Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS VPN CloudHub is a hub-and-spoke connectivity topology that uses multiple AWS Site-to-Site VPN connections to connect branch offices, data centers, or other remote networks with an Amazon VPC. It can also enable traffic between the remote locations through the AWS VPN infrastructure.
CloudHub is a network design pattern, not a standalone AWS service. The central hub is an AWS Virtual Private Gateway (VGW) attached to a VPC, while each spoke is a remote network connected through its own Customer Gateway (CGW) and VPN connection.
Key Concepts
Hub-and-spoke topology
The VPC acts as the central cloud network. Multiple remote locations establish independent IPsec Site-to-Site VPN connections to the VGW:
- The Virtual Private Gateway is deployed on the AWS side and attached to the VPC.
- Each branch office or data center has a Customer Gateway representing its VPN device.
- Each remote location establishes a separate VPN connection to the VGW.
- BGP can dynamically advertise routes between the remote networks and AWS.
- Route tables determine which traffic is sent through the VPN connections.
Conceptually, the topology looks like this:
Branch Office A ── VPN ──┐
Data Center B ── VPN ──┼── Virtual Private Gateway ── VPC
Branch Office C ── VPN ──┘
Virtual Private Gateway
A VGW is the AWS-side VPN endpoint for a VPC. It is attached to the VPC and terminates Site-to-Site VPN connections from customer networks.
In the CloudHub topology, the VGW serves as the central hub for all connected remote locations.
Customer Gateway
A Customer Gateway is the AWS configuration that represents a customer-side VPN device or router. Each remote office or data center generally has its own customer gateway configuration and VPN connection.
The physical or virtual device at the remote location must support the required VPN capabilities, including IPsec and, when used, BGP.
BGP and autonomous system numbers
CloudHub commonly uses BGP to exchange network routes dynamically. Each connected remote location must use a unique BGP autonomous system number (ASN).
Unique ASNs allow AWS to distinguish route advertisements from the different customer networks. Reusing the same ASN across the remote sites can prevent the topology from operating as intended and is a common exam trap.
Routing between remote locations
CloudHub can support communication in both directions:
- Between a remote network and the VPC
- Between one remote network and another remote network, with traffic routed through the AWS hub
This behavior depends on the routes being advertised and accepted, as well as the applicable VPC and VPN route-table configuration. Creating VPN tunnels alone does not automatically mean that every network can communicate with every other network.
Architecture Decision Guide
| Requirement | Suitable design | Important considerations |
|---|---|---|
| Connect one branch office to a VPC | A single Site-to-Site VPN using a VGW and CGW | Configure the remote network, VPN connection, and VPC routes |
| Connect multiple branch offices to one VPC | AWS VPN CloudHub | Use a VGW as the hub and a separate VPN connection for each remote location |
| Enable branch-to-branch communication through AWS | VPN CloudHub with appropriate route advertisements and route-table entries | Verify that the routes for each remote network are exchanged and permitted |
| Dynamically learn changing network routes | BGP-based VPN connections | Assign a unique BGP ASN to each remote location |
| Use static route exchange instead of BGP | Static VPN routing, where supported by the design | Route changes require manual administration, and CloudHub route exchange behavior must be evaluated carefully |
Exam-Relevant Takeaways
- AWS VPN CloudHub is a topology, not a separate AWS service.
- The central AWS component is a Virtual Private Gateway attached to a VPC.
- Each branch office or data center connects through its own Customer Gateway and Site-to-Site VPN connection.
- The topology follows a hub-and-spoke model.
- BGP is used to exchange routes dynamically between AWS and the remote networks.
- Each remote location must have a unique BGP ASN.
- Traffic between remote sites can be routed through the AWS hub when the required routes are advertised and configured.
- VPC route tables and VPN route propagation or explicit routes control where traffic is sent.
- A VPN connection by itself does not guarantee end-to-end connectivity; routing, security controls, and non-overlapping address ranges must also be correct.
Common Exam Traps
Treating CloudHub as a standalone service
CloudHub describes the deployment topology. The underlying components are Site-to-Site VPN connections, customer gateways, and a virtual private gateway.
Confusing the VGW and CGW roles
- VGW: AWS-side endpoint attached to the VPC
- CGW: Configuration representing the remote VPN device
Reusing BGP ASNs
The remote locations need unique BGP ASNs. A scenario with several branches using the same ASN should be treated as a potential configuration problem when the design requires distinct BGP route exchange.
Assuming all connected networks can communicate automatically
CloudHub provides the architectural path, but route advertisements and route tables must allow the traffic. Also check that security groups, network ACLs, firewalls, and on-premises policies permit the traffic.
Ignoring overlapping CIDR ranges
Remote networks and the VPC need address ranges that can be routed unambiguously. Overlapping CIDRs can make routes ambiguous and prevent reliable communication.
Real-World Engineer Notes
- Model every office or data center as a separate remote network with its own customer gateway and VPN connection.
