Managing routing protocols for AWS and hybrid connectivity options (for example, over a Direct Connect connection, VPN)

What are the primary AWS services that are used to establish a hybrid network architecture with your own data centers?

The primary AWS services used to establish a hybrid network architecture are AWS Direct Connect (DX) and AWS Virtual Private Network (VPN). AWS Direct Connect establishes a dedicated network connection between your premises and AWS, providing lower latencies and potentially reduced costs over internet-based connections. AWS VPN allows you to establish a secure and private tunnel from your network or device to the AWS global network.

Can you explain the difference between AWS Direct Connect’s private VIF and public VIF?

A private Virtual Interface (VIF) is used to access resources that are in your Virtual Private Cloud (VPC), such as EC2 instances or RDS databases. It uses private IP addresses and keeps traffic within the AWS backbone. A public VIF is used to access public AWS services outside of your VPC, like S3 or DynamoDB, that are reachable within the AWS global network. The public VIF allows direct access using public IP addresses but does not route internet-bound traffic.

How do BGP attributes influence routing decisions in a hybrid network environment using AWS?

BGP attributes such as AS Path, Local Preference, MED (Multi-Exit Discriminator), Weight (a Cisco-specific attribute), and Origin influence routing decisions. In a hybrid network, these attributes determine the most favorable path for data to travel from the data center to AWS. For example, Local Preference can be used to prefer one path over another. In AWS, the BGP community tags can also contribute to route preference and decision-making.

What AWS service can be used to resolve DNS queries from on-premises systems in AWS VPCs without exposing this traffic to the internet?

AWS Route 53 Resolver can be used to resolve DNS queries from on-premises systems in AWS VPCs without the need to send DNS queries over the internet. Route 53 Resolver provides both DNS forwarding, for routing DNS queries from AWS to on-premises DNS servers, and inbound endpoint functionality that allows on-premises systems to resolve AWS VPC DNS names.

What is the difference between AWS Transit Gateway and AWS VPN CloudHub?

AWS Transit Gateway acts as a cloud router that simplifies network architecture by allowing transitive connectivity between VPCs and on-premises networks. It eliminates the need to implement multiple VPC peering connections by serving as a central hub. AWS VPN CloudHub, on the other hand, is a feature of AWS Site-to-Site VPN that provides a hub-and-spoke model for connecting multiple branch offices or remote sites using a secure VPN setup.

How can you leverage AWS Direct Connect Gateway to connect multiple VPCs to your on-premises network?

AWS Direct Connect Gateway allows you to connect to multiple VPCs in the same or different AWS Regions using a single AWS Direct Connect connection. By attaching your Direct Connect connection to a Direct Connect Gateway, and then associating the gateway with multiple VPCs, you can route traffic to and from these VPCs using your on-premises network connection.

In what scenarios would you recommend setting up a Software VPN over a hardware VPN on AWS?

A software VPN is recommended in scenarios where flexibility and rapid deployment are more critical than the high throughput and low latency that hardware VPNs offer. It is also preferred when there are specific cryptographic requirements or custom configurations needed that AWS VPN does not support natively.

How does AWS Direct Connect bypass the public internet and what implications does this have for data transfer?

AWS Direct Connect bypasses the public internet by establishing a direct, private connection between an AWS Direct Connect location and your data center, office, or colocation environment. This reduces the exposure to internet-based threats, often results in more stable and reliable network performance, and can lead to reduced bandwidth costs for high-volume data transfer.

What is VPN Failover and how can it be configured on AWS?

VPN Failover is a mechanism for maintaining network connectivity by automatically switching to a backup VPN connection in case the primary connection fails. On AWS, VPN failover can be configured by setting up multiple VPN connections and leveraging the automatic route propagation feature in your VPC route table. AWS Site-to-Site VPN connections automatically support failover with two tunnels for redundancy.