HybridNetArchit
Enthusiast
Enthusiast

VMC on AWS T0 Transitive Routes for Connected VPC?

Jump to solution

Hi,
Cannot find an answer to this and wondered if anyone can help/ point in correct direction.


A colleague and I are investigating a design where multiple SDDCs are being deployed and connectivity is being aggregated via native AWS Transit Gateway (TGW). Route based VPNs are in use. This bit is fine. The connectivity between the SDDC and its connected VPC is also understood from the perspective of the SDDC consuming services sitting in its corresponding VPC. My colleague who is looking after the AWS side has had some conflicting messages regarding additional connectivity options for the Connected VPCs (additional meaning in addition to the SDDC ENI connectivity). He has some challenges and has been told not to treat the connected VPCs as normal VPCs with regards to routing and thus his idea of connecting them also to the TGW is thrown into doubt, He is essentially been told it may cause issues. Having never tested this myself and with no means to test this in advance I was hoping for some points of clarification.


1. Can the T0 Gateway participate in transitive routing between its Connected VPC and an onward connection to AWS Transit Gateway. ie routes in TGW route table include those of the connected VPC (learned via T0)?. Have only previously tested routed between SDDC and connected VPC and nothing beyond that.


2. Can the connected VPC actually consume TGW in addition to its SDDC connection. If so is there anything we need to be aware of - potential issues and ways to mitigate these.


Essentially he wants to avoid using the SDDC as a transitive hop between the TGW and connected VPC and thus only allow the SDDC to consume the connected VPC via its ENI interface.
Thanks in advance

Tags (3)
0 Kudos
1 Solution

Accepted Solutions
FReale
VMware Employee
VMware Employee


Hello, 

While using a VPN to connect to a TGW the VMC platform will not advise any route to the connected VPC. 
Only the Network Segments that are managed by NSX will be announced. 

The connected VPC will always reached using the xENI, that xENI cannot be used to route traffic that come outside of the VPC. 

Cheers

Fabio 

View solution in original post

0 Kudos
3 Replies
FReale
VMware Employee
VMware Employee


Hello, 

While using a VPN to connect to a TGW the VMC platform will not advise any route to the connected VPC. 
Only the Network Segments that are managed by NSX will be announced. 

The connected VPC will always reached using the xENI, that xENI cannot be used to route traffic that come outside of the VPC. 

Cheers

Fabio 

View solution in original post

0 Kudos
HybridNetArchit
Enthusiast
Enthusiast

Perfect, many thanks.

So using popular VMware speak (parlance), The Connected VPC should be considered a 'first class citizen' and should be treated as any other VPC and directly connected to the AWS TGW for non SDDC traffic.

0 Kudos
FReale
VMware Employee
VMware Employee

Exactly, the connected VPC need to be connected to the TGW to be able to reach all the other VPC

0 Kudos