Transit Gateway

AWS Transit Gateway connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub. This simplifies your network and puts an end to complex peering relationships. It acts as a cloud router – each new connection is only made once.

Create the Transit Gateway

1. In the left hand pane of the VPC Dashboard scroll down and click on Transit Gateways

2. Click on Create Transit Gateway

   
   3. Add a name for the new Transit Gateway as TGW and add a description of TGW for us-east-1.

   
   4. Select Multicast support and keep the remaining settings at the defaults. You will need this option enabled if you progress to the advanced multicast lab. Click on Create transit gateway.

   
   5. The state of the new transit gateway will show as pending for a few minutes.

   

Attach VPCs to Transit Gateway

The best practice for connecting VPCs to Transit Gateway is to use a dedicated /28 subnet in each availability zone and the CloudFormation run earlier created these for VPC B and VPC C alongside two private and public /24 subnets for hosting workloads.

However the "VPC Fundamentals" lab only created the two public and two private /24 subnets for VPC A and our AWS environment currently looks like this:

Therefore before we create the transit gateway we need to add a dedicated /28 subnet in each availability zone in VPC A for the transit gateway attachments.

Create Transit Gateway Subnets in VPC A

1. Within the VPC Dashboard click on Subnets and click the Create subnet button

   
   2. Create a subnet under VPC A with a name of VPC A TGW Subnet AZ1 in us-east-1a with a CIDR block of 10.0.5.0/28

   
   3. Create another subnet under VPC A with a name of VPC A TGW Subnet AZ2 in us-east-1b with a CIDR block of 10.0.5.16/28

   

Now that we have subnets to place the transit gateway attachments into we will attach VPC A, VPC B, and VPC C to the transit gateway and test connectivity between our EC2 instances in each VPC.

Create Transit Gateway Attachment for VPC A

1. On the left navigation pane go to Transit Gateway Attachments

2. Click on Create Transit Gateway Attachment.

   
   3. Enter VPC A Attachment as the Name tag.
   4. Select the transit gateway from the dropdown for Transit Gateway ID.
   5. Leave Attachment Type as VPC

   
   6. Select VPC A from the VPC ID drop down.
   7. Select VPC A TGW Subnet AZ1 and VPC A TGW Subnet AZ2 for the Subnet IDs.

   

   Important

   Note that the TGW subnets will not be selected by default, double check the subnets are the TGW ones.

   1. Click Create transit gateway attachment on the bottom right corner.
   2. VPC attachment should create successfully and will be in a pending state initially

   

Create Transit Gateway Attachment for VPC B

1. Click Create Transit Gateway Attachment.
2. Enter VPC B Attachment as the Name tag.
3. Select the transit gateway from the dropdown for Transit Gateway ID.

4. Leave Attachment Type as VPC

   
   5. Select VPC B from the VPC ID drop down
   6. Select VPC B TGW Subnet AZ1 and VPC B TGW Subnet AZ2 for the Subnet IDs.

   

Important

Note that the TGW subnets will not be selected by default, double check the subnets are the TGW ones.

1. Click Create transit gateway attachment on the bottom right corner.

2. VPC attachment should create successfully and will be in a pending state initially

   

Create Transit Gateway Attachment for VPC C

1. Click Create Transit Gateway Attachment.
2. Name the attachment as VPC C attachment.
3. Select the transit gateway from the dropdown for Transit Gateway ID.

4. Leave Attachment Type as VPC

   
   5. Select VPC C from the VPC ID drop dowm.
   6. Select VPC C TGW Subnet AZ1 and VPC C TGW Subnet AZ2 for the Subnet IDs.

   

Important

Note that the TGW subnets will not be selected by default, double check the subnets are the TGW ones.

1. Click Create transit gateway attachment on the bottom right corner.

2. VPC attachment should create successfully and will be in a pending state initially

   

Let’s go take a look at how the Transit Gateway attached to the VPC.

On the left in the EC2 Dashboard click on Network Interfaces

There are now six interfaces with a Description beginning Network Interface for Transit Gateway Attachment... representing the Elastic Network Interfaces that have been placed in each of the two Transit Gateway subnets in each of the three VPCs.

Now that we have attachments in all three VPCs, we need to add routes to their route tables to point traffic to the interfaces.

Add Routes to TGW in the VPC Route Tables

1. On the left in the VPC Dashboard click on Route Tables
2. Select the check box for VPC A Private Route Table, scroll down select the Routes tab and click on Edit routes.
   
3. Add a route to VPC B in the VPC A Private Route Table using a Destination of 10.1.0.0/16 with a Target as the transit gateway.
4. Add a route to VPC C in the VPC A Private Route Table using a Destination of 10.2.0.0/16 with a Target as the transit gateway.

5. Click Save routes.

   
   6. Confirm that the routes have been added to the route table.

   
   7. Click on Route tables
   8. Select the check box for VPC B Private Route Table, scroll down select the Routes tab and click on Edit routes.

   
   9. Add an aggregate route with a Destination of 10.0.0.0/8 with a Target as the transit gateway. Click Save routes.

   
   10. Confirm that the route has been added to the VPC B Private Route Table.

   
   11. Click on Route tables
   12. Select the check box for VPC C Private Route Table, scroll down select the Routes tab and click on Edit routes.

   
   13. Add an aggregate route with a Destination of 10.0.0.0/8 with a Target as the transit gateway. Click Save routes.

   
   14. Confirm that the route has been added to the VPC C Private Route Table.

   

Test Connectivity

Now let’s test the connectivity between the instances in the private subnets in VPC A, B & C.

1. Navigate to Instances in the EC2 Dashboard
2. Select the check box for VPC A Private AZ1 Server and click Connect to use Session Manager to connect
   
3. Confirm connectivity between the VPCs by pinging the IP address on the instances in VPC B and VPC C with the following commands:

ping 10.1.1.100 -c 5   
ping 10.2.1.100 -c 5  

1. You should see a response from both EC2 instances
   

Congratulations you now have a multi-VPC architecture with connectivity between the VPCs provided by Transit Gateway.