AWS Transit Gateway Connect Demonstration

Welcome

This repository demonstrates the usage of Transit Gateway (TGW) connect and accelerates your integration of SDWAN appliances with AWS Transit Gateway.

For more details, checkout the Documentation and our Blog Article.

Quickstart

You can use the following link to deploy the full setup directly into your AWS account. Ensure you are logged into the AWS Console before following it.

Quickstart CloudFormation Link

Pre-requisites

Example ip ranges see architecture diagram and pre-requisites folder in this repository. The tgw_vpc_basics.yaml template deployed the pre-requistites for you if not already exists.

• Pick a region from the Documentation
• Transit Gateway setup with unused CIDR attached
• VPC with two public subnets
• VPC attached to Transit Gateway
• Public subnets route table entries with destination TGW CIDR pointing to TGW

Manual Deployment

1. (Optional) Deploy tgw_vpc_basics.yaml for VPC and Transit Gateway (including attached TGW CIDR block, here: 10.10.0.0/24) setup
2. Deploy gre_setup.yaml, important parameters are the transport TGW attachment id, route table id and VPC information

Deployment Consumer VPCs

1. VPC needs to be attached to TGW
2. Consumer subnets need a default route (0.0.0.0/0) towards TGW
3. VPC attachment has to be associated with GRE main route table
4. Routing from TGW towards consumer VPC has to be in place within GRE main route table

Architecture

Data Points

• High Available setup, two SDWAN instances with two BGP peers each
• Full appliance instance failover takes ~30s

Limitations

• Not all regions support TGW Connect (details see AWS documentation: TGW Connect)
• CFN resource type AWS::EC2::TransitGatewayConnect is not supported in all regions

Note:

• While code samples in this repository has been tested and believe it works well, as always, be sure to test it in your environment before using it in production!
• The sample SDWAN appliances are just break-outs to the public internet in this sample setup
• The architecture diagram png is a drawio editable png export, feel free to use and adapt
• Files within /conf folder are there to be at your hands, the actual deployed content is inlined for simplicity.

How to debug BGP sessions on SDWAN appliances

1. Login to the EC2 instances via Session Manager
2. Ping the BGP peer IP address of Transit Gateway sourcing from the virtual appliance’s BGP peer IP address within the GRE tunnel
3. Display actually applied routes to the kernel's table - ip route
4. Open vty shell tool - sudo vtysh
5. Display BGP session status - show ip bgp summary
6. Display routes being advertised and applied to kernel route table - show ip route

Future Work

• Add switch to demonstrate iBGP or eBGP within same template
• Add scenario with multiple TGW connect attachments in order to advertise different networks for different TGW route tables

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.