Skip to content

AWS Direct Connect

Service Overview and Purpose

AWS Direct Connect is a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. Using Direct Connect, you can reduce network costs, increase bandwidth throughput, and provide a more consistent network experience.

Key Characteristics

  • Dedicated Connection: Private network connection to AWS
  • Predictable Bandwidth: Consistent network performance
  • Reduced Costs: Lower data transfer costs
  • Enhanced Security: Private connection, not over internet
  • High Availability: Multiple connection options

Key Features and Capabilities

Connection Types

  • Dedicated Connection: 1Gbps, 10Gbps, 100Gbps capacity
  • Hosted Connection: 50Mbps to 10Gbps via AWS Partner
  • Hosted Virtual Interface: Shared connection with dedicated VLAN

Virtual Interfaces (VIFs)

  • Private VIF: Connect to VPC resources
  • Public VIF: Connect to AWS public services
  • Transit VIF: Connect to Transit Gateway

Direct Connect Gateway

  • Global Resource: Connect to VPCs in multiple regions
  • Centralized Management: Single connection to multiple VPCs
  • Transit Gateway Integration: Enhanced connectivity options

Configuration Examples

Dedicated Connection Setup

# Create Direct Connect connection (done at AWS location)
aws directconnect create-connection \
  --location "US West (Portland)" \
  --bandwidth 1Gbps \
  --connection-name "Production-DX-Connection" \
  --tags key=Environment,value=Production

# Create Private Virtual Interface
aws directconnect create-private-virtual-interface \
  --connection-id dxcon-12345678 \
  --new-private-virtual-interface '{
    "virtualInterfaceName": "Production-Private-VIF",
    "vlan": 100,
    "asn": 65000,
    "mtu": 1500,
    "authKey": "BGP_AUTH_KEY",
    "amazonAddress": "192.168.1.1/30",
    "customerAddress": "192.168.1.2/30",
    "addressFamily": "ipv4",
    "virtualGatewayId": "vgw-12345678"
  }'

# Create Public Virtual Interface
aws directconnect create-public-virtual-interface \
  --connection-id dxcon-12345678 \
  --new-public-virtual-interface '{
    "virtualInterfaceName": "Production-Public-VIF",
    "vlan": 200,
    "asn": 65000,
    "mtu": 1500,
    "authKey": "BGP_AUTH_KEY",
    "amazonAddress": "192.168.2.1/30",
    "customerAddress": "192.168.2.2/30",
    "addressFamily": "ipv4",
    "routeFilterPrefixes": [
      {"cidr": "0.0.0.0/0"}
    ]
  }'

Direct Connect Gateway

# Create Direct Connect Gateway
aws directconnect create-direct-connect-gateway \
  --name "Global-DX-Gateway" \
  --amazon-side-asn 64512

# Associate VPC with DX Gateway
aws directconnect create-direct-connect-gateway-association \
  --direct-connect-gateway-id dx-gw-12345678 \
  --gateway-id vgw-87654321 \
  --association-name "Production-VPC-Association"

# Create Transit VIF for Transit Gateway
aws directconnect create-transit-virtual-interface \
  --connection-id dxcon-12345678 \
  --new-transit-virtual-interface '{
    "virtualInterfaceName": "Transit-VIF",
    "vlan": 300,
    "asn": 65000,
    "mtu": 1500,
    "directConnectGatewayId": "dx-gw-12345678"
  }'

Use Cases and Scenarios

Primary Use Cases

  1. Hybrid Cloud: Extend on-premises infrastructure to AWS
  2. Data Migration: Large-scale data transfer to AWS
  3. Consistent Performance: Predictable bandwidth and latency
  4. Compliance: Private connection for regulatory requirements
  5. Cost Optimization: Reduce data transfer costs

Architecture Patterns

Multi-VPC Connectivity

# Connect multiple VPCs via DX Gateway
aws directconnect create-direct-connect-gateway-association \
  --direct-connect-gateway-id dx-gw-12345678 \
  --gateway-id vgw-prod123 \
  --association-name "Production-Association"

aws directconnect create-direct-connect-gateway-association \
  --direct-connect-gateway-id dx-gw-12345678 \
  --gateway-id vgw-dev456 \
  --association-name "Development-Association"

High Availability Setup

# Create redundant connections
aws directconnect create-connection \
  --location "US East (Ashburn)" \
  --bandwidth 1Gbps \
  --connection-name "Primary-DX-Connection"

aws directconnect create-connection \
  --location "US East (Miami)" \
  --bandwidth 1Gbps \
  --connection-name "Backup-DX-Connection"

# BGP configuration for failover
# Primary connection: Higher LOCAL_PREF
# Backup connection: Lower LOCAL_PREF

BGP Configuration

BGP Routing Examples

# Customer router BGP configuration example
router bgp 65000
 neighbor 192.168.1.1 remote-as 7224
 neighbor 192.168.1.1 password BGP_AUTH_KEY

 address-family ipv4
  neighbor 192.168.1.1 activate
  neighbor 192.168.1.1 soft-reconfiguration inbound

  # Advertise on-premises networks
  network 10.0.0.0 mask 255.0.0.0
  network 172.16.0.0 mask 255.240.0.0

  # Set preferences for load balancing
  neighbor 192.168.1.1 route-map SET_LOCAL_PREF in

route-map SET_LOCAL_PREF permit 10
 set local-preference 100

Route Propagation

# Enable route propagation on VGW
aws ec2 enable-vgw-route-propagation \
  --route-table-id rtb-12345678 \
  --gateway-id vgw-87654321

# View propagated routes
aws ec2 describe-route-tables \
  --route-table-ids rtb-12345678 \
  --query 'RouteTables[0].PropagatingVgws'

Monitoring and Troubleshooting

CloudWatch Metrics

# Monitor Direct Connect metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/DX \
  --metric-name ConnectionState \
  --dimensions Name=ConnectionId,Value=dxcon-12345678 \
  --start-time 2023-01-01T00:00:00Z \
  --end-time 2023-01-01T23:59:59Z \
  --period 300 \
  --statistics Maximum

# Monitor BGP session state
aws cloudwatch get-metric-statistics \
  --namespace AWS/DX \
  --metric-name VirtualInterfaceBpsEgress \
  --dimensions Name=VirtualInterfaceId,Value=dxvif-12345678 \
  --start-time 2023-01-01T00:00:00Z \
  --end-time 2023-01-01T23:59:59Z \
  --period 300 \
  --statistics Average

Troubleshooting Commands

# Check connection status
aws directconnect describe-connections \
  --connection-id dxcon-12345678

# Check VIF status
aws directconnect describe-virtual-interfaces \
  --virtual-interface-id dxvif-12345678

# View BGP peers
aws directconnect describe-virtual-interfaces \
  --virtual-interface-id dxvif-12345678 \
  --query 'virtualInterfaces[0].bgpPeers'

# Test connectivity
ping 192.168.1.1  # AWS BGP peer
traceroute 10.0.1.1  # VPC resource

Security Considerations

Network Security

  • Private Connection: Traffic doesn't traverse internet
  • BGP Authentication: MD5 authentication for BGP sessions
  • VLAN Isolation: Traffic isolation using VLANs
  • MACsec: Layer 2 encryption (where supported)

Access Control

# Restrict access to DX resources
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "directconnect:Describe*"
    ],
    "Resource": "*"
  }, {
    "Effect": "Allow",
    "Action": [
      "directconnect:*VirtualInterface*"
    ],
    "Resource": "arn:aws:directconnect:*:account:dxcon/dxcon-12345678"
  }]
}

Cost Optimization

Pricing Components

  • Port Hours: Hourly charge for dedicated connection
  • Data Transfer: Outbound data transfer charges (reduced rates)
  • Cross Connect: Charges at colocation facility

Cost Optimization Strategies

# Monitor data transfer to optimize costs
aws cloudwatch get-metric-statistics \
  --namespace AWS/DX \
  --metric-name VirtualInterfaceBpsEgress \
  --dimensions Name=VirtualInterfaceId,Value=dxvif-12345678 \
  --start-time 2023-01-01T00:00:00Z \
  --end-time 2023-01-31T23:59:59Z \
  --period 86400 \
  --statistics Sum

# Use hosted connections for lower bandwidth needs
# Implement proper BGP routing to avoid unnecessary traffic

Exam-Specific Tips

Key Exam Topics

  1. Connection Types: Dedicated vs Hosted connections
  2. Virtual Interfaces: Private, Public, and Transit VIFs
  3. Direct Connect Gateway: Multi-region connectivity
  4. BGP Routing: Route propagation and preferences
  5. High Availability: Redundancy and failover

Common Exam Scenarios

  1. Hybrid Connectivity: Connect on-premises to AWS
  2. Multi-Region Access: Use DX Gateway for global connectivity
  3. High Availability: Design redundant DX connections
  4. Cost Optimization: Reduce data transfer costs
  5. Compliance: Private connectivity requirements

Exam Tips

  • Know connection types and their use cases
  • Understand VIF types and their purposes
  • Remember BGP concepts and routing preferences
  • Know Direct Connect Gateway benefits for multi-region
  • Understand high availability design patterns