AWS Direct Connect Gateway: Multi-Region Hybrid Connectivity – SAP-C02 Study Guide

Purpose of This Lesson

AWS Direct Connect (DX) is regional, but enterprise networks often need private connectivity from one on-premises data center to VPCs in multiple AWS Regions. AWS Direct Connect Gateway (DXGW) provides a global logical routing construct that can use a Direct Connect connection in one geographic location to reach VPCs in other Regions.

This lesson focuses on the DXGW topology, its relationship with virtual private gateways and transit gateways, supported routing patterns, and the communication paths that are not supported.

Key Concepts

Direct Connect is regional

A Direct Connect connection enters AWS through a Direct Connect location. Without a Direct Connect Gateway, a private virtual interface (private VIF) generally connects through a virtual private gateway (VGW) to a VPC in the same Region as the Direct Connect connection.

For multiple Regions, this can create an inefficient design:

• A private VIF and Direct Connect connection may be required for each Region.
• The on-premises data center may need connectivity to multiple geographically distant DX locations.
• Long-distance private circuits can increase cost, latency, and operational complexity.

Direct Connect Gateway is globally available

A DXGW is a global resource. It can be created in one AWS Region and associated with supported gateways in other Regions. The physical location of the Direct Connect connection does not restrict the DXGW to that Region.

A DXGW can be associated with:

• Virtual private gateways (VGWs) for VPC connectivity across Regions.
• An AWS Transit Gateway (TGW) when the design requires centralized connectivity to multiple VPCs, typically within a Region.

The exact VIF type depends on the gateway association:

• Use a private VIF when connecting to a DXGW associated with VGWs.
• Use a transit VIF when connecting to a DXGW associated with a Transit Gateway.

Typical multi-Region VGW topology

A common design uses the following path:

On-premises router → Direct Connect connection → private VIF → Direct Connect Gateway → VGW → VPC

The DXGW can be associated with multiple VGWs, including VGWs in different AWS Regions. BGP advertises the reachable VPC prefixes through the DX connection, allowing on-premises networks to reach the associated VPCs.

This design avoids requiring the data center to establish a separate long-distance connection to a DX location in every target Region.

DXGW is not a general-purpose VPC transit mesh

A DXGW enables on-premises connectivity to associated VPCs, but it does not provide unrestricted east-west routing between those VPCs. In particular, VPCs connected through VGWs to the same DXGW cannot communicate directly with one another through the DXGW.

For VPC-to-VPC connectivity, centralized routing, inspection, or broader network transit, use an architecture based on AWS Transit Gateway, VPC peering, or another explicitly supported networking pattern.

Routing and BGP

BGP is used to exchange routes over Direct Connect. In a DXGW design, the relevant VPC prefixes are advertised toward the on-premises network. Route tables and security controls still determine whether traffic can actually flow.

A successful design must validate all of the following:

• The VPC route table contains a route back to the on-premises prefixes.
• The on-premises router learns or statically configures routes to the VPC CIDR blocks.
• Security groups and network ACLs permit the required traffic.
• The VPC CIDR blocks do not overlap.
• The selected VIF type matches the gateway association.

Architecture Decision Guide

Requirement	Recommended design	Important consideration
Connect one on-premises network to one VPC	Direct Connect with a private VIF and VGW	A DXGW may be unnecessary unless future expansion is expected.
Connect one data center to VPCs in multiple Regions	DXGW associated with multiple VGWs	Use private VIFs; VPC CIDR blocks must not overlap.
Connect to many VPCs with centralized routing in one Region	Direct Connect Gateway associated with a Transit Gateway	Use a transit VIF and design TGW route tables deliberately.
Provide direct VPC-to-VPC connectivity	Transit Gateway, VPC peering, or another supported inter-VPC design	A DXGW alone does not create a VPC mesh.
Use public AWS service endpoints over Direct Connect	Public VIF	A public VIF cannot be attached to a DXGW.
Connect one private VIF to multiple DXGWs	Not supported	A private VIF can be attached to only one DXGW.

Exam-Relevant Takeaways

• Direct Connect Gateway is globally available, even though Direct Connect connections and VPCs are regional resources.
• A DXGW can connect a single Direct Connect location to VPCs in multiple Regions through associated VGWs.
• A private VIF is used with a DXGW associated with VGWs.
• A transit VIF is used when the DXGW is associated with a Transit Gateway.
• A DXGW does not provide direct communication between VPCs associated through VGWs.
• A DXGW does not provide communication between VIFs attached to the same DXGW.
• A VIF attached to a DXGW cannot communicate directly with a VPN connection on a VGW associated with that same DXGW.
• A VGW cannot be associated with more than one DXGW.
• A private VIF cannot be attached to more than one DXGW.
• Public VIFs cannot be attached to a DXGW.
• Overlapping CIDR blocks are not permitted for the VPCs associated with a DXGW.

Common Exam Traps

Confusing global scope with global network transit

A DXGW being globally available does not mean it automatically creates a full mesh between all associated VPCs. Its purpose is to extend Direct Connect connectivity to supported gateways, not to replace Transit Gateway for all routing use cases.

Selecting a public VIF for a DXGW

Public VIFs provide access to public AWS services. They are not used to connect a DXGW to private VPC networks. For VPC access through VGWs, select a private VIF.

Assuming one VGW can use multiple DXGWs

A VGW can be associated with only one DXGW. If the question describes two DXGWs for redundancy or independent routing domains, verify the supported architecture rather than attaching both to the same VGW.

Ignoring VPC CIDR overlap

Overlapping CIDR blocks prevent clean route advertisement and are an explicit DXGW limitation. Multi-Region hybrid designs should allocate non-overlapping address space from the beginning.

