AWS Direct Connect - User Guide

User Guide

AWS Direct Connect

AWS Direct Connect User Guide

AWS Direct Connect: User Guide

Amazon's trademarks and trade dress may not be used in connection with any product or service

that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any

manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are

the property of their respective owners, who may or may not be aﬃliated with, connected to, or

sponsored by Amazon.

AWS Direct Connect User Guide

Table of Contents

What is AWS Direct Connect? ......................................................................................................... 1

Direct Connect components ....................................................................................................................... 2

Network requirements ................................................................................................................................. 2

Supported Direct Connect virtual interface types ................................................................................. 3

Pricing for Direct Connect .......................................................................................................................... 4

Direct Connect maintenance ...................................................................................................................... 4

Access to remote AWS Regions ................................................................................................................. 6

Access to public services in a remote Region ................................................................................... 6

Access to VPCs in a remote Region .................................................................................................... 6

Network-to-Amazon VPC Connectivity Options ............................................................................... 7

Routing policies and BGP communities ................................................................................................... 7

Public virtual interface routing policies ............................................................................................. 7

Public virtual interface BGP communities ......................................................................................... 8

Private virtual interface and transit virtual interface routing policies ....................................... 10

Private virtual interface routing example ........................................................................................ 12

AWS Direct Connect Resiliency Toolkit ........................................................................................ 14

Prerequisites ................................................................................................................................................ 15

Maximum resiliency ................................................................................................................................... 17

High resiliency ............................................................................................................................................. 18

Development and test .............................................................................................................................. 19

Classic ........................................................................................................................................................... 20

Prerequisites ........................................................................................................................................... 20

Failover test ................................................................................................................................................. 21

Conﬁgure maximum resiliency ................................................................................................................ 21

Step 1: Sign up for AWS ..................................................................................................................... 22

Step 2: Conﬁgure the resiliency model ............................................................................................ 24

Step 3: Create your virtual interfaces .............................................................................................. 25

Step 4: Verify your virtual interface resiliency conﬁguration ...................................................... 33

Step 5: Verify your virtual interfaces connectivity ........................................................................ 33

Conﬁgure high resiliency .......................................................................................................................... 34

Step 1: Sign up for AWS ..................................................................................................................... 34

Step 2: Conﬁgure the resiliency model ............................................................................................ 36

Step 3: Create your virtual interfaces .............................................................................................. 37

Step 4: Verify your virtual interface resiliency conﬁguration ...................................................... 45

iii

AWS Direct Connect User Guide

Step 5: Verify your virtual interfaces connectivity ........................................................................ 45

Conﬁgure development and test resiliency .......................................................................................... 45

Step 1: Sign up for AWS ..................................................................................................................... 46

Step 2: Conﬁgure the resiliency model ............................................................................................ 48

Step 3: Create a virtual interface ...................................................................................................... 49

Step 4: Verify your virtual interface resiliency conﬁguration ...................................................... 57

Step 5: Verify your virtual interface ................................................................................................. 57

Conﬁgure a Classic connection ............................................................................................................... 58

Step 1: Sign up for AWS ..................................................................................................................... 58

Step 2: Request an AWS Direct Connect dedicated connection .................................................. 60

(Dedicated connection) Step 3: Download the LOA-CFA .............................................................. 62

Step 4: Create a virtual interface ...................................................................................................... 63

Step 5: Download the router conﬁguration .................................................................................... 72

Step 6: Verify your virtual interface ................................................................................................. 72

(Recommended) Step 7: Conﬁgure redundant connections ........................................................ 73

Failover Test ................................................................................................................................................ 75

Test History ............................................................................................................................................ 76

Validation Permissions ......................................................................................................................... 76

Start a virtual interface failover test ................................................................................................ 76

View a virtual interface failover test history .................................................................................. 77

Stop a virtual interface failover test ................................................................................................ 78

MAC security (MACsec) .................................................................................................................. 79

MACsec concepts ....................................................................................................................................... 79

MACsec key rotation .................................................................................................................................. 80

Supported connections ............................................................................................................................. 80

MACsec on dedicated connections ......................................................................................................... 80

MACsec prerequisites for dedicated connections ........................................................................... 81

Service-Linked roles ............................................................................................................................. 81

MACsec pre-shared CKN/CAK key considerations .......................................................................... 82

Get started with MACsec on a dedicated connection ......................................................................... 82

Create a connection ............................................................................................................................. 82

(Optional)Create a LAG ........................................................................................................................ 82

Associate the CKN/CAK with the connection or LAG .................................................................... 83

Conﬁgure your on-premises router ................................................................................................... 83

Remove the association between the CKN/CAK and the connection or LAG ........................... 83

Dedicated and hosted connections .............................................................................................. 84

AWS Direct Connect User Guide

Dedicated connections .............................................................................................................................. 84

Letter of Authorization and Connecting Facility Assignment (LOA-CFA) ................................... 86

Create a connection using the Connection wizard ........................................................................ 87

Create a Classic connection ................................................................................................................ 88

Download the LOA-CFA ....................................................................................................................... 90

Associate a MACsec CKN/CAK with a connection .......................................................................... 91

Remove the association between a MACsec secret key and a connection ................................ 92

Hosted connections ................................................................................................................................... 92

Accept a hosted connection ............................................................................................................... 94

Delete a connection ................................................................................................................................... 94

Update a connection ................................................................................................................................. 95

View connection details ............................................................................................................................ 96

Cross connects ............................................................................................................................... 98

US East (Ohio) ............................................................................................................................................. 99

US East (N. Virginia) ................................................................................................................................ 100

US West (N. California) ........................................................................................................................... 101

US West (Oregon) .................................................................................................................................... 102

Africa (Cape Town) .................................................................................................................................. 103

Asia Paciﬁc (Jakarta) ............................................................................................................................... 103

Asia Paciﬁc (Mumbai) .............................................................................................................................. 103

Asia Paciﬁc (Seoul) .................................................................................................................................. 104

Asia Paciﬁc (Singapore) .......................................................................................................................... 104

Asia Paciﬁc (Sydney) ................................................................................................................................ 105

Asia Paciﬁc (Tokyo) .................................................................................................................................. 105

Canada (Central) ....................................................................................................................................... 106

China (Beijing) ........................................................................................................................................... 106

China (Ningxia) ......................................................................................................................................... 107

Europe (Frankfurt) ................................................................................................................................... 107

Europe (Ireland) ........................................................................................................................................ 108

Europe (Milan) .......................................................................................................................................... 108

Europe (London) ....................................................................................................................................... 109

Europe (Paris) ............................................................................................................................................ 109

Europe (Stockholm) ................................................................................................................................. 109

Europe (Zurich) ......................................................................................................................................... 110

Israel (Tel Aviv) ......................................................................................................................................... 110

Middle East (Bahrain) .............................................................................................................................. 110

AWS Direct Connect User Guide

Middle East (UAE) .................................................................................................................................... 111

South America (São Paulo) .................................................................................................................... 111

AWS GovCloud (US-East) ....................................................................................................................... 111

AWS GovCloud (US-West) ...................................................................................................................... 111

Virtual interfaces and hosted virtual interfaces ....................................................................... 112

Public virtual interface preﬁx advertisement rules .......................................................................... 112

SiteLink ....................................................................................................................................................... 113

Prerequisites for virtual interfaces ....................................................................................................... 114

MTUs for private virtual interfaces or transit virtual interfaces .................................................... 119

Virtual interfaces ...................................................................................................................................... 120

Prerequisites for transit virtual interfaces to a Direct Connect gateway ................................ 121

Create a public virtual interface ...................................................................................................... 122

Create a private virtual interface .................................................................................................... 123

Create a transit virtual interface to the Direct Connect gateway ............................................. 126

Download the router conﬁguration ﬁle ......................................................................................... 128

Hosted virtual interfaces ........................................................................................................................ 129

Create a hosted private virtual interface ...................................................................................... 133

Create a hosted public virtual interface ........................................................................................ 135

Create a hosted transit virtual interface ....................................................................................... 137

View virtual interface details ................................................................................................................ 139

Add a BGP peer ........................................................................................................................................ 140

Delete a BGP peer ................................................................................................................................... 141

Set the MTU of a private virtual interface ......................................................................................... 142

Add or remove virtual interface tags .................................................................................................. 143

Delete a virtual interface ....................................................................................................................... 143

Accept a hosted virtual interface ......................................................................................................... 144

Migrate a virtual interface ..................................................................................................................... 145

Link aggregation groups (LAGs) ................................................................................................. 147

MACsec considerations ............................................................................................................................ 149

