Q: In which AWS Regions is AWS Transit Gateway available?
A: AWS Transit Gateway is available in US East (Virginia), US East (Ohio), US West (Oregon), US West (Northern California), AWS GovCloud (US-East), AWS GovCloud (US-West), Canada (Central), South America (São Paulo), Africa (Cape Town), EU (Ireland), EU (Stockholm), EU (London), EU (Frankfurt), EU (Paris), EU (Milan), Middle East (Bahrain), Asia Pacific (Hong Kong), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Singapore), Asia Pacific (Seoul), Asia Pacific (Sydney), Asia Pacific (Beijing), Asia Pacific (Ningxia) AWS Regions with support for other regions coming soon.
Transit Gateway Inter-Region Peering support is available for gateways in US East (N. Virginia), US East (Ohio), US West (Oregon), US West (N. California), AWS GovCloud (US-East), AWS GovCloud (US-West), Canada (Central), EU (Ireland), EU (Frankfurt), EU (Paris), EU (London), EU (Stockholm), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), and South America (Sao Paulo) AWS Regions.
Q: How do I control which Amazon VPCs can communicate with each other?
A: You can segment your network by creating multiple route tables in an AWS Transit Gateway and associate Amazon VPCs and VPNs to them. This will allow you to create isolated networks inside an AWS Transit Gateway similar to virtual routing and forwarding (VRFs) in traditional networks. The AWS Transit Gateway will have a default route table. The use of multiple route tables is optional.
Q: How does routing work in AWS Transit Gateway?
A: AWS Transit Gateway supports dynamic and static routing between attached Amazon VPCs and VPNs. By default, Amazon VPCs, VPNs, Direct Connect gateways, and peered Transit Gateways are associated to the default route table. You can create additional route tables and associate Amazon VPCs, Direct Connect gateways, and VPNs with it.
The routes decide the next hop depending on the destination IP address of the packet. Routes can point to an Amazon VPC or a VPN connection, a Direct Connect gateway, or a peered Transit Gateway.
Q: How do routes get propagated into the AWS Transit Gateway?
A: There are 2 ways where routes get propagated in the AWS Transit Gateway:
- Routes propagated to/from on-premises networks: When you connect VPN, routes will propagate between the AWS Transit Gateway and your on-premises router using Border Gateway Protocol (BGP).
- Routes Propagated to/from Amazon VPCs: When you attach an Amazon VPC to an AWS Transit Gateway or resize an attached Amazon VPC, the Amazon VPC Classless Inter-Domain Routing (CIDR) will propagate into the AWS Transit Gateway route table using internal APIs (not BGP). CIDR is a method for allocating IP addresses and IP routing to slow the growth of routing tables on routers across the Internet, and to help slow the rapid exhaustion of IPv4 addresses. Routes in the AWS Transit Gateway route table will not be propagated to the Amazon VPC’s route table. Amazon VPC owner need to create static route to send Traffic to the AWS Transit Gateway.
Inter-region peering attachments between Transit Gateways do not support route propagation.
Q: Can I connect Amazon VPCs with overlapping CIDRs?
A: AWS Transit Gateway doesn’t support routing between Amazon VPCs with overlapping CIDRs. If you attach a new Amazon VPC that has a CIDR which overlaps with an already attached Amazon VPC, AWS Transit Gateway will not propagate the new Amazon VPC route into the AWS Transit Gateway route table.
Performance and limits
Q: What are the service limits that I need to keep in mind while using AWS Transit Gateways?
A: The table below list the different service limits:
|Number of AWS Transit Gateway attachments
|Maximum bandwidth per VPN tunnel*||1.25 Gbps|
|Maximum bandwidth (burst) per VPC, Direct Connect gateway, or peered Transit Gateway connection||50 Gbps|
|Number of AWS Transit Gateways per Region per account
|Number of AWS Transit Gateway attachments per VPC
|Number of routes||10,000|
|Number of Direct Connect gateways per AWS Transit Gateway||20|
*Each VPN connection has two tunnels and each tunnel supports a maximum throughput of up to 1.25 Gbps. You can use equal-cost multi-path routing (ECMP) to get higher VPN bandwidth by aggregating multiple VPN tunnels across multiple VPN connections.
Security and compliance
Q: With which compliance programs does AWS Transit Gateway conform?
A: AWS Transit Gateway inherits compliance from Amazon Virtual Private Cloud (Amazon VPC) and meets the standards for PCI DSS Level 1, ISO 9001, ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3, FedRAMP Moderate, FedRAMP High and HIPAA eligibility.
For more information, visit our compliance page.
Q: Does AWS Transit Gateway support IPv6?
A: Yes, AWS Transit Gateway supports attaching Amazon VPCs with IPv6 CIDRs.
Q: Which Amazon VPC features are not supported in the first release?
A: Security Group Referencing on Amazon VPC is not supported at launch. Spoke Amazon VPCs cannot reference security groups in other spokes connected to the same AWS Transit Gateway.
Q: Can I associate my AWS Transit Gateway with a Direct Connect gateway in a different account?
