Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Site-to-Site VPN is used to securely connect an on-premises network, branch office, or data center to AWS over an encrypted IPsec VPN tunnel. This is a foundational hybrid networking service and is important for the SAP-C02 exam because many architecture scenarios involve connecting existing corporate environments to AWS VPCs.
For the AWS Solutions Architect Professional exam, you need to understand when Site-to-Site VPN is appropriate, how it compares to AWS Direct Connect, how routing works, and how VPN connectivity can be scaled through AWS Transit Gateway or AWS CloudHub.
Key Concepts
AWS Site-to-Site VPN Overview
AWS Site-to-Site VPN is a managed IPsec VPN service that creates encrypted connectivity between an AWS environment and an external network.
Common use cases include:
- Connecting a corporate data center to a VPC
- Connecting branch offices to AWS
- Providing temporary hybrid connectivity during a migration
- Encrypting traffic over the internet
- Adding encryption on top of private connectivity such as AWS Direct Connect
Site-to-Site VPN is often called an AWS managed VPN because AWS manages the VPN endpoint on the AWS side. The customer is still responsible for the VPN device and configuration on the on-premises side.
VPN Connectivity Options in AWS
AWS provides several VPN-related connectivity options.
Site-to-Site VPN
Site-to-Site VPN connects a network location, such as a data center or branch office, to AWS. It uses IPsec tunnels and is typically used for hybrid cloud connectivity.
AWS Client VPN
AWS Client VPN is a managed client-based VPN service. It is used when individual users need secure remote access into AWS or corporate resources.
Use Client VPN when the requirement is user-to-network access.
Use Site-to-Site VPN when the requirement is network-to-network access.
AWS VPN CloudHub
AWS VPN CloudHub is a hub-and-spoke model using multiple Site-to-Site VPN connections. It allows multiple remote sites to communicate through AWS.
This is useful when a company has multiple branch offices or data centers and wants AWS to act as the central routing hub.
Third-Party Software VPN Appliance
You can also deploy a third-party VPN appliance on an EC2 instance. This may be useful when an organization requires a specific vendor solution or advanced features not provided by AWS-managed VPN.
However, this model shifts more operational responsibility to you, including patching, scaling, availability, and appliance licensing.
Core Components of AWS Site-to-Site VPN
Virtual Private Gateway
A Virtual Private Gateway, or VGW, is the AWS-side VPN endpoint that attaches to a VPC.
The VGW allows the VPC to communicate with the on-premises customer network over the Site-to-Site VPN connection.
In a traditional single-VPC VPN design, the VGW is the target used in the VPC route table for traffic destined to the on-premises network.
Example route table logic:
| Destination | Target |
|---|---|
| VPC CIDR | local |
| On-premises CIDR | Virtual Private Gateway |
This tells AWS that traffic destined for the corporate network should be sent to the VPN connection through the VGW.
Customer Gateway
A Customer Gateway, or CGW, represents the customer-side endpoint.
There are two meanings to understand:
| Term | Meaning |
|---|---|
| Customer Gateway resource in AWS | A configuration object that represents the on-premises VPN device |
| Physical customer gateway device | The actual router, firewall, or VPN concentrator in the data center or branch office |
The AWS CGW configuration must map to the real-world public endpoint and routing configuration of the customer’s VPN device.
VPN Connection
The VPN connection links the AWS-side gateway and the customer gateway. AWS creates redundant VPN tunnels for high availability.
A standard AWS Site-to-Site VPN connection includes two tunnels. The customer-side device should be configured to use both tunnels for resiliency.
IPsec VPN Tunnels
AWS Site-to-Site VPN uses IPsec to encrypt traffic between AWS and the customer network.
Important security features include:
- IPsec encryption
- IKEv1 or IKEv2 support
- AES-256 encryption
- SHA-2 hashing
- Tunnel redundancy
From an exam perspective, remember that Site-to-Site VPN provides encrypted connectivity, usually over the public internet.