Create a LAG ............................................................................................................................................. 149

View LAG details ...................................................................................................................................... 152

Update a LAG ........................................................................................................................................... 152

Associate a connection with a LAG ...................................................................................................... 154

Disassociate a connection from a LAG ................................................................................................ 155

Associate a MACsec CKN/CAK with a LAG .......................................................................................... 155

Remove the association between a MACsec secret key and a LAG ................................................ 157

AWS Direct Connect User Guide

Delete a LAG ............................................................................................................................................. 157

Gateways ...................................................................................................................................... 159

Direct Connect gateways ........................................................................................................................ 159

Scenarios ............................................................................................................................................... 161

Create a Direct Connect gateway ................................................................................................... 164

Migrate from a virtual private gateway to a Direct Connect gateway ..................................... 165

Delete a Direct Connect gateway ................................................................................................... 165

Virtual private gateway associations ................................................................................................... 166

Create a virtual private gateway ..................................................................................................... 168

Associate or disassociate virtual private gateways ...................................................................... 169

Create a private virtual interface to the Direct Connect gateway ............................................ 170

Associate a virtual private gateway across accounts .................................................................. 173

Transit gateway associations ................................................................................................................. 174

Associating a transit gateway across accounts ............................................................................. 174

Associate or disassociate a transit gateway with Direct Connect. ............................................ 175

Create a transit virtual interface to the Direct Connect gateway ............................................. 177

Create a transit gateway association proposal ............................................................................. 180

Accept or reject a transit gateway association proposal ............................................................ 181

Update the allowed preﬁxes for a transit gateway association ................................................ 182

Delete a transit gateway association proposal ............................................................................. 182

Allowed preﬁxes interactions ................................................................................................................ 183

Virtual private gateway associations .............................................................................................. 183

Transit gateway associations ............................................................................................................ 184

Example: Allowed to preﬁxes in a transit gateway conﬁguration ............................................ 185

Tag resources ............................................................................................................................... 187

Tag restrictions ......................................................................................................................................... 188

Working with tags using the CLI or API .............................................................................................. 189

Examples ............................................................................................................................................... 189

Security ........................................................................................................................................ 190

Data protection ........................................................................................................................................ 190

Internetwork traﬃc privacy .............................................................................................................. 192

Encryption ............................................................................................................................................ 192

Identity and Access Management ........................................................................................................ 193

Audience ............................................................................................................................................... 193

Authenticating with identities ......................................................................................................... 194

Managing access using policies ....................................................................................................... 197

vii

AWS Direct Connect User Guide

How Direct Connect works with IAM ............................................................................................. 199

Identity-based policy examples for Direct Connect .................................................................... 206

Service-linked roles ............................................................................................................................ 215

AWS managed policies ...................................................................................................................... 219

Troubleshooting .................................................................................................................................. 220

Logging and monitoring ........................................................................................................................ 222

Compliance validation ............................................................................................................................ 223

Resilience in Direct Connect .................................................................................................................. 224

Failover .................................................................................................................................................. 224

Infrastructure security ............................................................................................................................. 225

Border Gateway Protocol .................................................................................................................. 225

Use the AWS CLI .......................................................................................................................... 226

Step 1: Create a connection .................................................................................................................. 226

Step 2: Download the LOA-CFA ............................................................................................................ 227

Step 3: Create a virtual interface and get the router conﬁguration .............................................. 228

Log API calls ................................................................................................................................ 234

AWS Direct Connect information in CloudTrail ................................................................................. 234

Understand AWS Direct Connect log ﬁle entries .............................................................................. 235

Monitor Direct Connect resources .............................................................................................. 240

Monitoring tools ....................................................................................................................................... 240

Automated monitoring tools ........................................................................................................... 241

Manual monitoring tools .................................................................................................................. 241

Monitor with Amazon CloudWatch ...................................................................................................... 242

AWS Direct Connect metrics and dimensions .............................................................................. 242

View Direct Connect CloudWatch metrics ..................................................................................... 248

Create alarms to monitor connections .......................................................................................... 249

Direct Connect quotas ................................................................................................................. 251

BGP quotas ................................................................................................................................................ 254

Load balance considerations ................................................................................................................. 254

Troubleshooting ........................................................................................................................... 255

Layer 1 (physical) issues ......................................................................................................................... 255

Layer 2 (data link) issues ........................................................................................................................ 258

Layer 3/4 (Network/Transport) issues ................................................................................................. 259

Routing issues ........................................................................................................................................... 262

Document history ........................................................................................................................ 264

viii

AWS Direct Connect User Guide

What is AWS Direct Connect?

AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard

Ethernet ﬁber-optic cable. One end of the cable is connected to your router, the other to an AWS

Direct Connect router. With this connection, you can create virtual interfaces directly to public AWS

services (for example, to Amazon S3) or to Amazon VPC, bypassing internet service providers in

your network path. An AWS Direct Connect location provides access to AWS in the Region with

which it is associated. You can use a single connection in a public Region or AWS GovCloud (US) to

access public AWS services in all other public Regions.

• For a list of Direct Connect locations you can connect to, see AWS Direct Connect Locations.

• For answers to questions about Direct Connect, see the Direct Connect FAQ.

The following diagram shows a high-level overview of how AWS Direct Connect interfaces with

your network.

Contents

• AWS Direct Connect components

• Network requirements

• Supported Direct Connect virtual interface types

• Pricing for Direct Connect

• AWS Direct Connect maintenance

• Access to remote AWS Regions

• AWS Direct Connect routing policies and BGP communities

AWS Direct Connect User Guide

AWS Direct Connect components

The following are the key components that you use for Direct Connect:

Connections

Create a connection in an AWS Direct Connect location to establish a network connection from

your premises to an AWS Region. For more information, see AWS Direct Connect dedicated and

hosted connections.

Virtual interfaces

Create a virtual interface to enable access to AWS services. A public virtual interface enables

access to public services, such as Amazon S3. A private virtual interface enables access to your

VPC. The types of supported interfaces are described below in the section called “Supported

Direct Connect virtual interface types”. For more details about the supported interfaces, see

AWS Direct Connect virtual interfaces and hosted virtual interfaces and Prerequisites for virtual

interfaces.

Network requirements

To use AWS Direct Connect in an AWS Direct Connect location, your network must meet one of the

following conditions:

• Your network is colocated with an existing AWS Direct Connect location. For more information

about available AWS Direct Connect locations, see AWS Direct Connect Product Details.

• You are working with an AWS Direct Connect partner who is a member of the AWS Partner

Network (APN). For information, see APN Partners Supporting AWS Direct Connect.

• You are working with an independent service provider to connect to AWS Direct Connect.

In addition, your network must meet the following conditions:

• Your network must use single-mode ﬁber with a 1000BASE-LX (1310 nm) transceiver for 1

gigabit Ethernet, a 10GBASE-LR (1310 nm) transceiver for 10 gigabit, a 100GBASE-LR4 for 100

gigabit Ethernet, or a 400GBASE-LR4 for 400 Gbps Ethernet.

• Auto-negotiation for a port must be disabled for a connection with a port speed of more than

1 Gbps. However, depending on the AWS Direct Connect endpoint serving your connection,

Direct Connect components 2

AWS Direct Connect User Guide

auto-negotiation might need to be enabled or disabled for 1 Gbps connections. If your virtual

interface remains down, see Troubleshooting layer 2 (data link) issues.

• 802.1Q VLAN encapsulation must be supported across the entire connection, including

intermediate devices.

• Your device must support Border Gateway Protocol (BGP) and BGP MD5 authentication.

• (Optional) You can conﬁgure Bidirectional Forwarding Detection (BFD) on your network.

Asynchronous BFD is automatically enabled for each AWS Direct Connect virtual interface.

It's automatically enabled for Direct Connect virtual interfaces, but does not take eﬀect until

you conﬁgure it on your router. For more information, see Enable BFD for a Direct Connect

connection.

AWS Direct Connect supports both the IPv4 and IPv6 communication protocols. IPv6 addresses

provided by public AWS services are accessible through AWS Direct Connect public virtual

interfaces.

AWS Direct Connect supports an Ethernet frame size of 1522 or 9023 bytes (14 bytes Ethernet

header + 4 bytes VLAN tag + bytes for the IP datagram + 4 bytes FCS) at the link layer. You can

set the MTU of your private virtual interfaces. For more information, see MTUs for private virtual

interfaces or transit virtual interfaces.

