direct Connect routes by default. Adjust MED or AS_PATH on VPN routes to deprioritize them.

When to use it

  • Designing hybrid cloud connectivity for data centers requiring consistent, high-bandwidth AWS access
  • Configuring BGP route preferences to implement Direct Connect primary with VPN failover
  • Choosing between dedicated vs hosted Direct Connect connections based on bandwidth requirements
  • Troubleshooting BGP session issues or route exchange problems on a Direct Connect VIF
  • Planning Direct Connect redundancy with multiple connections or diverse locations

Interview questions

  • How do you configure Direct Connect with VPN failover? Walk through the BGP configuration on both sides.
  • What is MACsec and when would you use it over a Direct Connect connection instead of IPsec VPN?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio