Create a private IP AWS Site-to-Site VPN over AWS Direct Connect - AWS Site-to-Site VPN
PrerequisitesCreate the customer gateway

Create a private IP AWS Site-to-Site VPN over AWS Direct Connect

To create a private IP VPN with AWS Direct Connect follow these steps. Before you create the private IP VPN over Direct Connect, you need to ensure that a transit gateway and Direct Connect gateway are first created. After creating the two gateways you then need to create an assocation between the two. These prerequisites are described in the following table. Once you've created and associated the two gateways, you'll create a VPN customer cateway and connection using that association.

Prerequisites

The following table describes the perquisites before creating a private IP VPN over Direct Connect.

Item Steps Information
Prepare the transit gateway for Site-to-Site VPN.

Create the transit gateway by using the Amazon Virtual Private Cloud (VPC) console or using the command-line or API.

See Transit gateways in the Amazon VPC Transit Gateways Guide.

 A transit gateway is a network transit hub that you can use to interconnect your VPCs and on-premises networks. You can create a new transit gateway or use an existing one for the private IP VPN connection. When you create the transit gateway, or modify an existing transit gateway, you specify a private IP CIDR block for the connection.
Note

When specifying the transit gateway CIDR block to be associated with your Private IP VPN, ensure the CIDR block does not overlap with any IP addresses for any other network attachments on the transit gateway. If any IP CIDR blocks do overlap, it may cause configuration issues with your customer gateway device.
Create the AWS Direct Connect gateway for Site-to-Site VPN.

Create the Direct Connect gateway by using the Direct Connect console or by using the command-line or API.

See Create an AWS Direct Connect gateway in the AWS Direct Connect User Guide.

 A Direct Connect gateway allows you to connect virtual interfaces (VIFs) across multiple AWS Regions. This gateway is used to connect to your VIF.
Create the transit gateway association for Site-to-Site VPN.

Create the association between the Direct Connect gateway and the transit gateway by using the Direct Connect console or using the command-line or API.

See Associate or disassociate AWS Direct Connect with a transit gateway in the AWS Direct Connect User Guide.

After creating the AWS Direct Connect gateway, create a transit gateway association for the AWS Direct Connect gateway. Specify the private IP CIDR for the transit gateway that was identified earlier in the allowed prefixes list.

Create the customer gateway and connection for Site-to-Site VPN

A customer gateway is a resource that you create in AWS. It represents the customer gateway device in your on-premises network. When you create a customer gateway, you provide information about your device to AWS. For more details, see Customer gateway.

To create a customer gateway using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. In the navigation pane, choose Customer gateways.

  3. Choose Create customer gateway.

  4. (Optional) For Name tag, enter a name for your customer gateway. Doing so creates a tag with a key of Name and the value that you specify.

  5. For BGP ASN, enter a Border Gateway Protocol (BGP) Autonomous System Number (ASN) for your customer gateway.

  6. For IP address, enter the private IP address for your customer gateway device.

  7. (Optional) For Device, enter a name for the device that hosts this customer gateway.

  8. Choose Create customer gateway.

  9. In the navigation pane, choose Site-to-Site VPN connections.

  10. Choose Create VPN connection.

  11. (Optional) For Name tag, enter a name for your Site-to-Site VPN connection. Doing so creates a tag with a key of Name and the value that you specify.

  12. For Target gateway type, choose Transit gateway. Then, choose the transit gateway that you identified earlier.

  13. For Customer gateway, select Existing. Then, choose the customer gateway that you created earlier.

  14. Select one of the routing options based on whether your customer gateway device supports Border Gateway Protocol (BGP):

    • If your customer gateway device supports BGP, choose Dynamic (requires BGP).

    • If your customer gateway device does not support BGP, choose Static.

  15. For Tunnel inside IP version, specify whether the VPN tunnels support IPv4 or IPv6 traffic.

  16. (Optional) If you specified IPv4 for Tunnel inside IP Version, you can optionally specify the IPv4 CIDR ranges for the customer gateway and AWS sides that are allowed to communicate over the VPN tunnels. The default is 0.0.0.0/0.

    If you specified IPv6 for Tunnel inside IP version, you can optionally specify the IPv6 CIDR ranges for the customer gateway and AWS sides that are allowed to communicate over the VPN tunnels. The default for both ranges is ::/0.

  17. For Outside IP address type, choose PrivateIpv4.

  18. For Transport attachment ID, choose the transit gateway attachment for the appropriate AWS Direct Connect gateway.

  19. Choose Create VPN connection.

Note

The Enable acceleration option is not applicable for VPN connections over AWS Direct Connect.

To create a customer gateway using the command line or API