Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Site-to-Site VPN provides an encrypted connection between an AWS network and an external network, such as a corporate data center, branch office, or private facility. It is a core hybrid networking option for connecting on-premises environments to a VPC or to multiple VPCs through AWS Transit Gateway.
The service is managed by AWS and uses IPsec tunnels. The underlying transport is commonly the public internet, although VPN encryption can also be layered over a private connection such as AWS Direct Connect.
Key Concepts
Core components
An AWS Site-to-Site VPN connection uses these logical components:
- Virtual Private Gateway (VGW): The AWS-side VPN endpoint attached to a VPC.
- Customer Gateway (CGW): An AWS configuration representing the customer-side VPN device. The corresponding physical or virtual device exists in the customer network.
- VPN connection: The encrypted connection between the customer gateway and the AWS VPN endpoint.
- VPN tunnels: Each connection includes two tunnels for redundancy.
The customer gateway may represent a hardware VPN appliance, a firewall, or another compatible device supporting AWS VPN requirements.
IPsec encryption and tunnel redundancy
Site-to-Site VPN uses IPsec to protect traffic between the external network and AWS. Supported security capabilities include AES encryption, including AES-256, and SHA-based integrity protection. Compatible customer devices can use IKE version 1 or IKE version 2.
AWS provides two tunnels per VPN connection. The tunnels terminate in separate availability zones on the AWS side, improving resilience against a failure of an individual endpoint or tunnel. The customer-side device and routing configuration must be designed to use the redundant tunnel appropriately.
Routing options
AWS Site-to-Site VPN supports two main routing models:
- Static routing: Routes are manually configured on both sides. This is simple and predictable but does not automatically adapt to network changes or tunnel failures.
- Dynamic routing with BGP: The customer gateway exchanges route information with AWS. BGP can advertise and learn routes dynamically and can support more effective failover between tunnels.
For a VPC to send traffic to an on-premises network, the relevant VPC route table must contain a route for the on-premises CIDR range. The route targets the virtual private gateway when the VPN is attached directly to the VPC.
Transit Gateway integration
A Site-to-Site VPN can terminate on an AWS Transit Gateway instead of directly on a VPC. This is useful when multiple VPCs, data centers, or branch offices need centralized connectivity.
A typical design is:
- Attach multiple VPCs to a Transit Gateway.
- Establish one or more VPN connections from external networks to the Transit Gateway.
- Use Transit Gateway route tables to control which VPCs and external networks can communicate.
This avoids building separate VPN connections to every VPC and supports a hub-and-spoke topology.
VPN over Direct Connect
A VPN does not have to use the public internet as its transport. IPsec encryption can be layered over a private network connection such as Direct Connect. This can provide additional encryption for traffic that already uses a private circuit.
The choice depends on the requirements for encryption, predictable private connectivity, performance, and cost. Direct Connect by itself is not an IPsec VPN; it is a private connectivity service. Combining the two addresses different requirements.
Exam-Relevant Takeaways
- AWS Site-to-Site VPN is a managed, IPsec-based hybrid connectivity service.
- The AWS-side logical endpoint is commonly a Virtual Private Gateway when connecting directly to one VPC.
- A Customer Gateway is an AWS object that represents the customer’s physical or virtual VPN device.
- Each VPN connection includes two tunnels for high availability.
- BGP provides dynamic route exchange and generally supports more automatic failover behavior than static routes.
- With static routing, routes and failover behavior require manual configuration.
- VPC route tables must include routes for the remote network CIDRs, targeting the appropriate VPN attachment.
- A VPN can connect to AWS Transit Gateway, allowing several VPCs to share centralized VPN connectivity.
- VPN traffic commonly traverses the internet, so latency and available throughput can vary.
- A VPN can be used over Direct Connect when private transport and additional IPsec encryption are both required.
- The stated maximum bandwidth is 1.25 Gbps per VPN tunnel.