Routing Options
AWS Site-to-Site VPN supports both static routing and dynamic routing with BGP.
Static Routing
With static routing, routes are manually configured.
Static routing may be appropriate when:
- The network is simple
- There are only a few known on-premises CIDR blocks
- The customer device does not support BGP
- Route changes are rare
The downside is operational overhead. If on-premises networks change, routes must be manually updated.
Dynamic Routing with BGP
BGP, or Border Gateway Protocol, allows AWS and the customer gateway to dynamically exchange routes.
BGP is usually preferred for more advanced or resilient architectures because it supports:
- Dynamic route advertisement
- Better failover behavior
- Reduced manual route maintenance
- More scalable hybrid routing
For the SAP-C02 exam, BGP is usually the better answer when the scenario emphasizes high availability, automatic failover, or changing network routes.
High Availability and Dual Tunnels
AWS provides two VPN tunnels per Site-to-Site VPN connection.
This is important because a single tunnel should not be treated as highly available. The customer gateway device should be configured to use both tunnels.
If one tunnel becomes unavailable, traffic should fail over to the second tunnel.
However, failover depends heavily on the customer-side routing configuration. If static routing is used, failover may require manual intervention or additional configuration on the customer device. With BGP, failover can be more automated.
Transit Gateway Integration
AWS Site-to-Site VPN can connect to AWS Transit Gateway.
This is a major architecture decision point for the SAP-C02 exam.
Instead of attaching a VPN directly to a single VPC through a Virtual Private Gateway, you can terminate the VPN on a Transit Gateway and use that Transit Gateway to route traffic to multiple VPCs.
Use Transit Gateway when:
- Multiple VPCs need access to the same on-premises network
- You need centralized routing
- You want scalable hub-and-spoke networking
- You are connecting many VPCs, accounts, or remote networks
- You want to simplify hybrid network management
This is usually better than creating separate VPN connections to each VPC.
AWS VPN CloudHub
AWS VPN CloudHub allows multiple remote networks to connect using Site-to-Site VPN connections in a hub-and-spoke model.
For example:
- Branch office A connects to AWS
- Branch office B connects to AWS
- Data center connects to AWS
- AWS acts as the hub between those sites
CloudHub is useful when there are multiple remote locations that need to communicate with AWS and potentially with each other.
For larger, more modern architectures, Transit Gateway is often the preferred hub for scalable routing.
Site-to-Site VPN Over the Internet
Most Site-to-Site VPN deployments run over the public internet.
This makes them relatively fast to provision and cost-effective, but it introduces performance variability.
Because AWS does not control the entire internet path, latency, jitter, packet loss, and throughput can vary.
This matters for applications that are sensitive to:
- Latency
- Packet loss
- Consistent throughput
- Large data transfers
- Real-time communication
- Database replication
For predictable private network performance, AWS Direct Connect may be a better design.
Site-to-Site VPN Over Direct Connect
Although VPN commonly runs over the internet, it can also be used with AWS Direct Connect.
This design can provide encryption over a private Direct Connect path.
This may be relevant when:
- The organization wants private connectivity
- The organization also requires encryption in transit
- Compliance requires encrypted network traffic
- Direct Connect alone does not satisfy encryption requirements
Direct Connect provides private connectivity, but traffic is not automatically encrypted at the network layer. Site-to-Site VPN can be layered on top to add encryption.
Performance Limitations
AWS Site-to-Site VPN has performance limits that matter in exam scenarios.
Key limits from the lesson:
| Limit | Value |
|---|---|
| Maximum bandwidth per VPN tunnel | 1.25 Gbps |
| Single TCP flow limit | 256 Mbps |
| Tunnels per VPN connection | 2 |
The single TCP flow limit is especially important. Even if the VPN tunnel supports up to 1.25 Gbps, one individual TCP session may not be able to use the full tunnel bandwidth.
This can affect workloads such as:
- Large file transfers
- Backup replication
- Database synchronization
- Migration tools using limited TCP sessions
- High-throughput applications
For higher, more predictable bandwidth, Direct Connect is often a stronger answer.
Security Considerations
Site-to-Site VPN encrypts traffic using IPsec, making it suitable for secure hybrid connectivity.
Security considerations include:
- Use strong encryption settings
- Prefer IKEv2 where supported
- Ensure customer gateway devices are patched
- Limit route propagation to required networks
- Monitor tunnel health
- Avoid overly broad CIDR advertisements
- Use logging and monitoring for VPN state changes
The AWS side is managed, but the customer-side VPN appliance is still your operational responsibility.
Cost Considerations
Site-to-Site VPN is generally cheaper and faster to deploy than Direct Connect.
It is often a good fit for:
- Pilot migrations
- Development connectivity
- Backup connectivity
- Lower-bandwidth hybrid access
- Temporary network extension
- Encrypted connectivity when performance is not the main driver
However, if the workload requires consistent high throughput, low latency, or dedicated private connectivity, Direct Connect may be more cost-effective operationally despite higher setup complexity.
Exam-Relevant Takeaways
For the SAP-C02 exam, remember these points:
- AWS Site-to-Site VPN is used for encrypted network-to-network connectivity between AWS and on-premises environments.
- It uses IPsec tunnels.
- The AWS side uses a Virtual Private Gateway or Transit Gateway.
- The customer side uses a Customer Gateway, which maps to a real VPN router, firewall, or concentrator.
- Each VPN connection provides two tunnels for redundancy.
- Static routes are simple but less flexible.
- BGP is preferred for dynamic routing and better failover.
- Site-to-Site VPN can connect to Transit Gateway when multiple VPCs need shared hybrid connectivity.
- VPN over the internet is encrypted but subject to internet performance variability.
- Direct Connect is better for predictable private connectivity.
- VPN can be used over Direct Connect when encryption is required.
- Site-to-Site VPN has throughput limits, including a per-tunnel limit and a single TCP flow limit.
- For multiple branch offices, CloudHub or Transit Gateway may be relevant.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| Connect one on-premises data center to one VPC securely over the internet | AWS Site-to-Site VPN with Virtual Private Gateway | Simple encrypted hybrid connectivity for a single VPC |
| Connect multiple VPCs to the same on-premises network | AWS Site-to-Site VPN with Transit Gateway | Centralized routing and shared hybrid connectivity across VPCs |
| Support dynamic route updates and automatic failover | Site-to-Site VPN with BGP | BGP supports dynamic routing and better failover behavior |
| Simple VPN with a small number of fixed on-premises CIDR blocks | Site-to-Site VPN with static routes | Easier configuration when the network is small and stable |
| Individual remote users need VPN access to AWS resources | AWS Client VPN | Client VPN is designed for user-to-network access |
| Multiple branch offices need hub-and-spoke VPN connectivity through AWS | AWS VPN CloudHub or Transit Gateway | Supports multiple remote networks connecting through AWS |
| Need predictable low-latency private connectivity | AWS Direct Connect | Direct Connect avoids the variability of internet-based VPN |
| Need encrypted traffic over a private Direct Connect circuit | Site-to-Site VPN over Direct Connect | Adds IPsec encryption to private connectivity |
| Need vendor-specific VPN features not provided by AWS-managed VPN | Third-party VPN appliance on EC2 | Allows custom VPN software, but adds operational responsibility |
| High-bandwidth migration or replication workload exceeds VPN limits | AWS Direct Connect | Better suited for consistent high-throughput hybrid connectivity |
Common Exam Traps
Trap 1: Choosing Site-to-Site VPN When the Scenario Requires Predictable Performance
Site-to-Site VPN is encrypted and quick to deploy, but internet-based VPN does not provide guaranteed latency or bandwidth. If the question emphasizes consistent performance, private connectivity, or high throughput, Direct Connect is often the better answer.
Trap 2: Confusing Client VPN with Site-to-Site VPN
Client VPN is for individual users connecting into AWS.
Site-to-Site VPN is for connecting entire networks, such as data centers or branch offices.