Supported Direct Connect virtual interface types

AWS Direct Connect supports the following three virtual interface (VIF) types:

• Private virtual interface

This type of interface is used to access an Amazon Virtual Private Cloud (VPC) using private IP

addresses. With a private virtual interface you can

• Connect directly to a single VPC per private virtual interface to access those resources using

private IPs in the same Region.

• Connect a private virtual interface to a Direct Connect gateway to access multiple virtual

private gateways across any account and AWS Region (except the AWS China Regions).

• Public virtual interface

This type of virtual interface is used to access all AWS public services using public IP addresses.

With a public virtual interface you can connect to all AWS public IP addresses and services

globally.

Supported Direct Connect virtual interface types 3

AWS Direct Connect User Guide

• Transit virtual interface

This type of interface is used to access one or more Amazon VPC Transit Gateways associated

with Direct Connect gateways. With a transit virtual interface you connect multiple Amazon VPC

Transit Gateways across multiple accounts and AWS Regions (except the AWS China Regions).

Note

There are limits to the number of diﬀerent types of associations between a Direct

Connect gateway and a virtual interface. For more information about speciﬁc limits, see

the Direct Connect quotas page.

For more information about virtual interfaces, see Virtual interfaces and hosted virtual interfaces.

Pricing for Direct Connect

AWS Direct Connect has two billing elements: port hours and outbound data transfer. Port

hour pricing is determined by capacity and connection type (dedicated connection or hosted

connection).

Data Transfer Out charges for private interfaces and transit virtual interfaces are allocated to the

AWS account responsible for the Data Transfer. There are no additional charges to use a multi-

account AWS Direct Connect gateway.

For publicly addressable AWS resources (for example, Amazon S3 buckets, Classic EC2 instances,

or EC2 traﬃc that goes through an internet gateway), if the outbound traﬃc is destined for public

preﬁxes owned by the same AWS payer account and actively advertised to AWS through an AWS

Direct Connect public virtual Interface, the Data Transfer Out (DTO) usage is metered toward the

resource owner at AWS Direct Connect data transfer rate.

For more information, see AWS Direct Connect Pricing.

AWS Direct Connect maintenance

AWS Direct Connect is a fully managed service where periodically, Direct Connect performs

maintenance activities on a hardware ﬂeet that supports the service. Direct Connect connections

are provisioned on standalone hardware devices that enables you to create highly resilient network

Pricing for Direct Connect 4

AWS Direct Connect User Guide

connections between Amazon Virtual Private Cloud and your on-premises infrastructure. This

capability enables you to access your AWS resources in a reliable, scalable, and cost-eﬀective way.

For more information, see AWS Direct Connect Resiliency Recommendations.

There are two types of Direct Connect maintenance: planned and emergency maintenance:

• Planned maintenance. Planned maintenance is scheduled in advance to improve availability and

deliver new features. This type of maintenance is scheduled during a maintenance window where

we provide three notiﬁcations: 14-calendar-day, 7-calendar day, and 1-calendar day.

Note

Calendar days include non-business days and local holidays.

• Emergency maintenance. Emergency maintenance is initiated on critical basis due to a service

impacting failure that requires immediate action from AWS to restore services. This type

of maintenance isn't planned in advance. Impacted customers are notiﬁed of emergency

maintenance up to 60-minutes prior to the maintenance.

We recommend that you follow the AWS Direct Connect Resiliency Recommendations so that you

can gracefully and proactively shift traﬃc to your redundant Direct connect connection during

maintenance. We also recommend that you proactively test the resiliency of your redundant

connections on a regular basis to validate that failover works as intended. Using the the section

called “Failover Test” functionality, you can verify that your traﬃc routes through one of your

redundant virtual interfaces.

For guidance around eligibility criteria to initiate a request for planned maintenance cancellation,

see How do I cancel a Direct Connect maintenance event?.

Note

Emergency maintenance requests can't be canceled as AWS must act immediately to

restore service.

For more information about maintenance events, see Maintenance events in the AWS Direct

Connect FAQs.

Direct Connect maintenance 5

AWS Direct Connect User Guide

Access to remote AWS Regions

AWS Direct Connect locations in public Regions or AWS GovCloud (US) can access public services

in any other public Region (excluding China (Beijing and Ningxia)). In addition, AWS Direct Connect

connections in public Regions or AWS GovCloud (US) can be conﬁgured to access a VPC in your

account in any other public Region (excluding China (Beijing and Ningxia). You can therefore use a

single AWS Direct Connect connection to build multi-Region services. All networking traﬃc remains

on the AWS global network backbone, regardless of whether you access public AWS services or a

VPC in another Region.

Any data transfer out of a remote Region is billed at the remote Region data transfer rate. For

more information about data transfer pricing, see the Pricing section on the AWS Direct Connect

detail page.

For more information about the routing policies and supported BGP communities for an AWS

Direct Connect connection, see Routing policies and BGP communities.

Access to public services in a remote Region

To access public resources in a remote Region, you must set up a public virtual interface and

establish a Border Gateway Protocol (BGP) session. For more information, see Virtual interfaces and

hosted virtual interfaces.

After you have created a public virtual interface and established a BGP session to it, your router

learns the routes of the other public AWS Regions. For more information about preﬁxes currently

advertised by AWS, see AWS IP Address Ranges in the Amazon Web Services General Reference.

Access to VPCs in a remote Region

You can create a Direct Connect gateway in any public Region. Use it to connect your AWS Direct

Connect connection over a private virtual interface to VPCs in your account that are located in

diﬀerent Regions or to a transit gateway. For more information, see AWS Direct Connect gateways.

Alternatively, you can create a public virtual interface for your AWS Direct Connect connection and

then establish a VPN connection to your VPC in the remote Region. For more information about

conﬁguring VPN connectivity to a VPC, see Scenarios for Using Amazon Virtual Private Cloud in the

Amazon VPC User Guide.

Access to remote AWS Regions 6

AWS Direct Connect User Guide

Network-to-Amazon VPC Connectivity Options

The following conﬁguration can be used to connect remote networks with your Amazon VPC

environment. These options are useful for integrating AWS resources with your existing on-site

services:

• Amazon Virtual Private Cloud Connectivity Options

AWS Direct Connect routing policies and BGP communities

AWS Direct Connect applies inbound (from your on-premises data center) and outbound (from

your AWS Region) routing policies for a public AWS Direct Connect connection. You can also use

Border Gateway Protocol (BGP) community tags on routes advertised by Amazon and apply BGP

community tags on the routes you advertise to Amazon.

Public virtual interface routing policies

If you're using AWS Direct Connect to access public AWS services, you must specify the public IPv4

preﬁxes or IPv6 preﬁxes to advertise over BGP.

The following inbound routing policies apply:

• You must own the public preﬁxes and they must be registered as such in the appropriate regional

internet registry.

• Traﬃc must be destined to Amazon public preﬁxes. Transitive routing between connections is

not supported.

• AWS Direct Connect performs inbound packet ﬁltering to validate that the source of the traﬃc

originated from your advertised preﬁx.

The following outbound routing policies apply:

• AS_PATH and Longest Preﬁx Match are used to determine the routing path. AWS recommends

advertising more speciﬁc routes using AWS Direct Connect if the same preﬁx is being advertised

to both the Internet and to a public virtual interface.

• AWS Direct Connect advertises all local and remote AWS Region preﬁxes where available and

includes on-net preﬁxes from other AWS non-Region points of presence (PoP) where available;

for example, CloudFront and Route53.

Network-to-Amazon VPC Connectivity Options 7

AWS Direct Connect User Guide

Note

• Preﬁxes listed in the AWS IP address ranges JSON ﬁle, ip-ranges.json, for the AWS

China Regions are only advertised in the AWS China Regions.

• Preﬁxes listed in the AWS IP address ranges JSON ﬁle, ip-ranges.json, for the AWS

Commercial Regions are only advertised in the AWS Commercial Regions.

For more information about the ip-ranges.json ﬁle, see AWS IP address ranges in the

AWS General Reference.

• AWS Direct Connect advertises preﬁxes with a minimum path length of 3.

•

AWS Direct Connect advertises all public preﬁxes with the well-known NO_EXPORT BGP

community.

• If you advertise the same preﬁxes from two diﬀerent Regions using two diﬀerent public virtual

interfaces, and both have the same BGP attributes and longest preﬁx length, AWS will prioritize

the home Region for outbound traﬃc.

• If you have multiple AWS Direct Connect connections, you can adjust the load-sharing of

inbound traﬃc by advertising preﬁxes with the same path attributes.

• The preﬁxes advertised by AWS Direct Connect must not be advertised beyond the network

boundaries of your connection. For example, these preﬁxes must not be included in any public

internet routing table.

• AWS Direct Connect keeps preﬁxes advertised by customers within the Amazon network. We do

not re-advertise customer preﬁxes learned from a public VIF to any of the following:

• Other AWS Direct Connect customers

• Networks that peer with the AWS Global Network

• Amazon's transit providers

Public virtual interface BGP communities

AWS Direct Connect supports scope BGP community tags to help control the scope (Regional or

global) and route preference of traﬃc on public virtual interfaces. AWS treats all routes received

from a public VIF as if they were tagged with the NO_EXPORT BGP community tag, meaning only

the AWS network will use that routing information.

Public virtual interface BGP communities 8

AWS Direct Connect User Guide

Scope BGP communities

You can apply BGP community tags on the public preﬁxes that you advertise to Amazon to indicate

how far to propagate your preﬁxes in the Amazon network, for the local AWS Region only, all

Regions within a continent, or all public Regions.

AWS Region communities

For inbound routing policies, you can use the following BGP communities for your preﬁxes:

•

7224:9100—Local AWS Regions

•

7224:9200—All AWS Regions for a continent:

• North America-wide

• Asia Paciﬁc

• Europe, the Middle East and Africa

•

7224:9300—Global (all public AWS Regions)

Note

If you do not apply any community tags, preﬁxes are advertised to all public AWS Regions

(global) by default.

Preﬁxes that are marked with the same communities, and have identical AS_PATH

attributes are candidates for multi-pathing.

The communities 7224:1 – 7224:65535 are reserved by AWS Direct Connect.

For outbound routing policies, AWS Direct Connect applies the following BGP communities to its

advertised routes:

•

7224:8100—Routes that originate from the same AWS Region in which the AWS Direct Connect

point of presence is associated.

•

7224:8200—Routes that originate from the same continent with which the AWS Direct Connect

point of presence is associated.

• No tag—Routes that originate from other continents.

Public virtual interface BGP communities 9

AWS Direct Connect User Guide

Note

To receive all AWS public preﬁxes do not apply any ﬁlter.

Communities that are not supported for an AWS Direct Connect public connection are removed.

NO_EXPORT BGP community

For outbound routing policies, the NO_EXPORT BGP community tag is supported for public virtual

interfaces.

AWS Direct Connect also provides BGP community tags on advertised Amazon routes. If you use

AWS Direct Connect to access public AWS services, you can create ﬁlters based on these community

tags.

For public virtual interfaces, all routes that AWS Direct Connect advertises to customers are tagged

with the NO_EXPORT community tag.

Private virtual interface and transit virtual interface routing policies

If you're using AWS Direct Connect to access your private AWS resources, you must specify the IPv4

or IPv6 preﬁxes to advertise over BGP. These preﬁxes can be public or private.

The following outbound routing rules apply based on the preﬁxes advertised:

• AWS evaluates the longest preﬁx length ﬁrst. AWS recommends advertising more speciﬁc routes

using multiple Direct Connect virtual interfaces if the desired routing paths are meant for active/

passive connections. See Inﬂuencing Traﬃc over Hybrid Networks using Longest Preﬁx Match for

more information.

• Local preference is the BGP attribute recommended to use when desired routing paths are meant

for active/passive connections and the preﬁx lengths advertised are the same. This value is set

per Region to prefer AWS Direct Connect Locations that have the same associated AWS Region

using the 7224:7200—Medium local preference community value. Where the local Region is not

associated with the Direct Connect location, it is set to a lower value. This applies only if no local

preference community tags are assigned.

• AS_PATH length can be used to determine the routing path when the preﬁx length and local

preference are the same.

Private virtual interface and transit virtual interface routing policies 10

AWS Direct Connect User Guide

• Multi-Exit Discriminator (MED) can be used to determine the routing path when preﬁx length,

local preference, and AS_PATH are the same. AWS does not recommend using MED values given

their lower priority in evaluation.

• AWS will load-share across multiple transit or private virtual interfaces when preﬁxes have the

same length and BGP attributes.

Private virtual interface and transit virtual interface BGP communities

When an AWS Region routes traﬃc to on-premises locations via Direct Connect private or transit

virtual interfaces, the associated AWS Region of the Direct Connect location inﬂuences the ability

to use equal-cost multi-path routing (ECMP). AWS Regions prefer Direct Connect locations in

the same associated AWS Region by default. See AWS Direct Connect Locations to identify the

associated AWS Region of any Direct Connect location.

When there are no local preference community tags applied, Direct Connect supports ECMP over

private or transit virtual interfaces for preﬁxes with the same length, AS_PATH length, and MED

value over two or more paths in the following scenarios:

• The AWS Region sending traﬃc has two or more virtual interface paths from locations in the

same associated AWS Region, whether in the same or diﬀerent colocation facilities.

• The AWS Region sending traﬃc has two or more virtual interface paths from locations not in the

same Region.

Fore more information, see How do I set up an Active/Active or Active/Passive Direct Connect

connection to AWS from a private or transit virtual interface?

Note

This has no eﬀect on ECMP to an AWS Region from on-premises locations.

To control route preferences, Direct Connect supports local preference BGP community tags for

private virtual interfaces and transit virtual interfaces.

Private virtual interface and transit virtual interface routing policies 11

AWS Direct Connect User Guide

Local preference BGP communities

You can use local preference BGP community tags to achieve load balancing and route preference

for incoming traﬃc to your network. For each preﬁx that you advertise over a BGP session, you can

apply a community tag to indicate the priority of the associated path for returning traﬃc.

The following local preference BGP community tags are supported:

•

7224:7100—Low preference

•

7224:7200—Medium preference

•

7224:7300—High preference

Local preference BGP community tags are mutually exclusive. To load balance traﬃc across

multiple AWS Direct Connect connections (active/active) homed to the same or diﬀerent AWS

Regions, apply the same community tag; for example, 7224:7200 (medium preference) across

the preﬁxes for the connections. If one of the connections fails, traﬃc will be then load balance

using ECMP across the remaining active connections regardless of their home Region associations .

To support failover across multiple AWS Direct Connect connections (active/passive), apply a

community tag with a higher preference to the preﬁxes for the primary or active virtual interface

and a lower preference to the preﬁxes for the backup or passive virtual interface. For example,

set the BGP community tags for your primary or active virtual interfaces to 7224:7300 (high

preference) and 7224:7100 (low preference) for your passive virtual interfaces.

Local preference BGP community tags are evaluated before any AS_PATH attribute, and are

evaluated in order from lowest to highest preference (where highest preference is preferred).

AWS Direct Connect private virtual interface routing example

Consider the conﬁguration where the AWS Direct Connect location 1 home Region is the same

as the VPC home Region. There is a redundant AWS Direct Connect location in a diﬀerent Region

There are two private VIFs (VIF A and VIF B) from AWS Direct Connect location 1 (us-east-1) to the

Direct Connect gateway. There is one private VIF (VIF C) from AWS Direct Connect location (us-

west-1) to the Direct Connect gateway. To have AWS route traﬃc over VIF B before VIF A, set the

AS_PATH attribute of VIF B to be shorter than the VIF A AS_PATH attribute.

The VIFs have the following conﬁgurations:

• VIF A (in us-east-1) advertises 172.16.0.0/16 and has an AS_PATH attribute of 65001, 65001,

65001

Private virtual interface routing example 12

AWS Direct Connect User Guide

• VIF B (in us-east-1) advertises 172.16.0.0/16 and has an AS_PATH attribute of 65001, 65001

• VIF C (in us-west-1) advertises 172.16.0.0/16 and has an AS_PATH attribute of 65001

If you change the CIDR range conﬁguration of VIF C, routes that fall in to the VIF C CIDR range use

VIF C because it has the longest preﬁx length.

• VIF C (in us-west-1) advertises 172.16.0.0/24 and has an AS_PATH attribute of 65001

Private virtual interface routing example 13

AWS Direct Connect User Guide

AWS Direct Connect Resiliency Toolkit

AWS oﬀers customers the ability to achieve highly resilient network connections between Amazon

Virtual Private Cloud (Amazon VPC) and their on-premises infrastructure. The AWS Direct Connect

Resiliency Toolkit provides a connection wizard with multiple resiliency models. These models help

you to determine, and then place an order for the number of dedicated connections to achieve

your SLA objective. You select a resiliency model, and then the AWS Direct Connect Resiliency

Toolkit guides you through the dedicated connection ordering process. The resiliency models are

designed to ensure that you have the appropriate number of dedicated connections in multiple

locations.

The AWS Direct Connect Resiliency Toolkit has the following beneﬁts:

• Provides guidance on how you determine and then order the appropriate redundant AWS Direct

Connect dedicated connections.