Treating DXGW as a replacement for Transit Gateway

If the requirement includes VPC-to-VPC communication, centralized inspection, segmentation, or hub-and-spoke routing across many VPCs, evaluate Transit Gateway. DXGW alone only addresses the Direct Connect gateway association and supported route exchange.

Forgetting the VIF type

The answer may be technically close but still wrong if it selects a private VIF for a Transit Gateway association. Use a transit VIF for a DXGW-to-TGW design and a private VIF for a DXGW-to-VGW design.

Real-World Engineer Notes

• A DXGW can reduce the need for separate Direct Connect connectivity to every Region, but it does not eliminate the need for resilient physical connectivity. Consider redundant Direct Connect connections, diverse DX locations, and backup VPN connectivity where appropriate.
• Route advertisement is only one part of the design. Confirm return routes, security groups, network ACLs, firewall policies, and on-premises routing behavior.
• Allocate unique, non-overlapping CIDR ranges across all VPCs that may participate in the hybrid network. Renumbering after deployment is disruptive.
• Use Transit Gateway route tables to separate environments such as production, development, shared services, and inspection networks when centralized routing is required.
• A single DX connection or DXGW does not by itself provide high availability. Physical-path diversity and independent devices are separate architecture decisions.
• Document which prefixes are advertised from on premises and which VPC prefixes are accepted. BGP policy can help control route scope and prevent accidental propagation.

Quick Reference Summary

• DXGW scope: Global.
• Primary purpose: Extend Direct Connect connectivity to supported gateways and VPCs across Regions.
• VGW topology: DX connection → private VIF → DXGW → VGW → VPC.
• Transit Gateway topology: DX connection → transit VIF → DXGW → TGW → attached VPCs.
• Multi-Region VPC access: Supported through multiple VGW associations.
• VPC-to-VPC routing through DXGW: Not supported for VPCs associated through VGWs.
• Public VIF to DXGW: Not supported.
• CIDR requirement: Associated VPC CIDR blocks must not overlap.
• VGW association limit: A VGW cannot be associated with more than one DXGW.
• Private VIF association limit: A private VIF cannot be attached to more than one DXGW.

Flashcards

1. Q: What problem does Direct Connect Gateway solve?

A: It allows Direct Connect connectivity from a connection in one location to supported VPC gateways in multiple AWS Regions, reducing the need for separate regional DX connectivity.

1. Q: Is Direct Connect Gateway regional or global?

A: It is a globally available resource.

1. Q: Which gateway types can be associated with a DXGW?

A: Virtual private gateways and a Transit Gateway.

1. Q: Which VIF is used to connect a DXGW to VGWs?

A: A private VIF.

1. Q: Which VIF is used to connect a DXGW to a Transit Gateway?

A: A transit VIF.

1. Q: Can a DXGW create direct communication between VPCs connected through VGWs?

A: No. A DXGW does not provide direct VPC-to-VPC communication in that topology.

1. Q: Can a public VIF be attached to a DXGW?

A: No.

1. Q: What CIDR constraint applies to VPCs associated with a DXGW?

A: Their CIDR blocks must not overlap.

1. Q: Can one VGW be associated with multiple DXGWs?

A: No. A VGW can be associated with only one DXGW.

1. Q: Can one private VIF be attached to multiple DXGWs?

A: No. It can be attached to only one DXGW.

1. Q: What protocol advertises routes over Direct Connect?

A: BGP.

1. Q: What AWS service is usually considered when VPC-to-VPC transit is required?

A: AWS Transit Gateway, although VPC peering or other supported designs may also apply depending on the requirements.

Practice Questions

Question 1

A company has one corporate data center in the United States and VPCs in us-west-1 and eu-central-1. It wants private connectivity to both VPCs but does not want to establish a separate long-distance Direct Connect connection to Europe. The VPC CIDR blocks do not overlap. Which design best meets the requirement?

Correct answer: Create a Direct Connect Gateway, attach a private VIF to it, and associate the DXGW with the VGW for each VPC.

Explanation: A DXGW is globally available and can associate with VGWs in multiple Regions. The private VIF provides the connection from the Direct Connect location to the DXGW, which then reaches the regional VGWs.

Question 2

A network architect wants VPCs connected to the same DXGW through VGWs to communicate directly with one another. Which statement is correct?

Correct answer: The DXGW does not support direct communication between those VPCs; a Transit Gateway or another supported inter-VPC design is required.

Explanation: DXGW extends Direct Connect connectivity to associated gateways but does not function as a general-purpose VPC transit mesh.

Question 3

An organization wants to connect its on-premises network through Direct Connect to a Transit Gateway that routes traffic among dozens of VPCs. Which VIF should be used?

Correct answer: A transit VIF connected to a DXGW associated with the Transit Gateway.

Explanation: Transit VIFs are used for Direct Connect connectivity to Transit Gateway associations. A private VIF is used for a DXGW associated with VGWs.

Question 4

An architect proposes attaching one private VIF to two DXGWs so that the VIF can provide connectivity to two independent routing domains. What is the issue with this proposal?

Correct answer: A private VIF cannot be attached to more than one DXGW.

Explanation: The VIF-to-DXGW association is constrained to one DXGW. Redundancy or routing separation must be designed using supported DX connections, VIFs, gateways, and routing policies.

Question 5

A company associates a DXGW with several VGWs. Two of the associated VPCs use overlapping CIDR ranges. What is the primary design problem?

Correct answer: Overlapping CIDR blocks are not supported for VPCs associated with the DXGW.

Explanation: Route advertisement and forwarding become ambiguous when the same address space represents multiple VPCs. The VPC networks must use non-overlapping CIDR ranges before this topology can be implemented.