Trap 3: Ignoring Transit Gateway in Multi-VPC Designs
If multiple VPCs need access to the same on-premises environment, do not default to separate VPN connections for every VPC. Transit Gateway is usually the scalable architecture.
Trap 4: Assuming Both VPN Tunnels Automatically Mean Perfect Failover
AWS provides two tunnels, but the customer gateway must be configured correctly. Without BGP or proper routing behavior, failover may not be automatic.
Trap 5: Forgetting the Single TCP Flow Limit
A VPN tunnel may support more aggregate bandwidth than a single TCP session can use. If a workload depends on one large TCP stream, it may not achieve full tunnel throughput.
Trap 6: Assuming Direct Connect Is Encrypted by Default
Direct Connect provides private connectivity, but not automatic IPsec encryption. If encryption is required, use VPN over Direct Connect or another encryption method.
Trap 7: Using Static Routes for a Complex Hybrid Network
Static routes may work for simple networks, but they become operationally painful as the number of networks grows. BGP is usually preferred for dynamic and resilient hybrid routing.
Real-World Engineer Notes
In real environments, Site-to-Site VPN is often the first hybrid connectivity option because it is quick to deploy and does not require a telecommunications provider circuit. It is useful for migrations, proof-of-concepts, disaster recovery access, and smaller hybrid workloads.
However, production-grade hybrid networking requires careful planning.
Key operational concerns include:
- Monitoring both tunnels
- Testing failover before production cutover
- Verifying route propagation
- Coordinating firewall rules on both sides
- Confirming phase 1 and phase 2 IPsec settings
- Documenting customer gateway public IPs
- Ensuring on-premises devices support IKEv1 or IKEv2
- Watching for asymmetric routing
- Avoiding overlapping CIDR blocks
- Reviewing bandwidth and latency requirements
From an infrastructure engineer’s perspective, the AWS side is usually the easier half. The harder work is often on the customer edge firewall or router, especially when multiple teams manage networking, security, and cloud separately.
For enterprise environments, Transit Gateway is commonly used as the central hub. It simplifies connectivity when there are many VPCs, AWS accounts, and remote locations. Without a hub design, VPN sprawl can become difficult to manage.
For critical workloads, test real throughput instead of assuming the maximum VPN limit will be achieved. Application behavior, TCP windowing, latency, packet loss, and number of flows can all affect performance.
Quick Reference Summary
AWS Site-to-Site VPN provides encrypted IPsec connectivity between AWS and an on-premises network. The AWS side uses a Virtual Private Gateway or Transit Gateway, while the customer side uses a Customer Gateway that represents a real VPN device.
Each VPN connection includes two tunnels for high availability. Routing can be static or dynamic with BGP. Static routing is simple, but BGP is better for dynamic routing and failover.
Use Site-to-Site VPN for secure hybrid connectivity when fast deployment and encryption are important. Use Transit Gateway when multiple VPCs need shared access to the VPN. Use Direct Connect when the requirement is predictable private connectivity, higher throughput, or lower latency. Use VPN over Direct Connect when encryption is also required.
Flashcards
Q: What is AWS Site-to-Site VPN used for?
A: It is used to create encrypted network-to-network connectivity between an on-premises environment and AWS.
Q: What protocol does AWS Site-to-Site VPN use?
A: It uses IPsec.
Q: What is a Virtual Private Gateway?
A: A Virtual Private Gateway is the AWS-side VPN endpoint that attaches to a VPC.
Q: What is a Customer Gateway in AWS?
A: It is an AWS configuration object representing the customer-side VPN device, such as a router, firewall, or VPN concentrator.
Q: How many tunnels does an AWS Site-to-Site VPN connection provide?
A: Two tunnels are provided for redundancy.
Q: Which routing protocol is commonly used for dynamic routing with AWS Site-to-Site VPN?
A: BGP.
Q: When should you prefer BGP over static routing?
A: When you need dynamic route exchange, better failover, or a more scalable hybrid network.