• Ensures that the redundant dedicated connections have the same speed.

• Automatically conﬁgures the dedicated connection names.

• Automatically approves your dedicated connections when you have an existing AWS account and

you select a known AWS Direct Connect Partner. The Letter of Authority (LOA) is available for

immediate download.

• Automatically creates a support ticket for the dedicated connection approval when you are a

new AWS customer, or you select an unknown (Other) partner.

• Provides an order summary for your dedicated connections, with the SLA that you can achieve

and the port-hour cost for the ordered dedicated connections.

• Creates link aggregation groups (LAGs), and adds the appropriate number of dedicated

connections to the LAGs when you choose a speed other than 1 Gbps, 10 Gbps, 100 Gbps, or 400

Gbps.

• Provides a LAG summary with the dedicated connection SLA that you can achieve, and the total

port-hour cost for each ordered dedicated connection as part of the LAG.

• Prevents you from terminating the dedicated connections on the same AWS Direct Connect

device.

• Provides a way for you to test your conﬁguration for resiliency. You work with AWS to bring

down the BGP peering session in order to verify that traﬃc routes to one of your redundant

virtual interfaces. For more information, see the section called “Failover Test”.

AWS Direct Connect User Guide

• Provides Amazon CloudWatch metrics for connections and virtual interfaces. For more

information, see Monitor Direct Connect resources.

The following resiliency models are available in the AWS Direct Connect Resiliency Toolkit:

• Maximum Resiliency: This model provides you a way to order dedicated connections to achieve

an SLA of 99.99%. It requires you to meet all of the requirements for achieving the SLA that are

speciﬁed in the AWS Direct Connect Service Level Agreement.

• High Resiliency: This model provides you a way to order dedicated connections to achieve an

SLA of 99.9%. It requires you to meet all of the requirements for achieving the SLA that are

speciﬁed in the AWS Direct Connect Service Level Agreement.

• Development and Test: This model provides you a way to achieve development and test

resiliency for non-critical workloads, by using separate connections that terminate on separate

devices in one location.

• Classic. This model is intended for users that have existing connections and want to add

additional connections. This model does not provide an SLA.

The best practice is to use the Connection wizard in the AWS Direct Connect Resiliency Toolkit to

order the dedicated connections to achieve your SLA objective.

After you select the resiliency model, the AWS Direct Connect Resiliency Toolkit steps you through

the following procedures:

• Selecting the number of dedicated connections

• Selecting the connection capacity, and the dedicated connection location

• Ordering the dedicated connections

• Verifying that the dedicated connections are ready to use

• Downloading your Letter of Authority (LOA-CFA) for each dedicated connection

• Verifying that your conﬁguration meets your resiliency requirements

Prerequisites

AWS Direct Connect supports the following port speeds over single-mode ﬁber: 1000BASE-LX

(1310 nm) transceiver for 1 gigabit Ethernet, a 10GBASE-LR (1310 nm) transceiver for 10 gigabit, a

100GBASE-LR4 for 100 gigabit Ethernet, or a 400GBASE-LR4 for 400 Gbps Ethernet.

Prerequisites 15

AWS Direct Connect User Guide

You can set up an AWS Direct Connect connection in one of the following ways:

Model Bandwidth Method

Dedicated connection 1 Gbps, 10 Gbps, 100 Gbps,

and 400 Gbps

Work with an AWS Direct

Connect Partner or a network

provider to connect a router

from your data center, oﬃce,

or colocation environment

to an AWS Direct Connect

location. The network

provider does not have to

be an AWS Direct Connect

Partner to connect you to a

dedicated connection. AWS

Direct Connect dedicated

connections support these

port speeds over single-mo

de ﬁber: 1 Gbps: 1000BASE-

LX (1310 nm), 10 Gbps:

10GBASE-LR (1310 nm),

100Gbps: 100GBASE-LR4, or

400GBASE-LR4 for 400 Gbps

Ethernet.

Hosted connection 50 Mbps, 100 Mbps, 200

Mbps, 300 Mbps, 400 Mbps,

500 Mbps, 1 Gbps, 2 Gbps, 5

Gbps, 10 Gbps, and 25 Gbps.

Work with a partner in the

AWS Direct Connect Partner

Program to connect a router

from your data center, oﬃce,

or colocation environment

to an AWS Direct Connect

location.

Only certain partners provide

higher capacity connections.

Prerequisites 16

AWS Direct Connect User Guide

For connections to AWS Direct Connect with bandwidths of 1 Gbps or higher, ensure that your

network meets the following requirements:

• Your network must use single-mode ﬁber with a 1000BASE-LX (1310 nm) transceiver for 1

gigabit Ethernet, a 10GBASE-LR (1310 nm) transceiver for 10 gigabit, a 100GBASE-LR4 for 100

gigabit Ethernet, or a 400GBASE-LR4 for 400 Gbps Ethernet.

• Auto-negotiation for a port must be disabled for a connection with a port speed of more than

1 Gbps. However, depending on the AWS Direct Connect endpoint serving your connection,

auto-negotiation might need to be enabled or disabled for 1 Gbps connections. If your virtual

interface remains down, see Troubleshooting layer 2 (data link) issues.

• 802.1Q VLAN encapsulation must be supported across the entire connection, including

intermediate devices.

• Your device must support Border Gateway Protocol (BGP) and BGP MD5 authentication.

• (Optional) You can conﬁgure Bidirectional Forwarding Detection (BFD) on your network.

Asynchronous BFD is automatically enabled for each AWS Direct Connect virtual interface.

It's automatically enabled for Direct Connect virtual interfaces, but does not take eﬀect until

you conﬁgure it on your router. For more information, see Enable BFD for a Direct Connect

connection.

Make sure you have the following information before you begin your conﬁguration:

• The resiliency model that you want to use.

• The speed, location, and partner for all of your connections.

You only need the speed for one connection.

Maximum resiliency

You can achieve maximum resiliency for critical workloads by using separate connections that

terminate on separate devices in more than one location (as shown in the following ﬁgure).

This model provides resiliency against device, connectivity, and complete location failures. The

following ﬁgure shows both connections from each customer data center going to the same AWS

Direct Connect locations. You can optionally have each connection from a customer data center

going to diﬀerent locations.

Maximum resiliency 17

AWS Direct Connect User Guide

For the procedure for using the AWS Direct Connect Resiliency Toolkit to conﬁgure a maximum

resiliency model, see Conﬁgure maximum resiliency.

High resiliency

You can achieve high resiliency for critical workloads by using two single connections to multiple

locations (as shown in the following ﬁgure). This model provides resiliency against connectivity

failures caused by a ﬁber cut or a device failure. It also helps prevent a complete location failure.

High resiliency 18

AWS Direct Connect User Guide

For the procedure for using the AWS Direct Connect Resiliency Toolkit to conﬁgure a high resiliency

model, see Conﬁgure high resiliency.

Development and test

You can achieve development and test resiliency for non-critical workloads by using separate

connections that terminate on separate devices in one location (as shown in the following ﬁgure).

This model provides resiliency against device failure, but does not provide resiliency against

location failure.

Development and test 19

AWS Direct Connect User Guide

For the procedure for using the AWS Direct Connect Resiliency Toolkit to conﬁgure a maximum

resiliency model, see Conﬁgure development and test resiliency.

Classic

Select Classic when you have existing connections.

The following procedures demonstrate the common scenarios to get set up with an AWS Direct

Connect connection.

Prerequisites

For connections to AWS Direct Connect with port speeds of 1 Gbps or higher, ensure that your

network meets the following requirements:

Classic 20

AWS Direct Connect User Guide

• Your network must use single-mode ﬁber with a 1000BASE-LX (1310 nm) transceiver for 1

gigabit Ethernet, a 10GBASE-LR (1310 nm) transceiver for 10 gigabit, a 100GBASE-LR4 for 100

gigabit Ethernet, or a 400GBASE-LR4 for 400 Gbps Ethernet.

• Auto-negotiation for a port must be disabled for a connection with a port speed of more than

1 Gbps. However, depending on the AWS Direct Connect endpoint serving your connection,

auto-negotiation might need to be enabled or disabled for 1 Gbps connections. If your virtual

interface remains down, see Troubleshooting layer 2 (data link) issues.

• 802.1Q VLAN encapsulation must be supported across the entire connection, including

intermediate devices.

• Your device must support Border Gateway Protocol (BGP) and BGP MD5 authentication.

• (Optional) You can conﬁgure Bidirectional Forwarding Detection (BFD) on your network.

