By using AWS re:Post, you agree to the Terms of Use
/enable communication between multiple VPCs from a single VPN connection attached to my transit gateway/

enable communication between multiple VPCs from a single VPN connection attached to my transit gateway

0

We have DEV and Production servers in different AWS accounts and these account's VPC are connected via Transit Gateway. I want to connect the VPN to the same Transit gateway so that we don't need to create separate VPNs for DEV And Production account. As AWS doesn't support multiple Remote IPv4 network CIDR in to Site to Site VPN. The CIDR range for which both the accounts can be accessible is of size /16. Since it is a very big CIDR and this can cause overlapping of IP addresses for the client's Network they are not allowing it. Also they are not accepting CIDR greater than size /30. AWS support has recommended that we can consider using a dynamic VPN routing. Does anyone has any idea how we can achieve this configuration without setting up Two VPNs.

2 Answers
1

Have you seen this? https://aws.amazon.com/premiumsupport/knowledge-center/transit-gateway-connect-vpcs-from-vpn/ This looks like the scenario you are describing. Hope this helps

answered 15 days ago
  • Thank you Valkyrie, I will go through it

1

Adding something for one part of your question:

You can absolutely route more than a single CIDR range through Site-to-Site VPN. That's not a restriction at all. Where the misunderstanding normally is: You can only specify a single encryption domain on the VPN.

You might choose to set up the encryption domain to match your CIDR range (say, 172.24.0.0/16) that will restrict you to only routing that CIDR range on the VPN.

Instead, you should set up the encryption domain on the VPN to be 0.0.0.0/0 which means "encrypt all traffic on this VPN tunnel". The routers on either end of the tunnel (in this case, Transit Gateway and your on premises device) will only be sending traffic to the tunnel which needs to go to the remote end; and because the tunnel is set up to encrypt all traffic it will encrypt whatever traffic is sent to it even if it "belongs" to multiple CIDR ranges.

EXPERT
answered 15 days ago
  • This will definitely help, Thank you for such a wonderful contribution Brettski

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions