24. AWS Transit Gateway

Overview

• A transit gateway is a network transit hub that you can use to interconnect your virtual private clouds (VPCs) and on-premises networks.
• A transit gateway acts as a Regional virtual router for traffic flowing between your virtual private clouds (VPCs) and on-premises networks.
• As your cloud infrastructure expands globally, inter-Region peering connects transit gateways together using the AWS Global Infrastructure.
• Your data is automatically encrypted and never travels over the public internet.
• A transit gateway scales elastically based on the volume of network traffic.
• Routing through a transit gateway operates at layer 3, where the packets are sent to a specific next-hop attachment, based on their destination IP addresses.

Transit gateway concepts

• Attachments — You can attach the following:
  • One or more VPCs
  • A Connect SD-WAN/third-party network appliance
  • An AWS Direct Connect gateway
  • A peering connection with another transit gateway
  • A VPN connection to a transit gateway
• Transit gateway Maximum Transmission Unit (MTU) — The maximum transmission unit (MTU) of a network connection is the size, in bytes, of the largest permissible packet that can be passed over the connection.
  • A transit gateway supports an MTU of 8500 bytes for traffic between VPCs, AWS Direct Connect, Transit Gateway Connect, and peering attachments.
  • Traffic over VPN connections can have an MTU of 1500 bytes.
• Transit gateway route table — A transit gateway has a default route table and can optionally have additional route tables. A route table includes dynamic and static routes that decide the next hop based on the destination IP address of the packet. The target of these routes could be any transit gateway attachment. By default, transit gateway attachments are associated with the default transit gateway route table.Transit gateway peering attachments support static routing only.
• Associations — Each attachment is associated with exactly one route table. Each route table can be associated with zero to many attachments.
• Route propagation — A VPC, VPN connection, or Direct Connect gateway can dynamically propagate routes to a transit gateway route table. With a Connect attachment, the routes are propagated to a transit gateway route table by default.
  • With a VP