How do I set up an Active/Active or Active/Passive Direct Connect connection to AWS from a public virtual interface?

4 minute read
1

I want to set up an Active/Active or Active/Passive AWS Direct Connect connection to AWS services from a public virtual interface.

Short description

To use Direct Connect to transport production workloads between AWS services, it's a best practice to create two connections through different data centers or providers. There are two options to configure your connections:

  • Active/Active: Traffic is load shared between interfaces based on flow. If one connection becomes unavailable, then all traffic is routed through the other connection.
  • Active/Passive: One connection handles traffic, and the other is on standby. If the active connection becomes unavailable, then all traffic is routed through the passive connection.

When you configure public virtual interfaces, use a public or private Autonomous System Number (ASN) for your on-premises peer router for the new virtual interface. The valid values are from 1 to 2,147,483,647.

According to the Internet Assigned Numbers Authority (IANA), the following ASNs are available for private use:

  • 2-byte private ASNs: 64,512 to 65,534
  • 4-byte private ASNs: 4,200,000,000 to 4,294,967,294

Resolution

Configure an Active/Active connection

Public ASN

If you use a public ASN, then complete the following tasks:

  • Allow your customer gateway to advertise the same prefix with the same Border Gateway Protocol (BGP) attributes on both public virtual interfaces. The prefix can be a public IP address or a network that you own. This configuration lets you load balance traffic over both public virtual interfaces.
  • Check the vendor documentation for device-specific commands for your customer gateway device.

Private ASN

If you use a private ASN, then load balancing on a public virtual interface isn't supported.

Note: If you use two Direct Connect connections with two public virtual interfaces, then confirm that both interfaces are terminated on different AWS devices. To check the AWS device IDs, open the Direct Connect console, and then choose Connections.

Configure an Active/Passive connection

Public ASN

If you use a public ASN, then check the following configurations:

  • Confirm that your customer gateway advertises the same prefix on both BGP sessions. The prefix can be a public IP address or a network that you own.
  • Identify the connection that you plan to set as the secondary connection. Then, start advertising the on-premises public prefixes with additional AS_Path prepends in the BGP attributes. For example, your customer gateway uses ASN 123. The gateway can advertise the prefix on the secondary connection with AS_Path set to 123 123 123 123. With this configuration, AWS always sends traffic to on-premises prefixes on the connection with the shorter AS_Path.
  • Identify the connection that you plan to set as the primary connection. Then, increase the Local Preference (local-pref) to be sure that the on-premises router always chooses the correct path to send traffic to AWS. A higher Local Preference (local-pref) value is preferred, and the default is 100. For more information, see Public virtual interface routing policies.
  • The primary connection is considered the primary path. When a failure occurs, traffic is shifted to the secondary connection as a secondary path.

Private ASN

If you use a private ASN, then check the following configurations:

  • Confirm that your customer gateway advertises the longer prefix on your primary connection. For example, if you advertise prefix X.X.X.0/24, then your customer gateway can advertise two prefixes (X.X.X.0/25 and X.X.X.128/25) on your primary connection. In this example, your customer gateway can also advertise prefix X.X.X.0/24 on your secondary connection.
  • If both interfaces are UP and the longer prefix is advertised on your primary connection, then traffic is sent to your through the primary connection. When a failure occurs, traffic is shifted and sent to the secondary connection.

Related information

AWS Direct Connect virtual interfaces

Configure redundant connections

Which type of Direct Connect virtual interface should I use to connect different AWS resources?

AWS OFFICIAL
AWS OFFICIALUpdated 8 months ago
2 Comments

Based on "If you use a private ASN, then load balancing on a public virtual interface isn't supported.", how it's decides which public VIF will be used when the route is advertised with same private ASN and prefix length?

profile pictureAWS
H_Shah
replied 4 days ago

Thank you for your comment. We'll review and update the Knowledge Center article as needed.

profile pictureAWS
MODERATOR
replied 3 days ago