AWS Transit Gateway Cheat Sheet

Last updated on November 14, 2024

Bookmarks

Features
Validate Your Knowledge

AWS Transit Gateway Cheat Sheet

A networking service that uses a hub and spoke model to enable customers to connect their on-premises data centers and their Amazon Virtual Private Clouds (VPCs) to a single gateway.
With this service, customers only have to create and manage a single connection from the central gateway into each on-premises data center, remote office, or VPC across your network.
If a new VPC is created, it is automatically connected to the Transit Gateway and will also be available to every other network that is also connected to the Transit Gateway.

Features

Inter-region peering
- Transit Gateway leverages the AWS global network to allow customers to route traffic across AWS Regions.
- Inter-region peering provides an easy and cost-effective way to replicate data for geographic redundancy or to share resources between AWS Regions.

Multicast
- Enables customers to have fine-grain control on who can consume and produce multicast traffic.
- It allows you to easily create and manage multicast groups in the cloud instead of the time-consuming task of deploying and managing legacy hardware on-premises.
- This multicast solution is also scalable so the customers can simultaneously distribute a stream of content to multiple subscribers.

Automated Provisioning
- Customers can automatically identify the Site-to-Site VPN connections and the on-premises resources with which they are associated using AWS Transit Gateway.
- Using the Transit Gateway Network Manager, you can also manually define your on-premises network.

Note: If you are studying for the AWS Certified Advanced Networking Specialty exam, we highly recommend that you take our AWS Certified Advanced Networking – Specialty Practice Exams and read our Advanced Networking Specialty exam study guide.

Validate Your Knowledge

Question 1

A multinational bank has two data centers that are 60 miles (96.56 kilometers) from each other. The bank also has a single transit gateway that has multiple VPC and VPN attachments.

The Network team recently established two AWS Direct Connect connections from the company’s on-premises data centers to a Direct Connect location with the help of a local Direct Connect Partner. Afterward, they provisioned an AWS Direct Connect Gateway that connects to the AWS Direct Connect location via a transit virtual interface.

With this setup, what other network connections can be implemented? (Select TWO.)

Connect multiple VPCs in the same or different AWS account using the Direct Connect connection.
Associate multiple transit gateways in different AWS Regions to the Direct Connect Gateway and use the same ASNs for each transit gateway. Enable the Appliance mode for all transit gateways.
Allow on-premises servers to connect to AWS resources that are reachable via public IP addresses such as AWS public endpoints and S3 buckets. Configure the Appliance mode on the existing transit gateway.
Use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections in different AWS Regions.
Associate multiple transit gateways in the same AWS Region.

Show me the answer!

Correct Answers: 1,5

A transit gateway enables you to attach VPCs and VPN connections in the same Region and route traffic between them. A transit gateway works across AWS accounts, and you can use AWS Resource Access Manager to share your transit gateway with other accounts. After you share a transit gateway with another AWS account, the account owner can attach their VPCs to your transit gateway. A user from either account can delete the attachment at any time.

You can enable multicast on a transit gateway, and then create a transit gateway multicast domain that allows multicast traffic to be sent from your multicast source to multicast group members over VPC attachments that you associate with the domain.

A transit virtual interface should be used to access one or more Amazon VPC Transit Gateways associated with Direct Connect gateways. You can use transit virtual interfaces with 1/2/5/10 Gbps AWS Direct Connect connections.

To connect to your resources hosted in an Amazon VPC (using their private IP addresses) through a transit gateway, use a transit virtual interface. With a transit virtual interface, you can:

– Connect multiple VPCs in the same or different AWS account using DX.

– Associate up to three transit gateways in the same AWS Region when you use a transit virtual interface to connect to a DX gateway.

– Attach VPCs in the same AWS Region to the transit gateway. Then, access multiple VPCs in different AWS accounts in the same AWS Region using a transit virtual interface.

You can also create a peering connection attachment between transit gateways in different AWS Regions. This enables you to route traffic between the transit gateways’ attachments across different Regions.

You can use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections. However, you can only aggregate connections in the same AWS Region only. Alternatively, you can create a peering connection attachment between transit gateways in different AWS Regions to enable you to route traffic between the transit gateways’ attachments across different Regions.

Hence, the correct answers are:

– Connect multiple VPCs in the same or different AWS account using the Direct Connect connection.

– Associate multiple transit gateways in the same AWS Region.

The option that says: Associate multiple transit gateways in different AWS Regions to the Direct Connect Gateway and use the same ASNs for each transit gateway. Enable the Appliance mode for all transit gateways is incorrect. Although this is possible, you have to use unique ASNs for each transit gateway. Enabling the Application mode for the transit gateways serves no purpose as well. The Application mode simply ensures that the bidirectional traffic is routed symmetrically, whereby a request is routed through the same Availability Zone in the VPC attachment for the life of the flow.

The option that says: Allow on-premises servers to connect to AWS resources that are reachable via public IP addresses such as AWS public endpoints and S3 buckets. Configure the Appliance mode on the existing transit gateway is incorrect because this is only possible with a public virtual interface and not with a transit virtual interface. Just as explained in the previous option, the use of the Application mode for the Transit Gateway is not warranted in this scenario.

The option that says: Use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN connections in different AWS Regions is incorrect. Although you can use ECMP and aggregate multiple VPNs with Transit Gateway, these resources should be in the same AWS Region. An alternative solution is to establish a peering connection between two transit gateways in different AWS Regions, however, the scenario clearly mentioned that there is only a single transit gateway.

References:
https://aws.amazon.com/premiumsupport/knowledge-center/public-private-interface-dx/
https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html
https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

Note: This question was extracted from our AWS Certified Advanced Networking Specialty Practice Exams.

For more AWS practice exam questions with detailed explanations, visit the Tutorials Dojo Portal:

AWS Transit Gateway Cheat Sheet Reference:
https://aws.amazon.com/transit-gateway/

Written by: Jon Bonso

Jon Bonso is the co-founder of Tutorials Dojo, an EdTech startup and an AWS Digital Training Partner that provides high-quality educational materials in the cloud computing space. He graduated from Mapúa Institute of Technology in 2007 with a bachelor's degree in Information Technology. Jon holds 10 AWS Certifications and is also an active AWS Community Builder since 2020.