Example: Peered transit gateways - Amazon Virtual Private Cloud

Example: Peered transit gateways

You can create a transit gateway peering connection between transit gateways in different Regions. You can then route traffic between the attachments for each of the transit gateways. In this scenario, VPC and VPN attachments are associated with the transit gateway default route tables, and they propagate to the transit gateway default route tables. Each transit gateway route table has a static route that points to the transit gateway peering attachment.

Contents

Overview

The following diagram shows the key components of the configuration for this scenario. Transit gateway 1 has two VPC attachments, and transit gateway 2 has one Site-to-Site VPN attachment. Packets from the subnets in VPC A and VPC B that have the internet as a destination first route through transit gateway 1, then transit gateway 2, and then route to the VPN.

You create the following entities for this scenario:

When you create the VPC attachments, the CIDRs for each VPC propagate to the route table for transit gateway 1. When the VPN is up, the following actions occur:

  • The BGP session is established

  • The Site-to-Site VPN CIDR propagates to the route table for transit gateway 2

  • The VPC CIDRs are added to the gateway BGP table

Routing

Each VPC has a route table and each transit gateway has a route table.

VPC route tables

Each VPC has a route table with 2 entries. The first entry is the default entry for local IPv4 routing in the VPC. This default entry enables the resources in this VPC to communicate with each other. The second entry routes all other IPv4 subnet traffic to the transit gateway. The following table shows the VPC A routes.

Destination Target

10.0.0.0/16

local

0.0.0.0/0

tgw-1-id

Transit gateway route tables

The following is an example of the default route table for transit gateway 1, with route propagation enabled.

Destination Target Route type

10.0.0.0/16

Attachment ID for VPC A

propagated

10.2.0.0/16

Attachment ID for VPC B

propagated

0.0.0.0/0

Attachment ID for peering connection

static

The following is an example of the default route table for transit gateway 2, with route propagation enabled.

Destination Target Route type

172.31.0.0/16

Attachment ID for VPN connection

propagated

10.0.0.0/16

Attachment ID for peering connection

static

10.2.0.0/16

Attachment ID for peering connection static

Customer gateway BGP table

The customer gateway BGP table contains the following VPC IP Addresses.

  • 10.0.0.0/16

  • 10.2.0.0/16