Asynchronous BFD is automatically enabled for each AWS Direct Connect virtual interface.

It's automatically enabled for Direct Connect virtual interfaces, but does not take eﬀect until

you conﬁgure it on your router. For more information, see Enable BFD for a Direct Connect

connection.

For the procedure for using the AWS Direct Connect Resiliency Toolkit to conﬁgure a Classic

connection, see Conﬁgure a Classic connection.

AWS Direct Connect FailoverTest

Use the AWS Direct Connect Resiliency Toolkit to verify traﬃc routes and that those routes meet

your resiliency requirements.

For the procedures for using the AWS Direct Connect Resiliency Toolkit to perform failover tests,

see Failover Test.

Use the AWS Direct Connect Resiliency Toolkit to conﬁgure

AWS Direct Connect for maximum resiliency

In this example, the AWS Direct Connect Resiliency Toolkit is used to conﬁgure a maximum

resiliency model

Tasks

• Step 1: Sign up for AWS

Failover test 21

AWS Direct Connect User Guide

• Step 2: Conﬁgure the resiliency model

• Step 3: Create your virtual interfaces

• Step 4: Verify your virtual interface resiliency conﬁguration

• Step 5: Verify your virtual interfaces connectivity

Step 1: Sign up for AWS

To use AWS Direct Connect, you need an AWS account if you don't already have one.

If you do not have an AWS account, complete the following steps to create one.

To sign up for an AWS account

1. Open https://portal.aws.amazon.com/billing/signup.

2. Follow the online instructions.

Part of the sign-up procedure involves receiving a phone call and entering a veriﬁcation code

on the phone keypad.

When you sign up for an AWS account, an AWS account root user is created. The root user

has access to all AWS services and resources in the account. As a security best practice, assign

administrative access to a user, and use only the root user to perform tasks that require root

user access.

AWS sends you a conﬁrmation email after the sign-up process is complete. At any time, you can

view your current account activity and manage your account by going to https://aws.amazon.com/

and choosing My Account.

Create a user with administrative access

After you sign up for an AWS account, secure your AWS account root user, enable AWS IAM Identity

Center, and create an administrative user so that you don't use the root user for everyday tasks.

Secure your AWS account root user

1. Sign in to the AWS Management Console as the account owner by choosing Root user and

entering your AWS account email address. On the next page, enter your password.

Step 1: Sign up for AWS 22

AWS Direct Connect User Guide

For help signing in by using root user, see Signing in as the root user in the AWS Sign-In User

Guide.

2. Turn on multi-factor authentication (MFA) for your root user.

For instructions, see Enable a virtual MFA device for your AWS account root user (console) in

the IAM User Guide.

Create a user with administrative access

1. Enable IAM Identity Center.

For instructions, see Enabling AWS IAM Identity Center in the AWS IAM Identity Center User

Guide.

2. In IAM Identity Center, grant administrative access to a user.

For a tutorial about using the IAM Identity Center directory as your identity source, see

Conﬁgure user access with the default IAM Identity Center directory in the AWS IAM Identity

Center User Guide.

• To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email

address when you created the IAM Identity Center user.

For help signing in using an IAM Identity Center user, see Signing in to the AWS access portal in

the AWS Sign-In User Guide.

Assign access to additional users

1. In IAM Identity Center, create a permission set that follows the best practice of applying least-

privilege permissions.

For instructions, see Create a permission set in the AWS IAM Identity Center User Guide.

2. Assign users to a group, and then assign single sign-on access to the group.

For instructions, see Add groups in the AWS IAM Identity Center User Guide.

Step 1: Sign up for AWS 23

AWS Direct Connect User Guide

Step 2: Conﬁgure the resiliency model

To conﬁgure a maximum resiliency model

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/

home.

2. In the navigation pane, choose Connections, and then choose Create a connection.

3. Under Connection ordering type, choose Connection wizard.

4. Under Resiliency level, choose Maximum Resiliency, and then choose Next.

5. On the Conﬁgure connections pane, under Connection settings, do the following:

a. For Bandwidth, choose the dedicated connection bandwidth.

This bandwidth applies to all of the created connections.

b. For First location service provider, select the appropriate AWS Direct Connect location for

the dedicated connection.

c. If applicable, for First Sub location, choose the ﬂoor closest to you or your network

provider. This option is only available if the location has meet-me rooms (MMRs) on multiple

ﬂoors of the building.

d. If you selected Other for First location service provider, for Name of other provider, enter

the name of the partner that you use.

e. For Second location service provider, select the appropriate AWS Direct Connect location.

f. If applicable, for Second Sub location, choose the ﬂoor closest to you or your network

provider. This option is only available if the location has meet-me rooms (MMRs) on multiple

ﬂoors of the building.

g. If you selected Other for Second location service provider, for Name of other provider,

enter the name of the partner that you use.

h. (Optional) Add or remove a tag.

[Add a tag] Choose Add tag and do the following:

• For Key, enter the key name.

• For Value, enter the key value.

[Remove a tag] Next to the tag, choose Remove tag.

6. Choose Next.

Step 2: Conﬁgure the resiliency model 24

AWS Direct Connect User Guide

7. Review your connections, and then choose Continue.

If your LOAs are ready, you can choose Download LOA, and then click Continue.

It can take up to 72 hours for AWS to review your request and provision a port for your

connection. During this time, you might receive an email with a request for more information

about your use case or the speciﬁed location. The email is sent to the email address that

you used when you signed up for AWS. You must respond within 7 days or the connection is

deleted.

Step 3: Create your virtual interfaces

You can create a private virtual interface to connect to your VPC. Or, you can create a public virtual

interface to connect to public AWS services that aren't in a VPC. When you create a private virtual

interface to a VPC, you need a private virtual interface for each VPC that you're connecting to. For

example, you need three private virtual interfaces to connect to three VPCs.

Before you begin, ensure that you have the following information:

Resource Required information

Connection The AWS Direct Connect connection or link aggregation group (LAG) for

which you are creating the virtual interface.

Virtual

interface name

A name for the virtual interface.

Virtual

interface owner

If you're creating the virtual interface for another account, you need the

AWS account ID of the other account.

(Private virtual

interface only)

Connection

For connecting to a VPC in the same AWS Region, you need the virtual

private gateway for your VPC. The ASN for the Amazon side of the BGP

session is inherited from the virtual private gateway. When you create a

virtual private gateway, you can specify your own private ASN. Otherwise,

Amazon provides a default ASN. For more information, see Create a Virtual

Private Gateway in the Amazon VPC User Guide. For connecting to a VPC

through a Direct Connect gateway, you need the Direct Connect gateway.

For more information, see Direct Connect Gateways.

Step 3: Create your virtual interfaces 25

AWS Direct Connect User Guide

Resource Required information

VLAN A unique virtual local area network (VLAN) tag that's not already in use on

your connection. The value must be between 1 and 4094 and must comply

with the Ethernet 802.1Q standard. This tag is required for any traﬃc

traversing the AWS Direct Connect connection.

If you have a hosted connection, your AWS Direct Connect Partner provides

this value. You can’t modify the value after you have created the virtual

interface.

Step 3: Create your virtual interfaces 26

AWS Direct Connect User Guide

Resource Required information

Peer IP

addresses

A virtual interface can support a BGP peering session for IPv4, IPv6, or

one of each (dual-stack). Do not use Elastic IPs (EIPs) or Bring your own IP

addresses (BYOIP) from the Amazon Pool to create a public virtual interface

. You cannot create multiple BGP sessions for the same IP addressing family

on the same virtual interface. The IP address ranges are assigned to each

end of the virtual interface for the BGP peering session.

• IPv4:

• (Public virtual interface only) You must specify unique public IPv4

addresses that you own. The value can be one of the following:

• A customer-owned IPv4 CIDR

These can be any public IPs (customer-owned or provided by AWS),

but the same subnet mask must be used for both your peer IP and

the AWS router peer IP. For example, if you allocate a /31 range, such

as 203.0.113.0/31 , you could use 203.0.113.0 for your peer

IP and 203.0.113.1 for the AWS peer IP. Or, if you allocate a /24

range, such as 198.51.100.0/24 , you could use 198.51.100.10

for your peer IP and 198.51.100.20 for the AWS peer IP.

• An IP range owned by your AWS Direct Connect Partner or ISP, along

with an LOA-CFA authorization

• An AWS-provided /31 CIDR. Contact AWS Support to request a public

IPv4 CIDR (and provide a use case in your request)

Note

We cannot guarantee that we will be able to fulﬁll all requests

for AWS-provided public IPv4 addresses.