Q: When should you use Transit Gateway with Site-to-Site VPN?
A: When multiple VPCs need to share connectivity to an on-premises network.
Q: What is AWS Client VPN used for?
A: It is used for individual user VPN access into AWS or corporate resources.
Q: What is AWS VPN CloudHub?
A: It is a hub-and-spoke VPN model that connects multiple remote sites through AWS.
Q: What is a key performance limitation of Site-to-Site VPN?
A: VPN performance can vary over the internet, and there are bandwidth limits per tunnel and per TCP flow.
Q: What is the stated maximum bandwidth per VPN tunnel in the lesson?
A: 1.25 Gbps per VPN tunnel.
Q: What is the stated single TCP flow limit in the lesson?
A: 256 Mbps per single TCP flow.
Q: Why might you run VPN over Direct Connect?
A: To add IPsec encryption over a private Direct Connect connection.
Q: Is Direct Connect encrypted by default?
A: No. Direct Connect provides private connectivity, but encryption must be added separately if required.
Practice Questions
Question 1:
A company needs to securely connect its on-premises data center to a single AWS VPC over the internet. The solution must be encrypted and quick to deploy. Which option is the best fit?
A. AWS Client VPN
B. AWS Site-to-Site VPN with a Virtual Private Gateway
C. AWS Direct Connect only
D. Internet Gateway with security groups
Correct Answer:
B. AWS Site-to-Site VPN with a Virtual Private Gateway
Explanation:
Site-to-Site VPN provides encrypted IPsec network-to-network connectivity between an on-premises data center and an AWS VPC. Client VPN is for individual users, while Direct Connect is private connectivity and usually takes longer to provision.
Question 2:
A company has ten VPCs across multiple AWS accounts that all need connectivity to the same on-premises network. The company wants to avoid creating and managing separate VPN connections for each VPC. Which architecture is most appropriate?
A. Attach a Virtual Private Gateway to each VPC and create separate VPNs
B. Use AWS Client VPN for each VPC
C. Terminate the Site-to-Site VPN on AWS Transit Gateway
D. Use one Internet Gateway and route all traffic through it
Correct Answer:
C. Terminate the Site-to-Site VPN on AWS Transit Gateway
Explanation:
Transit Gateway provides centralized routing and allows multiple VPCs to share hybrid connectivity. This is more scalable than creating separate VPNs for each VPC.
Question 3:
An organization wants dynamic route exchange and improved failover between AWS and its on-premises network. Which routing option should be used with AWS Site-to-Site VPN?
A. Static routes only
B. BGP
C. NAT Gateway routes
D. Internet Gateway route propagation
Correct Answer:
B. BGP
Explanation:
BGP supports dynamic routing and better failover behavior. Static routes can work for simple environments but require more manual management.
Question 4:
A company is using AWS Site-to-Site VPN over the public internet for large file transfers. Performance is inconsistent, and a single large transfer does not use the full available tunnel bandwidth. What is the most likely reason?
A. Site-to-Site VPN does not support encryption
B. Single TCP flows are limited and internet performance can vary
C. Virtual Private Gateways only support inbound traffic
D. Customer Gateways cannot use IKEv2
Correct Answer:
B. Single TCP flows are limited and internet performance can vary
Explanation:
Internet-based VPN performance depends on internet conditions. Additionally, a single TCP flow may be limited even when aggregate tunnel bandwidth is higher.
Question 5:
A company uses AWS Direct Connect but has a compliance requirement that traffic between the data center and AWS must be encrypted at the network layer. What should the solutions architect recommend?
A. Use an Internet Gateway instead of Direct Connect
B. Use Site-to-Site VPN over Direct Connect
C. Use NAT Gateway for encryption
D. Use VPC peering between AWS and the data center
Correct Answer:
B. Use Site-to-Site VPN over Direct Connect
Explanation:
Direct Connect provides private connectivity but does not automatically encrypt traffic. Running Site-to-Site VPN over Direct Connect adds IPsec encryption.