- A single TCP session is limited to 256 Mbps, which can affect applications dependent on one high-bandwidth flow.
Architecture Decision Guide
| Requirement | Suitable approach | Important consideration |
|---|---|---|
| Fast hybrid connectivity without provisioning a private circuit | Site-to-Site VPN over the internet | Internet latency and path performance are variable |
| Encrypted connectivity between one VPC and a data center | VPN terminating on a VGW | Add remote-network routes to the VPC route tables |
| Centralized connectivity for multiple VPCs | VPN terminating on Transit Gateway | Configure Transit Gateway attachments and route tables |
| Automatic route exchange and improved tunnel failover | BGP-based VPN | Both sides must support and be configured for BGP |
| Small or stable network with manually controlled routes | Static-routing VPN | Route changes and failover are less automatic |
| Private circuit with additional encryption | IPsec VPN over Direct Connect | Direct Connect and VPN solve different connectivity and security requirements |
| Third-party VPN appliance or custom routing behavior | VPN software on EC2 or another supported appliance | This is a self-managed alternative, not the AWS managed VPN service |
Common Exam Traps
- Confusing the CGW with the physical VPN device: The Customer Gateway is an AWS configuration object. The actual device is located in the customer network.
- Assuming a VPN has only one tunnel: AWS provides two tunnels per VPN connection. Designs should account for both.
- Treating static routing as automatically failover-capable: Static routes do not provide the same dynamic convergence behavior as BGP.
- Forgetting VPC route tables: Creating a VPN connection alone does not make every subnet reachable. The subnet route table needs a route for the remote CIDR.
- Assuming VPN bandwidth is unlimited: Throughput is constrained per tunnel, and a single TCP flow has a lower stated limit.
- Assuming internet VPN performance is deterministic: The public internet introduces variable latency and path conditions.
- Confusing VPN with Direct Connect: Direct Connect provides private network connectivity; IPsec VPN provides encryption. They can be used together.
- Using separate VPNs to every VPC by default: Transit Gateway is usually the more scalable hub for many VPCs and external networks.
- Assuming two tunnels eliminate all customer-side work: The customer gateway device and its routing must be configured to use the redundant paths.
Real-World Engineer Notes
- Use non-overlapping CIDR ranges between VPCs and on-premises networks. Overlapping ranges complicate routing and can prevent direct communication.
- Prefer BGP when the environment has changing routes, multiple paths, or a requirement for more automated tunnel failover.
- Use static routing when the topology is small and route changes are rare, but document the operational process for failover and route updates.
- Test both VPN tunnels rather than validating only the currently active path.
- For high-throughput applications, test both aggregate throughput and the behavior of individual TCP sessions. A workload may have enough total VPN capacity but still be constrained by the per-flow limit.
- Use Transit Gateway route tables to enforce segmentation between VPCs, branches, and data centers instead of assuming that all attached networks should communicate.
- Monitor tunnel state, route advertisements, and traffic metrics. A tunnel can be technically established while routing or security configuration still prevents application traffic.
Quick Reference Summary
- Service: AWS Site-to-Site VPN
- Primary use: Encrypted hybrid connectivity between AWS and an external network
- Protocol: IPsec
- AWS-side endpoint: VGW for direct VPC connectivity, or Transit Gateway for centralized connectivity
- Customer-side representation: Customer Gateway
- Redundancy: Two VPN tunnels per connection
- Routing: Static routes or dynamic BGP
- Common transport: Public internet
- Alternative transport: Direct Connect with VPN encryption layered over it
- Per-tunnel maximum: 1.25 Gbps
- Single TCP session limit: 256 Mbps
- Main design concern: Route correctness and failover behavior, not merely tunnel establishment
Flashcards
- What protocol does AWS Site-to-Site VPN use?
IPsec.
- What is the role of a Virtual Private Gateway?
It is the AWS-side VPN endpoint attached to a VPC.
- What does a Customer Gateway represent?
An AWS configuration representing the customer’s physical or virtual VPN device.
