Direct Connect

The illustration depicts that our data center is connected to the partner router, partner router is connected to the AWS Direct Connect endpoint, which is then connected to the VGW. Black lines show the private connection (private VIFs), while blue lines show the public connection (public VIFs).

AWS DX components

There are two main components of DX: Connections and Virtual Interfaces. Connections manage the connectivity from on-premises locations to the AWS Region, and Virtual Interfaces (VIFs) enable access to the AWS services. 

Virtual interfaces

There are three types of Virtual Interfaces (VIFs); we must create one to use the AWS Direct Connect.

• Private virtual interface: This is used to access private AWS resources using a private IP address.

• Public virtual interface: This is used to access all the public AWS resources using a public IP address.

• Transit virtual interface: This accesses the Transit Gateways connected with the AWS Direct Connect Gateway. We can also use Transit VIF with both dedicated or hosted connections. 

AWS DX network requirements

Here are some network requirements that must be met to use Direct Connect.

• DX supports only 802.1Q VLAN encapsulation—all the resources that are a part of the connection to link our network to the AWS must support 802.1Q. 

• For AWS Direct Connect locations, we have three options to choose from.  

  • Collocating with the existing AWS Direct Connect location: We are responsible for setting up connections between the on-premises network, Direct Connect location, and AWS.

  • Working with AWS Direct Connect Partners: If we select a partner from the AWS Partner Networks (APN), the DX partner will provide the necessary equipment. We usually need to set up a physical connection from the on-premises network to the DX partner’s equipment in this option. The DX partner manages the rest. 

  • Direct Connect node: A direct connection is established from the on-premises location to the DX node. We are responsible for setting up all the equipment from our location to the DX node.

• AWS supports three types of ethernet connections which are 1 Gbps, 10 Gbps, and 100 Gbps. The ethernet connection must be single-mode fiber.

• AWS DX supports both IPv4 and IPv6 protocols. 

Connection types

AWS Direct Connect supports two ethernet connections to create a dedicated network connection between our on-premises network and VPC. 

• Dedicated connection: A physical connection given to a single customer. We have to request AWS for the dedicated connection. The bandwidth can be 1 Gbps, 10 Gbps, or 100 Gbps.

• Hosted connection: A physical connection that can be requested using the AWS Direct Connect Partner. The capacity can be added or removed on our demand. 

Note: The overall time to create a new connection of either type is usually more than one month. So, if you are asked to develop a solution to transfer the data in a short time, then you can’t use AWS Direct Connect. 

Encryption and resiliency

Although AWS Direct Connect is a private connection, the data in transition is not encrypted. We can add a VPN to our connection to encrypt the data and make it an IPsec-encrypted private connection. 

We have two types of resiliency models in Direct Connect, and the selection depends on our use case, whether we want high resilience or maximum resilience.

• In high resiliency, we create single connections from AWS to multiple locations.

• In maximum resiliency, two separate connections are created for separate devices in more than one location. 

AWS Direct Connect gateway

Imagine we have multiple VPCs that we want to connect to the corporate data center. AWS Direct Connect gateway allows us to connect these multiple VPCs in different AWS Regions but in the same account. We add a Direct Connect Gateway in the path from the AWS Direct Connect locations to the AWS Regions through VIFs. Then, we connect them to the VPCs in different Regions.