Multi-Cloud Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)

Important

If you intend to deploy a transit network using AWS Transit Gateway (TGW), your starting point is this link. For building encrypted Transit in AWS/Azure/GCP/OCI or Transit network with Azure Native Peering, this document is your starting point.

This workflow provides you with step-by-step instructions to build a Multi-Cloud Transit Network. This Multi-Cloud Transit Network consists of a Transit Gateway and a set of Spoke Gateways for communications between Spoke VPC or VNet instances and your on-prem network.

While the instructions below reference AWS, these functionalities apply to any public cloud in which Aviatrix Transit Network is supported.

For a design guide, see Multi-Cloud Transit Network Design Patterns.

For more information, see Multi-Cloud Transit Network FAQ.

For other Aviatrix functions, such as VPN access for users and VPN access for sites, see the Aviatrix Overview.

Note

For description purposes, gateway and GW are used interchangeably. Other than gateway deletion, resources created by this workflow should be deleted within the workflow.

The Transit Network diagram is described as below.

Test

Planning and Prerequisites

  1. If you have not launched an Aviatrix Controller, start with Aviatrix startup guide
  2. Identify a VPC/VNet, call it Transit VPC/VNet, in a region where you want to launch the Transit GW (additional details) We recommend you to use the information here to create a Transit VPC/VNet.
  3. Create a VGW or reuse an existing VGW. The VGW should not be attached to the Transit VPC/VNet if you plan to launch Transit GW in the same VPC/VNet. This VGW can be attached to a different VPC/VNet if this VPC/VNet CIDR is different from the Transit VPC/VNet where the Transit GW is launched or in a different region and account. (see 10Gbps Transit Network use case). This VGW should be connected to on-prem either over Direct Connect or over the Internet.
  4. If this is your first time using Aviatrix, make sure you go through the Aviatrix Controller on-boarding process to create an Aviatrix account that corresponds to an IAM role. For instructions on how to launch an Aviatrix Controller, check out this link.

Tip

Use the Aviatrix “Create a VPC” tool with the option “Aviatrix Transit VPC” to create a transit VPC/VNet that has all infrastructure fully populated.

Log into the Aviatrix Controller

Open a browser and navigate to https://<Controller Public IP address>/. Once authenticated, select Multi-Cloud Transit > Setup in the left navigation bar.

The Multi-Cloud Transit Network Workflow page opens. Use this page and the four tabs in the top right (Transit, Spoke, Attach/Detach, and External Connection) to set up a Multi-Cloud Transit Network.

Transit

On the Multi-Cloud Transit Network Workflow page, select the Transit tab in the top right to launch a Transit Gateway.

1. Launch an Aviatrix Transit Gateway

On the Multi-Cloud Transit Network Workflow page, select the Transit tab in the top right to launch a Transit Gateway.

The Transit GW is the hub gateway, it serves to move traffic between a Spoke VPC/VNet and an on-prem network. The Transit GW must be launched on a public subnet where its associated route table has a route 0.0.0.0/0 that points to AWS IGW.

TVPC2

Setting Value
Cloud Type Currently Transit GW can launched in AWS, Azure, and GCP
Gateway Name A unique name to identify the Transit GW
Access Account Name An Aviatrix account that corresponds to an IAM role or account in AWS
Region One of the AWS regions
VPC ID The Transit VPC/VNet/VCN ID
Public Subnet The public subnet on which Transit GW instance is deployed
Gateway Size Transit GW instance size
Allocate New EIP Select this checkbox to have the Controller allocate a new EIP and associate it with the Transit Gateway instance. If you do not select this option, the Controller looks for an allocated but unassociated EIP in the Transit GW account.
Insane Mode Encryption If selected, Transit GW can peer and connect to Spoke with Insane Mode Encryption.
Add/Edit Tags Additional AWS Tags for the Transit GW instance

Warning

When selecting Transit GW instance size, choose a t2 series for Proof of Concept (POC) or prototyping only. Transit GW of t2 series instance type has a random packet drop of 3% for packet size less than 150 bytes when interoperating with VGW. This packet drop does not apply to Spoke GW.

You can change the Transit GW size later by following these instructions.

2. (Optional) Enable/Disable HA to an Aviatrix Transit Gateway

When HA is enabled, a second Transit GW will be launched. Note both Transit GWs will be forwarding traffic in an event of tunnel failure between a Spoke VPC/VNet and Transit VPC/VNet, and between the Transit GW and VGW. For best practice, the HA GW should be launched on a different public subnet (in AWS, GCP, or OCI) in a different AZ.

HAVPC

Setting Value
Aviatrix Transit Gateway Select the Transit GW for which you want to enable HA
HA Gateway Subnet Select the subnet in which you want to enable HA. A best practice is to select a different public subnet from the original Transit GW in a different AZ.
Allocate New EIP Select this checkbox to have the Controller allocate a new EIP and associate it with the HA Gateway instance. If you do not select this option, the Controller looks for an allocated but unassociated EIP in the Transit GW account.