• (Private virtual interface only) Amazon can generate private IPv4

addresses for you. If you specify your own, ensure that you specify

private CIDRs for your router interface and the AWS Direct Connect

interface only. For example, do not specify other IP addresses from your

local network. Similar to a public virtual interface, the same subnet

mask must be used for both your peer IP and the AWS router peer IP.

Step 3: Create your virtual interfaces 27

AWS Direct Connect User Guide

Resource Required information

For example, if you allocate a /30 range, such as 192.168.0.0/30 ,

you could use 192.168.0.1 for your peer IP and 192.168.0.2 for

the AWS peer IP.

• IPv6: Amazon automatically allocates you a /125 IPv6 CIDR. You cannot

specify your own peer IPv6 addresses.

Address family Whether the BGP peering session will be over IPv4 or IPv6.

BGP informati

• A public or private Border Gateway Protocol (BGP) Autonomous System

Number (ASN) for your side of the BGP session. If you are using a public

ASN, you must own it. If you are using a private ASN, you can set a custom

ASN value. For a 16-bit ASN, the value must be in the 64512 to 65534

range. For a 32-bit ASN, the value must be in the 1 to 2147483647 range.

Autonomous System (AS) prepending does not work if you use a private

ASN for a public virtual interface.

• AWS enables MD5 by default. You cannot modify this option.

• An MD5 BGP authentication key. You can provide your own, or you can let

Amazon generate one for you.

Step 3: Create your virtual interfaces 28

AWS Direct Connect User Guide

Resource Required information

(Public virtual

interface

only) Preﬁxes

you want to

advertise

Public IPv4 routes or IPv6 routes to advertise over BGP. You must advertise

at least one preﬁx using BGP, up to a maximum of 1,000 preﬁxes.

• IPv4: The IPv4 CIDR can overlap with another public IPv4 CIDR announced

using AWS Direct Connect when either of the following is true:

• The CIDRs are from diﬀerent AWS Regions. Make sure that you apply

BGP community tags on the public preﬁxes.

• You use AS_PATH when you have a public ASN in an active/passive

conﬁguration.

For more information, see Routing policies and BGP communities.

• IPv6: Specify a preﬁx length of /64 or shorter.

• You may add additional preﬁxes to an existing public VIF and advertise

those by contacting AWS support. In your support case, provide a list of

additional CIDR preﬁxes you want to add to the public VIF and advertise.

• You can specify any preﬁx length over a Direct Connect public virtual

interface. IPv4 should support anything from /1 - /32, and IPv6 should

support anything from /1 - /64.

(Private virtual

interface only)

Jumbo frames

The maximum transmission unit (MTU) of packets over AWS Direct Connect.

The default is 1500. Setting the MTU of a virtual interface to 9001 (jumbo

frames) can cause an update to the underlying physical connection if it

wasn't updated to support jumbo frames. Updating the connection disrupts

network connectivity for all virtual interfaces associated with the connectio

n for up to 30 seconds. Jumbo frames apply only to propagated routes from

AWS Direct Connect. If you add static routes to a route table that point to

your virtual private gateway, then traﬃc routed through the static routes

is sent using 1500 MTU. To check whether a connection or virtual interface

supports jumbo frames, select it in the AWS Direct Connect console and ﬁnd

Jumbo frame capable on the virtual interface General conﬁguration page.

Step 3: Create your virtual interfaces 29

AWS Direct Connect User Guide

Resource Required information

(Transit virtual

interface only)

Jumbo frames

The maximum transmission unit (MTU) of packets over AWS Direct Connect.

The default is 1500. Setting the MTU of a virtual interface to 8500 (jumbo

frames) can cause an update to the underlying physical connection if it

wasn't updated to support jumbo frames. Updating the connection disrupts

network connectivity for all virtual interfaces associated with the connectio

n for up to 30 seconds. Jumbo frames are supported up to 8500 MTU for

Direct Connect. Static routes and propagated routes conﬁgured in the

Transit Gateway Route Table will support Jumbo Frames, including from

EC2 instances with VPC static route table entries to the Transit Gateway

Attachment. To check whether a connection or virtual interface supports

jumbo frames, select it in the AWS Direct Connect console and ﬁnd Jumbo

frame capable on the virtual interface General conﬁguration page.

If your public preﬁxes or ASNs belong to an ISP or network carrier, we request additional

information from you. This can be a document using an oﬃcial company letterhead, or an email

from the company's domain name verifying that the network preﬁx/ASN can be used by you.

When you create a public virtual interface, it can take up to 72 hours for AWS to review and

approve your request.

To provision a public virtual interface to non-VPC services

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/

home.

2. In the navigation pane, choose Virtual Interfaces.

3. Choose Create virtual interface.

4. Under Virtual interface type, for Type, choose Public.

5. Under Public virtual interface settings, do the following:

a. For Virtual interface name, enter a name for the virtual interface.

b. For Connection, choose the Direct Connect connection that you want to use for this

interface.

c. For VLAN, enter the ID number for your virtual local area network (VLAN).

Step 3: Create your virtual interfaces 30

AWS Direct Connect User Guide

d. For BGP ASN, enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN)

of your gateway.

The valid values are 1-2147483647.

6. Under Additional settings, do the following:

a. To conﬁgure an IPv4 BGP or an IPv6 peer, do the following:

[IPv4] To conﬁgure an IPv4 BGP peer, choose IPv4 and do one of the following:

• To specify these IP addresses yourself, for Your router peer ip, enter the destination IPv4

CIDR address to which Amazon should send traﬃc.

• For Amazon router peer IP, enter the IPv4 CIDR address to use to send traﬃc to AWS.

[IPv6] To conﬁgure an IPv6 BGP peer, choose IPv6. The peer IPv6 addresses are

automatically assigned from Amazon's pool of IPv6 addresses. You cannot specify custom

IPv6 addresses.

b. To provide your own BGP key, enter your BGP MD5 key.

If you do not enter a value, we generate a BGP key.

c. To advertise preﬁxes to Amazon, for Preﬁxes you want to advertise, enter the IPv4 CIDR

destination addresses (separated by commas) to which traﬃc should be routed over the

virtual interface.

d. (Optional) Add or remove a tag.

[Add a tag] Choose Add tag and do the following:

• For Key, enter the key name.

• For Value, enter the key value.

[Remove a tag] Next to the tag, choose Remove tag.

7. Choose Create virtual interface.

To provision a private virtual interface to a VPC

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/

home.

2. In the navigation pane, choose Virtual Interfaces.

Step 3: Create your virtual interfaces 31

AWS Direct Connect User Guide

3. Choose Create virtual interface.

4. Under Virtual interface type, for Type, choose Private.

5. Under Private virtual interface settings, do the following:

a. For Virtual interface name, enter a name for the virtual interface.

b. For Connection, choose the Direct Connect connection that you want to use for this

interface.

c. For Gateway type, choose Virtual private gateway, or Direct Connect gateway.

d. For Virtual interface owner, choose Another AWS account, and then enter the AWS

account.

e. For Virtual private gateway, choose the virtual private gateway to use for this interface.

f. For VLAN, enter the ID number for your virtual local area network (VLAN).

g. For BGP ASN, enter the Border Gateway Protocol Autonomous System Number of your on-

premises peer router for the new virtual interface.

The valid values are 1 to 2147483647.

6. Under Additional Settings, do the following:

a. To conﬁgure an IPv4 BGP or an IPv6 peer, do the following:

[IPv4] To conﬁgure an IPv4 BGP peer, choose IPv4 and do one of the following:

• To specify these IP addresses yourself, for Your router peer ip, enter the destination IPv4

CIDR address to which Amazon should send traﬃc.

• For Amazon router peer ip, enter the IPv4 CIDR address to use to send traﬃc to AWS.

Important

If you let AWS auto-assign IPv4 addresses, a /29 CIDR will be allocated from

169.254.0.0/16 IPv4 Link-Local according to RFC 3927 for point-to-point

connectivity. AWS does not recommend this option if you intend to use the

customer router peer IP address as the source and/or destination for VPC traﬃc.

Instead you should use RFC 1918 or other addressing, and specify the address

yourself.

• For more information about RFC 1918, see Address Allocation for Private

Internets.

Step 3: Create your virtual interfaces 32

AWS Direct Connect User Guide

• For more information about RFC 3927, see Dynamic Conﬁguration of IPv4 Link-

Local Addresses.