- How many tunnels does AWS provide per Site-to-Site VPN connection?
Two tunnels for redundancy.
- What are the two supported routing models?
Static routing and dynamic routing with BGP.
- Why is BGP useful for VPN connectivity?
It dynamically exchanges routes and can improve route convergence and tunnel failover.
- What must be added to a VPC route table for on-premises access?
A route for the on-premises CIDR range targeting the VPN attachment, such as a VGW.
- How can multiple VPCs share centralized VPN connectivity?
Terminate the VPN on an AWS Transit Gateway and attach the VPCs to it.
- Can Site-to-Site VPN use Direct Connect as its transport?
Yes. IPsec encryption can be layered over a private Direct Connect link.
- What is the stated maximum bandwidth per VPN tunnel?
1.25 Gbps.
- What is the stated limit for a single TCP session?
256 Mbps.
- Why can VPN performance vary when using the internet?
The path, congestion, and latency of the public internet are not fully controlled by the organization.
Practice Questions
Question 1
A company needs to connect its data center to a single VPC. The connection must be encrypted, and the company wants to avoid managing VPN servers in EC2. Which solution best meets the requirement?
A. Deploy a self-managed VPN appliance on an EC2 instance
B. Create an AWS Site-to-Site VPN using a Customer Gateway and Virtual Private Gateway
C. Create a Direct Connect connection without additional encryption
D. Use AWS Client VPN for all data center subnets
Correct answer: B
Explanation: AWS Site-to-Site VPN is a managed IPsec VPN designed for network-to-network connectivity. A Customer Gateway represents the customer-side device, while the Virtual Private Gateway provides the AWS-side endpoint for a VPC.
Question 2
A company has ten VPCs and several branch offices. It wants to avoid creating a separate VPN connection from every branch office to every VPC. Which architecture is most appropriate?
A. Create a VPN connection from each branch directly to every VPC
B. Deploy one NAT gateway per VPC and route branch traffic through it
C. Terminate the VPN connections on AWS Transit Gateway and attach the VPCs
D. Use VPC peering between every VPC and one centralized VPN VPC
Correct answer: C
Explanation: Transit Gateway provides a central routing hub for multiple VPCs and external networks. Its route tables can control connectivity and avoid a large mesh of individual VPN connections.
Question 3
A VPN-connected data center has two tunnels to AWS. The organization wants route changes and tunnel failures to be handled with minimal manual intervention. Which configuration is most suitable?
A. Static routes with no health monitoring
B. BGP dynamic routing through the customer gateway
C. A single default route through one tunnel
D. VPC peering to the data center
Correct answer: B
Explanation: BGP dynamically exchanges routes and is better suited to environments requiring route updates and more automated failover between redundant VPN tunnels.
Question 4
An application sends large amounts of data over AWS Site-to-Site VPN. Testing shows that many parallel sessions achieve high aggregate throughput, but one individual TCP session does not exceed 256 Mbps. What explains this behavior?
A. The VPN supports only UDP traffic
B. A single TCP session has a stated throughput limit even when aggregate tunnel capacity is higher
C. The VPC route table supports only 256 Mbps total
D. BGP prevents large TCP transfers
Correct answer: B
Explanation: The stated per-tunnel maximum is higher, but AWS limits a single TCP flow to 256 Mbps. Applications that depend on one large flow may need a different connectivity design or workload-level parallelism.
Question 5
A company has a private Direct Connect circuit but must provide IPsec encryption for traffic between its data center and AWS. Which approach addresses both requirements?
A. Use Direct Connect alone because private circuits automatically provide IPsec
B. Use Site-to-Site VPN over the Direct Connect transport
C. Replace Direct Connect with Client VPN
D. Use a NAT gateway to encrypt the traffic
Correct answer: B
Explanation: Direct Connect supplies private connectivity but is not itself an IPsec VPN. An IPsec Site-to-Site VPN can be layered over the private connection to add encryption.