AWS - Routing via VPN

1

Hello.

I have questions about routing in VPN IPSec tunnels.

  1. I understand AWS has an implicit router within VPC, so this router manages routing inside and outside VPC?

  2. Also in every route table, there is a default local route with VPC CIDR, so this enables routing between all subnets within a VPC?

  3. I understand Virtual Private Gateway is regional resource but inside VPC, and Transit Gateway is regional resource but outside VPC. They are resources different that implicit router. So how these resources talk with implicit router?

  4. If I configure a VPN with Virtual Private Gateway or Transit Gateway. Which routes are advertised from Virtual Private Gateway and Transit Gateway to on-premises via VPN with dynamic routing?. Can I define a preffix-list in these resources?

Thank you.

1 Answer
0

I understand AWS has an implicit router within VPC, so this router manages routing inside and outside VPC?

Yes

Also in every route table, there is a default local route with VPC CIDR, so this enables routing between all subnets within a VPC?

Yes

I understand Virtual Private Gateway is regional resource but inside VPC, and Transit Gateway is regional resource but outside VPC. They are resources different that implicit router. So how these resources talk with implicit router?

The VPC subnets will have route for the on-premises networks pointing towards the VGW or TGW, from there the traffic will get encrypted and will get injected in the VPN tunnel and would traverse the public internet.

If I configure a VPN with Virtual Private Gateway or Transit Gateway. Which routes are advertised from Virtual Private Gateway and Transit Gateway to on-premises via VPN with dynamic routing?.

The answer is in the VPN FAQ

Q: What is the maximum number of routes that my VPN connection will advertise to my customer gateway device?

A: Your VPN connection will advertise a maximum of 1,000 routes to the customer gateway device. For VPNs on a Virtual Private Gateway, advertised route sources include VPC routes, other VPN routes, and routes from DX Virtual Interfaces. For VPNs on an AWS Transit Gateway, advertised routes come from the route table associated to the VPN attachment. If more than 1,000 routes are attempted to be sent, only a subset of 1,000 will be advertised.

Can I define a preffix-list in these resources?

You can configure prefix-list on your CGW not on AWS side

profile pictureAWS
EXPERT
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions