AWS Direct Connect
User Guide

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>

You can return to the original look by selecting English in the language selector above.

Virtual Private Gateway Associations

You can use an AWS Direct Connect gateway to connect your AWS Direct Connect connection over a private virtual interface to one or more VPCs in your account that are located in the same or different Regions. You associate a Direct Connect gateway with the virtual private gateway for the VPC. Then, you create a private virtual interface for your AWS Direct Connect connection to the Direct Connect gateway. You can attach multiple private virtual interfaces to your Direct Connect gateway.

In the following diagram, the Direct Connect gateway enables you to use your AWS Direct Connect connection in the US East (N. Virginia) Region to access VPCs in your account in both the US East (N. Virginia) and US West (N. California) Regions.


                Direct connect gateway

The following rules apply:

  • You cannot use a Direct Connect gateway to connect to a VPC in the China Regions.

  • There are limits for creating and using Direct Connect gateways. For more information, see AWS Direct Connect Limits.

  • The VPCs to which you connect through a Direct Connect gateway cannot have overlapping CIDR blocks. If you add an IPv4 CIDR block to a VPC that's associated with a Direct Connect gateway, ensure that the CIDR block does not overlap with an existing CIDR block for any other associated VPC. For more information, see Adding IPv4 CIDR Blocks to a VPC in the Amazon VPC User Guide.

  • You cannot create a public virtual interface to a Direct Connect gateway.

  • A Direct Connect gateway supports communication between attached private virtual interfaces and associated virtual private gateways only. The following traffic flows are not supported:

    • Direct communication between the VPCs that are associated with a single Direct Connect gateway. This includes traffic from one VPC to another by using a hairpin through an on-premises network through a single virtual interface.

    • Direct communication between the virtual interfaces that are attached to a single Direct Connect gateway.

    • Direct communication between the virtual interfaces that are attached to a single Direct Connect gateway and a VPN connection on a virtual private gateway that's associated with the same Direct Connect gateway.

  • You cannot associate a virtual private gateway with more than one Direct Connect gateway and you cannot attach a private virtual interface to more than one Direct Connect gateway.

  • A virtual private gateway that you associate with a Direct Connect gateway must be attached to a VPC.

  • A virtual private gateway association proposal expires 7 days after it is created.

  • An accepted virtual private gateway proposal, or a deleted virtual private gateway proposal remains visible for 3 days.

To connect your AWS Direct Connect connection to a VPC in the same Region only, you can create a Direct Connect gateway. Or, you can create a private virtual interface and attach it to the virtual private gateway for the VPC. For more information, see Creating a Private Virtual Interface and VPN CloudHub.

To use your AWS Direct Connect connection with a VPC in another account, you can create a hosted private virtual interface for that account. When the owner of the other account accepts the hosted virtual interface, they can choose to attach it either to a virtual private gateway or to a Direct Connect gateway in their account. For more information, see AWS Direct Connect Virtual Interfaces.

Associating and Disassociating Virtual Private Gateways

The virtual private gateway must be attached to the VPC to which you want to connect. For more information, see Create a Virtual Private Gateway in the Amazon VPC User Guide.

Note

If you are planning to use the virtual private gateway for a Direct Connect gateway and a dynamic VPN connection, set the ASN on the virtual private gateway to the value that you require for the VPN connection. Otherwise, the ASN on the virtual private gateway can be set to any permitted value. The Direct Connect gateway advertises all connected VPCs over the ASN assigned to it.

To associate a virtual private gateway

  1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/home.

  2. In the navigation pane, choose Direct Connect Gateways and then select the Direct Connect gateway.

  3. Choose View details.

  4. Choose Gateways associations and then choose Associate gateway.

  5. For Gateways, choose the virtual private gateways to associate, and then choose Associate gateway.

You can view all of the virtual private gateways that are associated with the Direct Connect gateway by choosing Gateway associations.

To disassociate a virtual private gateway

  1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/home.

  2. In the navigation pane, choose Direct Connect Gateways and then select the Direct Connect gateway.

  3. Choose View details.

  4. Choose Gateway associations and then select the virtual private gateway.

  5. Choose Disassociate.

To associate a virtual private gateway using the command line or API

To view the virtual private gateways associated with a Direct Connect gateway using the command line or API

To disassociate a virtual private gateway using the command line or API

Creating a Private Virtual Interface to the Direct Connect Gateway

To connect your AWS Direct Connect connection to the remote VPC, you must create a private virtual interface for your connection. Specify the Direct Connect gateway to which to connect.

Note

If you're accepting a hosted private virtual interface, you can associate it with a Direct Connect gateway in your account. For more information, see Accepting a Hosted Virtual Interface.

To provision a private virtual interface to a Direct Connect gateway

  1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/v2/home.

  2. In the navigation pane, choose Virtual Interfaces.

  3. Choose Create virtual interface.

  4. Under Virtual interface type, for Type, choose Private.

  5. Under Virtual interface type, choose Private.

  6. Under Private virtual interface settings, do the following:

    1. For Virtual interface name, enter a name for the virtual interface.

    2. For Connection, choose the Direct Connect connection that you want to use for this interface.

    3. For Virtual interface owner, choose My AWS account if the virtual interface is for your AWS account.

    4. For Direct Connect gateway, select the Direct Connect gateway.

    5. For VLAN, enter the ID number for your virtual local area network (VLAN).

    6. For BGP ASN, enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) of your gateway.

      The valid values are 1-2147483647.

  7. Under Additional Settings, do the following:

    1. To configure an IPv4 BGP or an IPv6 peer, do the following:

      [IPv4] To configure an IPv4 BGP peer, choose IPv4 and do one of the following:

      • To specify these IP addresses yourself, for Your router peer ip, enter the destination IPv4 CIDR address to which Amazon should send traffic.

      • For Amazon router peer ip, enter the IPv4 CIDR address to use to send traffic to AWS.

      [IPv6] To configure an IPv6 BGP peer, choose IPv6. The peer IPv6 addresses are automatically assigned from Amazon's pool of IPv6 addresses. You cannot specify custom IPv6 addresses.

    2. To change the maximum transmission unit (MTU) from 1500 (default) to 9001 (jumbo frames), select Jumbo MTU (MTU size 9001).

    3. (Optional) Add or remove a tag.

      [Add a tag] Choose Add tag and do the following:

      • For Key, enter the key name.

      • For Value, enter the key value.

      [Remove a tag] Next to the tag, choose Remove tag.

  8. Choose Create virtual interface.

After you've created the virtual interface, you can download the router configuration for your device. For more information, see Downloading the Router Configuration File.

To create a private virtual interface using the command line or API

To view the virtual interfaces that are attached to a Direct Connect gateway using the command line or API