Outpost connectivity to the local network - AWS Outposts

Outpost connectivity to the local network

You need the following components to connect your Outpost to your on-premises network:

  1. Physical connectivity from the Outpost patch panel to your customer devices.

  2. Link Aggregation Control Protocol (LACP) to establish two link aggregation group (LAG) connections to your Outpost network devices and to your local network devices.

  3. Virtual LAN (VLAN) connectivity between the Outpost and your customer devices.

  4. Layer 3 point-to-point connectivity for each VLAN.

  5. Border Gateway Protocol (BGP) for the route advertisement between the Outpost and your on-premises service link.

  6. BGP for the route advertisement between the Outpost and your on-premises local gateway.

For more information about AWS Outposts hardware and connectivity information, see AWS Outposts Now Available – Order Yours Today.

Physical connectivity

An Outpost rack has two physical network devices that attach to your local network.

An Outpost requires a minimum of two physical links between these Outpost network devices and your local network devices. An Outpost supports the following uplink speeds and quantities for each Outpost network device.

Uplink speed Number of uplinks

1 Gbps

1, 2, 3, 4, 5, 6, 7, 8

10 Gbps

1, 2, 3, 4, 8, 12, 16

40 Gbps

1, 2, 3, 4

100 Gbps

1, 2, 3, 4

The uplink speed and quantity are symmetrical on each Outpost network device. If you use 100 Gbps as the uplink speed, you must configure the link with forward error correction (FEC CL91).

Outpost racks can support single-mode fiber (SMF) with Lucent Connector (LC), multimode fiber (MMF), or MMF OM4 with LC. AWS provides the optics that are compatible with the fiber that you provide at the rack position.

In the following diagram, the physical demarcation is the fiber patch panel in each Outpost. You provide the fiber cables that are required to connect the Outpost to the patch panel.


          Outpost physical demarcation

AWS Outposts uses the Link Aggregation Control Protocol (LACP) to establish two link aggregation group (LAG) connections to your Outpost network devices and to your local network devices. The links from each Outpost network device are aggregated into an Ethernet LAG to represent a single network connection. These LAGs use LACP with standard fast timers.

To enable an Outpost installation at your site, you must configure your side of the LAG connections on your network devices.

From a logical perspective, ignore the Outpost patch panels as the demarcation point and use the Outpost networking devices.

For deployments that have multiple racks, an Outpost must have four physical links between the aggregation layer of the Outpost network devices and your local network devices.

The following diagram shows four physical connections between each Outpost network device and its connected local network device. We use Ethernet LAGs to aggregate the physical links connecting the Outpost network devices and the customer local network devices.


          Using link aggregation to connect devices.

Virtual LANs

Each LAG between an Outpost network device and a local network device must be configured as an IEEE 802.1q Ethernet trunk. This enables the use of multiple VLANs for network segregation between data paths.

Each Outpost has the following data paths between the on-premises network and its network:

  • Service link VLAN – Enables communication between the Outpost and the AWS Region for both management of the Outpost and intra-VPC between the AWS Region and Outpost. This VLAN provides access to the AWS Region, which enables the service link connection from the Outpost to be established back to the Region. The service link is a custom VPN or VPNs from the Outpost to the Region. It is connected to the Outpost that is configured in the Availability Zone when your purchase the Outpost.

  • Local gateway VLAN – Enables VPC traffic from your VPC to your local LAN. This VLAN enables instances running on the Outpost to communicate with your on-premises network. It also enables them to communicate with the internet through your on-premises network.

You can configure the service link VLAN and local gateway VLAN only between the Outpost and your customer local network devices.

An Outpost is designed to segregate the service link and local gateway data paths into two isolated networks. This enables you to choose which of your networks can communicate with services running on the Outpost. It also enables you to make the service link an isolated network from the local gateway network by using multiple route table on your customer local network device, commonly known as Virtual Routing and Forwarding instances (VRF). The demarcation line exists at the port of the Outpost network devices. AWS manages any infrastructure on the AWS side of the connection, and you manage any infrastructure on your side of the line.


          Virtual LANs.

To integrate your Outpost with your on-premises network during the installation and on-going operation, you must allocate the VLANs used between the Outpost network devices and the customer local network devices. You need to provide this information to AWS before the installation. For more information, see Network readiness checklist.

Network layer connectivity

Each Outpost network device requires an IP address on each VLAN so they can communicate with the customer local network devices to establish a BGP session. We recommend that you use a dedicated subnet, with a /30 or /31 CIDR, to represent this logical point-to-point connectivity. We recommend that you do not bridge the VLANs between your customer local network devices.

You need to establish two paths:

  • Service link path - To establish this path, specify a VLAN subnet with a range of /30 or /31 and an IP address for the service link VLAN on the Outpost network device.

  • Local gateway path - To establish this path, specify a VLAN subnet with a range of /30 or /31 and an IP address for the local gateway VLAN on the Outpost network device.

The following diagram shows the connections from each Outpost network device to the customer device for the service link path and the local gateway path. There are four VLANs for this example:

  • VLAN A is for the service link path that connects the Outpost network device 1 with the customer local network device 1.

  • VLAN B is for the local gateway path that connects the Outpost network device 1 with the customer local network device 1.

  • VLAN C is for the service link path that connects the Outpost network device 2 with the customer local network device 2.

  • VLAN D is for the local gateway path that connects the Outpost network device 2 with the customer local network device 2.