A: Yes, you can associate your AWS Transit Gateway with an AWS Direct Connect gateway from a different AWS account. Only the owner of the AWS Transit Gateway can create association to a Direct Connect gateway. You cannot use Resource Access Manager to associate your AWS Transit Gateway with Direct Connect gateway. For more information, please review the AWS Transit Gateway Support section in the Direct Connect FAQs.
Q: I want to associate my Transit Gateway to a Direct Connect gateway, can I use the same Autonomous System Number (ASN) for the Direct Connect gateway and the Transit Gateway?
A: No, you cannot use the same ASN for the Transit Gateway and the Direct Connect gateway.
Q: Which attachment types can I use to route multicast traffic?
A: You can route multicast traffic within and between VPC attachments to a Transit Gateway. Multicast routing is not supported over AWS Direct Connect, AWS Site-to-Site VPN, and peering attachments.
Q: What is AWS Transit Gateway network manager?
A: AWS Transit Gateway network manager is a feature of AWS Transit Gateway. It centralizes management and monitoring of networking resources and connections to remote branch locations.
Q: How do I setup AWS Transit Gateway network manager?
A: Use the following steps to setup and manage Transit Gateway network manager:
- Create a new ‘global network’, initially an empty object.
- Register your AWS Transit Gateways from any AWS Region.
- Add on-premises resources: Input information about your on-premises devices, sites, links, and the Site-to-Site VPN connections with which they are associated.
- Monitor your global network: through Network Manager’s visualizations, events, and metrics.
Q: Which AWS partners are supporting AWS Transit Gateway network manager?
A: Currently, Cisco, Aruba, Silver Peak, and Aviatrix are supporting AWS Transit Gateway network manager. Their integration of network manager into their SD-WAN solutions enables to automate the branch-cloud connectivity and provides end-to-end monitoring of the global network from a single dashboard.
Q: What is a global network?
A: A ‘Global Network’ is an object in the AWS Transit Gateway network manager service that represents your private global network in AWS. It includes your AWS Transit Gateway hubs, their attachments, and on-premises devices, sites, and links.
Q: What resources are automatically included in the global network when I register an AWS Transit Gateway?
A: For registered AWS Transit Gateways, all attachments are automatically included. Attachments include VPCs, VPNs, Direct Connect gateways, and AWS Transit Gateway-AWS Transit Gateway peering.
Q: How can I visualize the resources and connections in my global network?
A: The AWS Transit Gateway network manager dashboard shows your AWS Transit Gateways across all AWS Regions and on-premises. It offers a logical view and a geographic view of your network resources and connections, along with connection status.
Q: How does AWS Transit Gateway network manager help me monitor my global network?
A: The dashboard of AWS Transit Gateway network manager also shows you these events and metrics, such as bytes in/out, packets in/out, and packets dropped. Connection status is embedded into the the topology and goegraphic views of your global network. AWS Transit Gateway network manager also offers real-time network events and metrics for your global network through AWS CloudWatch. These events, metrics, and visualizations help you monitor your network and take actions as needed.
Q: What metrics are available in AWS Transit Gateway network manager?
A: From the dashboard of network manager, you can view Transit Gateway availability and performance metrics, such as bytes in/out, packets in/out, and packets dropped. AWS Site-to-Site VPN up/down metrics are also available to view for your on-premises devices and links.
Q: What network events are available in AWS Transit Gateway network manager?
A: AWS Transit Gateway network manager offers built-in event notifications for network topology changes, routing updates, and connection status updates. These events are delivered through CloudWatch Events.
Q: How do AWS partners support AWS Transit Gateway network manager?
A: SD-WAN providers offer integration with AWS Transit Gateway network manager. Their integration of network manager into their SD-WAN solutions enables them to automate the branch-cloud connectivity and provides end-to-end monitoring of the global network from a single pane of glass, the dashboard of the network manager.
Q: How do I automatically connect using a partner SD-WAN device?
A: Your SD-WAN solution from the partner uses AWS application programming interfaces (APIs) on your behalf to automatically register the branch device, create a VPN connection, and then applies the VPN configurations to the branch device to establish the connection.
Q: What is Route Analyzer?
A: Route Analyzer is a feature of AWS Transit Gateway Network Manager. It helps you to verify routing configurations of Transit Gateways across your global network.
Q: Does Route Analyzer send data packets to analyze the route?
A: No, Route Analyzer does not send any data packets but verifies the associated Transit Gateway route table configuration between the given source and the destination.
Q: Can I use the Route Analyzer on my existing Transit Gateways?
A: Yes, you can if your Transit Gateway is registered to your Global Network. If you have multiple Transit Gateways on the path to destination, then all of them need to be registered to the Global Network.
Q: Can I use the Route Analyzer to analyze routes in VPC route tables?
A: No, Route Analyzer only verifies Transit Gateway route tables. VPC route tables and customer gateway devices are not a part of the analysis.
Q: Can I use the Route Analyzer to analyze security group rules and network ACL rules in VPC?
A: No, Route Analyzer only verifies Transit Gateway route tables. Security Group rules and Network ACL rules are not a part of the analysis.
Q: I have a middlebox appliance attached to my transit gateway; will this feature work with this type of network architecture?
A: Yes, you can use this feature with a middlebox appliance architecture set up on your Transit Gateway. When you run the analysis, Route Analyzer will ask you to confirm if there is a middlebox appliance between the source and destination.