[IPv6] To conﬁgure an IPv6 BGP peer, choose IPv6. The peer IPv6 addresses are

automatically assigned from Amazon's pool of IPv6 addresses. You cannot specify custom

IPv6 addresses.

b. To change the maximum transmission unit (MTU) from 1500 (default) to 9001 (jumbo

frames), select Jumbo MTU (MTU size 9001).

c. (Optional) Under Enable SiteLink, choose Enabled to enable direct connectivity between

Direct Connect points of presence.

d. (Optional) Add or remove a tag.

[Add a tag] Choose Add tag and do the following:

• For Key, enter the key name.

• For Value, enter the key value.

[Remove a tag] Next to the tag, choose Remove tag.

7. Choose Create virtual interface.

Step 4: Verify your virtual interface resiliency conﬁguration

After you have established virtual interfaces to the AWS Cloud or to Amazon VPC, perform a virtual

interface failover test to verify that your conﬁguration meets your resiliency requirements. For

more information, see the section called “Failover Test”.

Step 5: Verify your virtual interfaces connectivity

After you have established virtual interfaces to the AWS Cloud or to Amazon VPC, you can verify

your AWS Direct Connect connection using the following procedures.

To verify your virtual interface connection to the AWS Cloud

•

Run traceroute and verify that the AWS Direct Connect identiﬁer is in the network trace.

Step 4: Verify your virtual interface resiliency conﬁguration 33

AWS Direct Connect User Guide

To verify your virtual interface connection to Amazon VPC

1. Using a pingable AMI, such as an Amazon Linux AMI, launch an EC2 instance into the VPC that

is attached to your virtual private gateway. The Amazon Linux AMIs are available in the Quick

Start tab when you use the instance launch wizard in the Amazon EC2 console. For more

information, see Launch an Instance in the Amazon EC2 User Guide. Ensure that the security

group that's associated with the instance includes a rule permitting inbound ICMP traﬃc (for

the ping request).

2. After the instance is running, get its private IPv4 address (for example, 10.0.0.4). The Amazon

EC2 console displays the address as part of the instance details.

3. Ping the private IPv4 address and get a response.

Use the AWS Direct Connect Resiliency Toolkit to conﬁgure

AWS Direct Connect for high resiliency

In this example, the AWS Direct Connect Resiliency Toolkit is used to conﬁgure a high resiliency

model

Tasks

• Step 1: Sign up for AWS

• Step 2: Conﬁgure the resiliency model

• Step 3: Create your virtual interfaces

• Step 4: Verify your virtual interface resiliency conﬁguration

• Step 5: Verify your virtual interfaces connectivity

Step 1: Sign up for AWS

To use AWS Direct Connect, you need an AWS account if you don't already have one.

If you do not have an AWS account, complete the following steps to create one.

To sign up for an AWS account

1. Open https://portal.aws.amazon.com/billing/signup.

Conﬁgure high resiliency 34

AWS Direct Connect User Guide

2. Follow the online instructions.

Part of the sign-up procedure involves receiving a phone call and entering a veriﬁcation code

on the phone keypad.

When you sign up for an AWS account, an AWS account root user is created. The root user

has access to all AWS services and resources in the account. As a security best practice, assign

administrative access to a user, and use only the root user to perform tasks that require root

user access.

AWS sends you a conﬁrmation email after the sign-up process is complete. At any time, you can

view your current account activity and manage your account by going to https://aws.amazon.com/

and choosing My Account.

Create a user with administrative access

After you sign up for an AWS account, secure your AWS account root user, enable AWS IAM Identity

Center, and create an administrative user so that you don't use the root user for everyday tasks.

Secure your AWS account root user

1. Sign in to the AWS Management Console as the account owner by choosing Root user and

entering your AWS account email address. On the next page, enter your password.

For help signing in by using root user, see Signing in as the root user in the AWS Sign-In User

Guide.

2. Turn on multi-factor authentication (MFA) for your root user.

For instructions, see Enable a virtual MFA device for your AWS account root user (console) in

the IAM User Guide.

Create a user with administrative access

1. Enable IAM Identity Center.

For instructions, see Enabling AWS IAM Identity Center in the AWS IAM Identity Center User

Guide.

2. In IAM Identity Center, grant administrative access to a user.

Step 1: Sign up for AWS 35

AWS Direct Connect User Guide

For a tutorial about using the IAM Identity Center directory as your identity source, see

Conﬁgure user access with the default IAM Identity Center directory in the AWS IAM Identity

Center User Guide.

• To sign in with your IAM Identity Center user, use the sign-in URL that was sent to your email

address when you created the IAM Identity Center user.

For help signing in using an IAM Identity Center user, see Signing in to the AWS access portal in

the AWS Sign-In User Guide.

Assign access to additional users

1. In IAM Identity Center, create a permission set that follows the best practice of applying least-

privilege permissions.

For instructions, see Create a permission set in the AWS IAM Identity Center User Guide.

2. Assign users to a group, and then assign single sign-on access to the group.

For instructions, see Add groups in the AWS IAM Identity Center User Guide.

Step 2: Conﬁgure the resiliency model

To conﬁgure a high resiliency model

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/

home.

2. In the navigation pane, choose Connections, and then choose Create a connection.

3. Under Connection ordering type, choose Connection wizard.

4. Under Resiliency level, choose High Resiliency, and then choose Next.

5. On the Conﬁgure connections pane, under Connection settings, do the following:

a. For bandwidth, choose the connection bandwidth.

This bandwidth applies to all of the created connections.

Step 2: Conﬁgure the resiliency model 36

AWS Direct Connect User Guide

b. For First location service provider, select the appropriate AWS Direct Connect location.

c. If applicable, for First Sub location, choose the ﬂoor closest to you or your network

provider. This option is only available if the location has meet-me rooms (MMRs) on multiple

ﬂoors of the building.

d. If you selected Other for First location service provider, for Name of other provider, enter

the name of the partner that you use.

e. For Second location service provider, select the appropriate AWS Direct Connect location.

f. If applicable, for Second Sub location, choose the ﬂoor closest to you or your network

provider. This option is only available if the location has meet-me rooms (MMRs) on multiple

ﬂoors of the building.

g. If you selected Other for Second location service provider, for Name of other provider,

enter the name of the partner that you use.

h. (Optional) Add or remove a tag.

[Add a tag] Choose Add tag and do the following:

• For Key, enter the key name.

• For Value, enter the key value.

[Remove a tag] Next to the tag, choose Remove tag.

6. Choose Next.

7. Review your connections, and then choose Continue.

If your LOAs are ready, you can choose Download LOA, and then click Continue.

It can take up to 72 hours for AWS to review your request and provision a port for your

connection. During this time, you might receive an email with a request for more information

about your use case or the speciﬁed location. The email is sent to the email address that

you used when you signed up for AWS. You must respond within 7 days or the connection is

deleted.

Step 3: Create your virtual interfaces

You can create a private virtual interface to connect to your VPC. Or, you can create a public virtual

interface to connect to public AWS services that aren't in a VPC. When you create a private virtual

Step 3: Create your virtual interfaces 37

AWS Direct Connect User Guide

interface to a VPC, you need a private virtual interface for each VPC that you're connecting to. For

example, you need three private virtual interfaces to connect to three VPCs.

Before you begin, ensure that you have the following information:

Resource Required information

Connection The AWS Direct Connect connection or link aggregation group (LAG) for

which you are creating the virtual interface.

Virtual

interface name

A name for the virtual interface.

Virtual

interface owner

If you're creating the virtual interface for another account, you need the

AWS account ID of the other account.

(Private virtual

interface only)

Connection

For connecting to a VPC in the same AWS Region, you need the virtual

private gateway for your VPC. The ASN for the Amazon side of the BGP

session is inherited from the virtual private gateway. When you create a

virtual private gateway, you can specify your own private ASN. Otherwise,

Amazon provides a default ASN. For more information, see Create a Virtual

Private Gateway in the Amazon VPC User Guide. For connecting to a VPC

through a Direct Connect gateway, you need the Direct Connect gateway.

For more information, see Direct Connect Gateways.

VLAN A unique virtual local area network (VLAN) tag that's not already in use on

your connection. The value must be between 1 and 4094 and must comply

with the Ethernet 802.1Q standard. This tag is required for any traﬃc

traversing the AWS Direct Connect connection.

If you have a hosted connection, your AWS Direct Connect Partner provides

this value. You can’t modify the value after you have created the virtual

interface.

Peer IP

addresses

A virtual interface can support a BGP peering session for IPv4, IPv6, or

one of each (dual-stack). Do not use Elastic IPs (EIPs) or Bring your own IP

addresses (BYOIP) from the Amazon Pool to create a public virtual interface

. You cannot create multiple BGP sessions for the same IP addressing family

Step 3: Create your virtual interfaces 38