          Service link path and local gateway path

The following table shows example values for the subnets that connect the Outpost network device 1 with the customer local network device 1.

VLAN Subnet Customer Device 1 IP AWS OND 1 IP
A

172.16.0.0/30

172.16.0.2/30

172.16.0.1/30
B 10.0.0.0/30 10.0.0.2/30 10.0.0.1/30

The following table shows example values for the subnets that connect the Outpost network device 2with the customer local network device 2.

VLAN Subnet Customer Device 2 IP AWS OND 2 IP
C

172.16.0.4/30

172.16.0.6/30

172.16.0.5/30
D 10.0.0.4/30 10.0.0.6/30 10.0.0.5/30

The Outpost establishes an external BGP peering session between each Outpost network device and the customer local network device for service link connectivity over the service link VLAN. The BGP peering session is established between the /30 or /31 IP addresses provided for the point-to-point VLAN. Each BGP peering session uses a private Autonomous System Number (ASN) on the Outpost network device and an ASN that you choose for your customer local network devices. AWS provides the attributes as part of the installation process.

Consider the scenario where you have an Outpost with two Outpost network devices connected by a service link VLAN to two customer local network devices. You configure the following infrastructure, and customer local network device BGP ASN attributes for each service link:

  • The service link BGP ASN. The valid values are 64512-65535.

  • The infrastructure CIDR. This must be a /26 CIDR.

  • The customer local network device 1 service link BGP peer IP address.

  • The customer local network device 1 service link BGP peer ASN. The valid values are 0-65535.

  • The customer local network device 2 service link BGP peer IP address.

  • The customer local network device 2 service link BGP peer ASN. The valid values are 0-65535. For more information, see RFC4893.


          Service link BGP advertisement

The Outpost establishes an external BGP peering session over the service link VLAN using the following process:

  1. Each Outpost network device uses the ASN to establish a BGP peering session with its connected local network device.

  2. Outpost network devices advertise the /26 CIDR range as two /27 CIDR blocks to support link and device failures.

  3. The subnet is used for connectivity from the Outpost to the AWS Region.

The service link infrastructure subnet is a /26 CIDR range that you provide during the pre-installation process. The service link range is used by the Outpost infrastructure to establish connectivity to the Region through the service link. The service link subnet is the Outpost source, which initiates the connectivity.

Outpost network devices advertise the /26 CIDR range as two /27 CIDR blocks to support link and device failures.

You must provide a service link BGP ASN and an infrastructure subnet CIDR (/26) for the Outpost. For each Outpost network device, provide the BGP peering IP address on the VLAN of the local network device and the BGP ASN of the local network device.

If you have a multiple rack deployment, you must have one /26 subnet per rack.

Local gateway BGP connectivity

The Outpost establishes an external BGP peering from each Outpost network device to a local network device for connectivity to the local gateway. It uses a private Autonomous System Number (ASN) that you assign in order to establish the external BGP sessions. Each Outpost network device has a single external BGP peering to a local network device using its local gateway VLAN.

The Outpost establishes an external BGP peering session over the local gateway VLAN between each Outpost network device and it's connected customer local network device. The peering session is established between the /30 or /31 IPs that you provided when you set up network connectivity and uses point-to-point connectivity between the Outpost network devices and customer local network devices. For more information, see Network layer connectivity.

Each BGP session uses the private ASN on the Outpost network device side, and an ASN that you choose on the customer local network device side. AWS provides the attributes as part of the pre-installation process.

Consider the scenario where you have an Outpost with two Outpost network devices connected by a service link VLAN to two customer local network devices. You configure the following local gateway and customer local network device BGP ASN attributes for each service link:

  • AWS provides the local gateway BGP ASN. The valid values are 64512-65535.

  • You provide the customer owned CIDR that gets advertised.

  • You provide the customer local network device 1 local gateway BGP peer IP address.

  • You provide the customer local network device 1 local gateway BGP peer ASN. The valid values are 0-65535. For more information, see RFC4893.

  • You provide the customer local network device 2 local gateway BGP peer IP address.

  • You provide the customer local network device 2 local gateway BGP peer ASN. The valid values are 0-65535. For more information, see RFC4893.


          Local gateway BGP advertisement

Local gateway customer-owned IP subnet advertisement

During the pre-installation process, AWS creates an address pool, known as a customer-owned IP address pool. It is created based on information that you provide about your on-premises network. You can create Elastic IP addresses from this pool, and then assign the addresses to resources on your Outpost, such as EC2 instances.

The local gateway translates the Elastic IP address to an address in the customer-owned pool. The local gateway advertises the translated address to your on-premises network, and any other network that communicates with the Outpost. The addresses are advertised on both local gateway BGP sessions to the local network devices.

Consider the scenario where you have an Outpost with two Outpost network devices connected by a service link VLAN to two customer local network devices. The following is configured:

  • A VPC with a CIDR block 10.0.0.0/16.

  • A subnet in the VPC with a CIDR block 10.0.3.0/24.

  • An EC2 instance in the subnet with a private IP address 10.0.3.112.

  • A customer-owned IP pool (10.1.0.0/26).

  • An Elastic IP address association that associates 10.0.3.112 to 10.1.0.2.

  • A local gateway that uses BGP to advertise 10.1.0.0/26 to the on-premises network through the local devices.

  • Communication between your Outpost and on-premises network will use the COIP Elastic IPs to address instances in the Outpost, the VPC CIDR range is not used.


          Local gateway subnet advertisement