- Document the BGP ASN, advertised prefixes, and expected return routes for each site.
- Test both directions of traffic. A route from a branch to the VPC is insufficient if the VPC or another branch lacks a return route.
- Keep VPC, branch, and data-center CIDR ranges non-overlapping when designing the environment.
- Validate the complete path: VPN tunnel state, BGP session state, route propagation or static routes, security groups, network ACLs, and on-premises firewall rules.
- For larger or more complex network topologies, evaluate whether a different AWS network architecture is more appropriate rather than extending a VGW-based hub indefinitely.
Quick Reference Summary
| Component or concept | Role |
|---|---|
| VPN CloudHub | Hub-and-spoke network topology |
| Virtual Private Gateway | AWS-side VPN hub attached to the VPC |
| Customer Gateway | AWS representation of a remote VPN device |
| Site-to-Site VPN | Encrypted IPsec connectivity between AWS and a remote network |
| BGP | Dynamic route exchange between connected networks |
| BGP ASN | Identifier for a routing domain; use a unique ASN for each remote location |
| Route tables | Determine whether traffic uses the VPN and which destination is reachable |
Flashcards
- What is AWS VPN CloudHub?
A hub-and-spoke topology that connects multiple remote networks to a VPC through separate Site-to-Site VPN connections.
- Is VPN CloudHub a standalone AWS service?
No. It is a network deployment pattern built using VPN connections, customer gateways, and a virtual private gateway.
- What is the hub in VPN CloudHub?
The Virtual Private Gateway attached to the VPC.
- What represents each remote office in AWS?
A Customer Gateway configuration associated with the remote VPN device.
- What protocol is commonly used for dynamic route exchange in CloudHub?
BGP.
- What ASN requirement applies to the remote locations?
Each remote location must use a unique BGP ASN.
- Can one branch office communicate with another through CloudHub?
Yes, provided the relevant routes are advertised and accepted and the route tables and security controls permit the traffic.
- What determines whether a destination uses a VPN connection?
The applicable route tables and the routes learned or configured for the VPN.
- What is a common addressing problem in multi-site VPN designs?
Overlapping CIDR ranges between the VPC and remote networks.
- Does an established VPN tunnel guarantee application connectivity?
No. Routing, return paths, security groups, network ACLs, firewalls, and application policies must also allow the traffic.
Practice Questions
Question 1
A company has one VPC and five branch offices. Each branch needs private connectivity to the VPC, and the company wants traffic between branches to traverse AWS. Which design best matches this requirement?
A. Create one VPN connection from the VPC to a single branch and route all other branches through that branch.
B. Create a VPN CloudHub topology with a VGW and a separate Site-to-Site VPN connection for each branch.
C. Create five VPCs and peer each VPC with the others.
D. Use an internet gateway and public IP addresses for each branch.
Correct answer: B
Explanation: VPN CloudHub is designed for multiple remote locations connecting to a central VPC through a VGW. With the correct route advertisements and route-table configuration, traffic can also pass between the branch networks through the AWS hub.
Question 2
A network architect is configuring BGP for four branch-office VPN connections in a CloudHub design. What requirement is most important?
A. All branches must use the same BGP ASN.
B. Each branch must use a unique BGP ASN.
C. BGP must be disabled on the VGW.
D. Each branch must use the VPC CIDR range as its BGP ASN.
Correct answer: B
Explanation: Each remote location must use a unique BGP ASN so that the routing domains can be distinguished during route exchange.
Question 3
A VPN tunnel between Branch A and the VPC is established, but Branch A cannot reach Branch B. Both branches are connected to the same VGW. What should be checked first?
A. Whether the VPC has an internet gateway.
B. Whether the required routes for both branch networks are advertised and present in the relevant route tables.
C. Whether both branches use the same BGP ASN.
D. Whether Branch A is in the same Availability Zone as Branch B.
Correct answer: B
Explanation: A functioning tunnel does not automatically provide branch-to-branch connectivity. The routes to the remote networks must be exchanged or configured, and the route tables must direct traffic through the appropriate VPN paths.
Question 4
Which component is deployed on the AWS side and attached to the VPC in an AWS VPN CloudHub design?
A. Customer Gateway
B. Virtual Private Gateway
C. Network ACL
D. Internet Gateway
Correct answer: B
Explanation: The Virtual Private Gateway is the AWS-side VPN hub attached to the VPC. A Customer Gateway represents the remote VPN device or router.
Question 5
A company wants to connect several data centers to a VPC using CloudHub. The data centers use overlapping private CIDR ranges. What is the primary design concern?
A. The VPC must have multiple internet gateways.
B. BGP cannot be used with IPsec VPNs.
C. Overlapping ranges can make routing ambiguous and prevent reliable communication.
D. Each data center must use the same customer gateway.
Correct answer: C
Explanation: Routing requires unambiguous destination prefixes. Overlapping VPC and on-premises CIDRs can cause route conflicts and prevent predictable traffic delivery, even when the VPN connections are operational.