How do I connect different branch offices using AWS Site-to-Site VPN and AWS Direct Connect?

Short description

AWS Site-to-Site VPN provides secured connectivity between AWS resources and the on-premises network such as a data center or a branch office.

AWS Direct Connect provides connectivity to AWS resources by establishing a link between your internal network and the AWS Direct Connect location.

Use Site-to-Site VPN and AWS Direct Connect's transit virtual interface (VIF) to establish connectivity between the branch offices.

Resolution

Establish the Site-to-Site VPN connection through a transit gateway from your branch office (for example, Branch office 1). Then, establish AWS Direct Connect from the second branch office (for example, Branch office 2) to the same transit gateway that you used to set up Site-to-Site VPN.

Branch office 1

Complete these steps to set up the AWS Direct Connect connection through the transit gateway:

1. Request AWS Direct Connect between an AWS Direct Connect location and Branch office 1.
2. Create an AWS Direct Connect transit VIF to the Direct Connect gateway.
3. Associate the transit gateway to the AWS Direct Connect gateway.
   Note: List Branch office 2's network prefixes in Allowed prefixes.
4. Using Border Gateway Protocol (BGP), advertise Branch office 1's CIDR from an on-premises device towards the transit VIF. For more information on configuring your on-premises device, see the device's third-party documentation for details.

Branch office 2

Complete these steps to set up a Site-to-Site VPN connection in this branch:

1. Establish Site-to-Site VPN through the same transit gateway used for the transit VIF in Branch office 1.
2. Using BGP, advertise Branch office 2's network prefixes from the customer gateway device towards the Site-to-Site VPN.

Note:

• Make sure that the Site-to-Site VPN attachment and the AWS Direct Connect gateway attachment associate with the same transit gateway routing table.
• The Autonomous System Number (ASN) for Transit Gateway, AWS Direct Connect gateway, and the branch offices must be unique.