Outpost connectivity to AWS Regions - AWS Outposts

Outpost connectivity to AWS Regions

AWS Outposts supports two types of wide area network (WAN) connectivity: service links and local gateways.

When an Outpost is provisioned, it initiates the service link VPN back to the AWS Region, and builds the service link VPN connection. The Outpost must be able to reach the public AWS ranges, either through the public internet or AWS Direct Connect public virtual interface. This connectivity can be through specific routes in the service link VLAN, or through a default route of 0.0.0.0/0. For more information about the public ranges for AWS, see AWS IP Address Ranges.

After the service link is established, the Outpost is in service and managed by AWS. The service link is used for the following traffic:

  • Management traffic to the Outpost through the service link

  • Traffic between the Outpost and any associated VPCs

Outpost service links support an MTU of 1300 bytes. You can use AWS Direct Connect, or an internet connection to connect to the AWS Region. For an optimal experience and resiliency, AWS recommends that you use dual 1Gbps connections to the AWS Region.

In the following diagram, the configuration extends the Amazon VPC from the AWS Region to the Outpost. An AWS Direct Connect public virtual interface is the service link connection. The following traffic goes over the service link and the AWS Direct Connect connection:

  • Control plane

  • Intra-VPC traffic between the Outpost and the AWS Region


          AWS Direct Connect connection to AWS

If you are using a stateful firewall with your internet connection to limit connectivity from the public internet to the service link VLAN, you can block all inbound connections that initiate from the internet. This is because the service link VPN initiates only from the Outpost to the Region, not from the Region to the Outpost.


          Internet gateway connection to AWS

If you use a firewall to limit the connectivity from the service link VLAN, you can block all inbound and outbound connections. This is because the service link VPN initiates from the Outpost to the AWS Region. You must configure the following outbound rules on any firewall between the AWS Region and the service link VLAN. If the firewall is stateful, outbound connections from the Outpost that are allowed, meaning that they were initiated from the Outpost, should be allowed back inbound. If the firewall is stateless, you must allow connections back inbound.

Protocol Source Port Source Address Destination Port Destination Address

UDP

443

Outpost service link /26

443

Outpost Region's public routes

TCP

1025-65535

Outpost service link /26

443

Outpost Region's public routes

Note

An Outpost VPC cannot use the service link to communicate with or within the same VPC extended in other Outposts. Use the local gateways to communicate between VPCs across Outposts. Outpost racks are also designed with redundant power and networking equipment, including local gateway components. For more information, see Resilience in AWS Outposts.

Connectivity through the local gateway

The primary role of a local gateway is to provide connectivity from an Outpost to your local on-premises LAN. It also provides connectivity to the internet through your on-premises network. The local gateway can also provide a data plane path back to the AWS Region. If you already have connectivity between your LAN and the Region through AWS Site-to-Site VPN or AWS Direct Connect, you can use the same path to connect from the Outpost to the AWS Region privately.

The data plane path for the local gateway traverses from the Outpost, through the local gateway, and to your private local gateway LAN segment. It would then follow a private path back to the AWS service endpoints in the Region.

Redundant internet connections

When you build connectivity from your Outpost to the AWS Region, we recommend that you create multiple connections for higher availability and resiliency. For more information, see AWS Direct Connect Resiliency Recommendations.

If you need connectivity to the public internet, you can use redundant internet connections and diverse internet providers, just as you would with your existing on-premises workloads.