To disable Transit GW HA, go to the Gateway page and delete the Transit GW with -hagw in the name extension. Note: If the Transit GW is connected to VGW, you cannot disable Transit GW HA and if there are still Spoke GWs, you cannot disable Transit GW HA either.

Spoke

To launch an Aviatrix Spoke Gateway, select the Spoke tab in the top right of the Multi-Cloud Transit Network Workflow page of your Aviatrix Controller.

1. Launch an Aviatrix Spoke Gateway

Note

If you are building Azure transit solution and do not require traffic encryption between Spoke VNet and Transit VNet, go to section “1b. Attach Azure ARM Spoke through Native Peering” section below to attach Spoke VNet directly.

launchSpokeGW

You can enable NAT function on the Spoke GW if egress to the Internet is intended to go through the Spoke GW. Once NAT is enabled, you can further configure FQDN whitelists for egress filter.

2. (Optional) Enable/Disable HA to an Aviatrix Spoke Gateway

When HA is enabled, a second Spoke GW will be launched. Note both Spoke GWs will be forwarding traffic in an event of tunnel failure between a Spoke VPC/VNet and Transit VPC/VNet. For best practice, the HA GW should be launched on a different public subnet (in AWS, GCP, or OCI) in a different AZ.

HAVPC

Setting Value
Aviatrix Spoke Gateway Select the Spoke GW for which you want to enable HA
HA Gateway Subnet Select the subnet in which you want to enable HA. A best practice is to select a different public subnet from the original Spoke GW in a different AZ.
Allocate New EIP Select this checkbox to have the Controller allocate a new EIP and associate it with the HA Gateway instance. If you do not select this option, the Controller looks for an allocated but unassociated EIP in the Spoke GW account.

To disable Spoke GW HA, go to the Gateway page and delete the Spoke GW with -hagw in the name extension.

Attach/Detach

To attach or detach a Spoke Gateway to a Transit Network, select the Attach/Detach tab in the top right of the Multi-Cloud Transit Network Workflow page in your Aviatrix Controller.

1a. Attach: Attach Spoke Gateway to Transit Network

This step attaches a Spoke VPC/VNet to the Transit GW Group by building an Aviatrix encrypted peering and transitive peering between the Spoke GW and the Transit GW. The Controller also instructs the Transit GW to start advertising the Spoke VPC/VNet CIDR to VGW via the established BGP session.

AttachSpokeGW

To attach a Spoke Gateway to a Transit Gateway:

  1. Click on the Spoke Gateway/SourceGateway dropdown menu and select the Spoke Gateway to attach.
  2. Click on the Transit Gateway/NextHop Gateway dropdown menu and select a Transit Gateway.
  3. Click Attach.

To attach more Spoke VPC/VNets to this Transit GW Group, click on the Spoke Gateway/Source Gateway dropdown menu and select a new Gateway to attach.

1b. Attach Azure ARM Spoke through Native Peering

Available in release 5.0 and later, you can build Azure transit solution without having to launch a gateway in a Spoke VNet. The use case is for building a Azure transit solution without the requirement to encrypt the traffic between the Transit VNet and the Spoke VNet.

azure_native_transit2

Note

The Spoke VNet must be in the same subscription or a different subscription but in the same AD as the Transit VNet subscription. If the Spoke VNet is in the different subscription than that of the Transit VNet, follow the instruction in this link, and complete Step 5 to 10 for each subscription to build trust relationship.

Do not perform peering function on the Azure portal.

Setting Value
Cloud Type Azure
Transit Gateway Name A unique name to identify the Transit GW
Spoke VNet Account Name An Aviatrix account that corresponds to a subscription in Azure
Spoke VNet Region Spoke VNet region
Spoke VNet Name: Resource Group The Spoke VNet Name

2a. Detach: Detach Aviatrix Spoke Gateway

This step detaches one Aviatrix Spoke VPC/VNet from a Transit GW Group. The Controller also instructs the Transit GW to stop advertising the Spoke VPC/VNet CIDR to VGW.

  1. Click on the Aviatrix Transit Gateway dropdown menu and select the Spoke Gateway.
  2. Click on the Aviatrix Spoke Gateway dropdown menu and select the Spoke Gateway to detach.
  3. Click Detach.

Note that the Spoke GW is not deleted and you can use the top section of this page in the Controller to attach the Transit GW group again.

To delete a Spoke GW, go to Gateway on the main navigation tab, select the gateway and click Delete.

2b. Detach Azure Native Spoke

This step detaches an Azure Native Spoke from an Aviatrix Transit Gateway.

  1. Click on the Aviatrix Transit Gateway Name dropdown menu and select the Transit Gateway.
  2. Click on the Spoke VNet dropdown menu and select the name of the Spoke VNet to detach.
  3. Click Detach.

Add More Spoke VPC/VNets

Repeat steps 1a and 1b to add more Spoke VPC/VNets to the Transit GW group.

