2.3.4. Hybrid Cloud Routing (BGP, VPN ECMP)

Hybrid cloud routing mechanisms (BGP, VPN ECMP) fundamentally manage dynamic traffic flow between on-premises and AWS, ensuring optimal path selection, load balancing, and rapid failover for resilient connectivity.

Scenario: You need to connect your on-premises data center to multiple AWS VPCs via AWS Direct Connect and AWS Site-to-Site VPN for redundancy. You want dynamic routing updates and to load-balance traffic across multiple VPN tunnels.

Effective routing is paramount in hybrid cloud environments to ensure seamless and efficient communication between on-premises networks and AWS VPCs over AWS Direct Connect or AWS Site-to-Site VPN.

Key Hybrid Cloud Routing Concepts:

• Border Gateway Protocol (BGP):
  • What it is: A dynamic routing protocol used to exchange route information between autonomous systems (your on-premises network and AWS).
  • Use with AWS: Used with AWS Direct Connect Virtual Interfaces (VIFs) and AWS Site-to-Site VPN connections (for dynamic routing).
  • Benefit: Enables dynamic exchange of prefixes, automatic route propagation to VPC route tables (if enabled), and faster failover in case of path changes.
• Virtual Private Gateway (VPG): The AWS side of a Site-to-Site VPN connection or a Direct Connect Private VIF. It acts as a router to/from your VPC.
• Direct Connect Gateway: A globally available resource that allows you to connect your Direct Connect connection to multiple VPCs in the same or different AWS Regions. Central hub for connecting DX connections to multiple VPCs or a Transit Gateway.
• Equal-Cost Multi-Path (ECMP) for VPN:
  • Concept: Allows traffic to be load-balanced across multiple VPN tunnels (e.g., the two tunnels in a Site-to-Site VPN connection) if they have equal cost.
  • Benefit: Increases effective bandwidth and provides active-active failover for VPN connections.
• VPC Route Tables & Transit Gateway Route Tables: Must be correctly configured to reflect routes learned via BGP or manually added static routes for proper traffic flow between on-premises and AWS.
• BGP Traffic Engineering (which lever steers which direction):
  • On-premises to AWS: set a higher Local Preference on your own routers for routes learned over the preferred link. It only steers traffic leaving your own AS.
  • AWS to on-premises (private/transit VIFs): AWS evaluates the longest prefix first, then local preference communities you attach (7224:7100 low, 7224:7200 medium, 7224:7300 high), then the shortest AS_PATH (prepend on the backup link), then MED (lower wins; evaluated last, so AWS does not recommend relying on it).
  • Public VIF scope communities: tag advertised prefixes 7224:9100 (local Region only), 7224:9200 (all Regions on the continent) or 7224:9300 (global, the default when untagged).
  • Route summarization: the advertising (on-premises) router should send a few aggregate prefixes (e.g., one supernet covering contiguous /24s) instead of hundreds of specifics. This keeps VPC and TGW route tables within quota (the VPC limit on propagated routes cannot be raised).
• VPN ECMP needs a Transit Gateway: ECMP requires a TGW with VPN ECMP support enabled and dynamic (BGP) routing with matching attributes; VPN connections that use static routing do not support ECMP. To aggregate bandwidth beyond one connection, create several Site-to-Site VPN connections to the TGW and advertise the same prefixes over each; a Virtual Private Gateway does not do ECMP.

Practical Implementation: Enabling VPN ECMP (Conceptual)

⚠️ Common Pitfall: Asymmetric routing. If traffic takes one path from on-premises to AWS (e.g., DX) and a different path back (e.g., VPN), stateful firewalls can block the return traffic. BGP attributes (like AS_PATH prepending) are crucial for influencing return paths.

Key Trade-Offs:

• Dynamic Routing (BGP) vs. Static Routing: BGP provides automatic route updates and faster failover but adds complexity. Static routing is simpler but requires manual updates and slower failover.

Reflection Question: How do hybrid cloud routing mechanisms (BGP for dynamic updates, VPN ECMP for load balancing across tunnels) fundamentally manage dynamic traffic flow between on-premises and AWS, ensuring optimal path selection, load balancing, and rapid failover for resilient connectivity?