SpokeVPC

External Device

1. Connect: Connect to VGW/External Device/Azure VNG

2. (Optional) Enable/Disable HA to an Aviatrix Spoke Gateway

When HA is enabled, a second Spoke GW will be launched. Note both Spoke GWs will be forwarding traffic in an event of tunnel failure between a Spoke VPC/VNet and Transit VPC/VNet. For best practice, the HA GW should be launched on a different public subnet (in AWS, GCP, or OCI) in a different AZ.

HAVPC

Setting Value
Aviatrix Spoke Gateway Select the Spoke GW for which you want to enable HA
HA Gateway Subnet Select the subnet in which you want to enable HA. A best practice is to select a different public subnet from the original Spoke GW in a different AZ.
Allocate New EIP Select this checkbox to have the Controller allocate a new EIP and associate it with the HA gateway instance. If you do not select this option, the Controller looks for an allocated but unassociated EIP in the Spoke GW account.

To disable Spoke GW HA, go to the Gateway page and delete the Spoke GW with -hagw in the name extension.

Attach/Detach

To attach or detach a Spoke Gateway to a Transit Network, select the Attach/Detach tab in the top right of the Multi-Cloud Transit Network Workflow page in your Aviatrix Controller.

1a. Attach: Attach Spoke Gateway to Transit Network

This step attaches a Spoke VPC/VNet to the Transit GW Group by building an Aviatrix encrypted peering and transitive peering between the Spoke GW and the Transit GW. The Controller also instructs the Transit GW to start advertising the Spoke VPC/VNet CIDR to VGW via the established BGP session.

To attach a Spoke Gateway to a Transit Gateway:

  1. Click on the Spoke Gateway/SourceGateway dropdown menu and select the Spoke Gateway to attach.
  2. Click on the Transit Gateway/NextHop Gateway dropdown menu and select a Transit Gateway.
  3. Click Attach.

To attach more Spoke VPC/VNets to this Transit GW Group, click on the Spoke Gateway/Source Gateway dropdown menu and select a new Gateway to attach.

1b. Attach Azure ARM Spoke through Native Peering

AWS VGW (VPN Gateway)

Aviatrix automates the process of discovering and connecting to AWS VGW. The instruction below is for connecting Aviatrix Transit GW to AWS VGW.

Before executing this step, a VGW must have already been created on AWS console.

Select the VGW ID in the dropdown menu.

As a result of this step, a Customer Gateway and a Site2Cloud Connection between the VGW to the Aviatrix Transit GW will be automatically created. The site2cloud IPSEC tunnel establishes a BGP session to exchange routes between on-prem and the cloud. You also can view them under Customer Gateways and Site-to-Site VPN Connections of the AWS console.

Setting Value
Cloud Type Azure
Transit Gateway Name A unique name to identify the Transit GW
Spoke VNet Account Name An Aviatrix account that corresponds to a subscription in Azure
Spoke VNet Region Spoke VNet region
Spoke VNet Name: Resource Group The Spoke VNet Name

2a. Detach: Detach Aviatrix Spoke Gateway

This step detaches one Aviatrix Spoke VPC/VNet from a Transit GW Group. The Controller also instructs the Transit GW to stop advertising the Spoke VPC/VNet CIDR to VGW.

  1. Click on the Aviatrix Transit Gateway dropdown menu and select the Spoke Gateway.
  2. Click on the Aviatrix Spoke Gateway dropdown menu and select the Spoke Gateway to detach.
  3. Click Detach.

Note that the Spoke GW is not deleted and you can use the top section of this page in the Controller to attach the Transit GW group again.

Setting Value
VPC ID The Transit VPC ID where Transit GW was launched
Connection Name A unique name to identify the connection to VGW
Aviatrix Gateway BCP ASN The BGP AS number the Transit GW will use to exchange routes with VGW
Primary Aviatrix Gateway The Transit GW you created in Step 1
AWS VGW Account Name The Aviatrix account that VGW is created with. This account could be the same as the account used by Transit GW, or it could be by a different account
VGW Region The AWS region where VGW is created
VGW ID VGW that is created in the VGW Region in the AWS VGW Account

2b. Detach Azure Native Spoke

This step detaches an Azure Native Spoke from an Aviatrix Transit Gateway.

  1. Click on the Aviatrix Transit Gateway Name dropdown menu and select the Transit Gateway.
  2. Click on the Spoke VNet dropdown menu and select the name of the Spoke VNet to detach.
  3. Click Detach.

Add More Spoke VPC/VNets

Repeat steps 1a and 1b to add more Spoke VPC/VNets to the Transit GW group.

You can check if routes are properly propagated by going to Multi-Cloud Transit > Advanced Config on the left sidebar, and selecting BGP. Select the Transit GW and click Details. The learned routes should be the list of the routes propagated from VGW. Scroll down to see the total number of learned routes.

External Device

To connect to or disconnect from an AWS VGW, External Device, or Azure VNG, select the External Device tab in the top right of the Multi-Cloud Transit Network Workflow page in your Aviatrix Controller.

1. Connect: Connect to VGW/External Device/Azure VNG

Tip

If you do not see the Transit GW you just created, refresh the browser.

This page displays the three options to connect to a Transit GW to an on-prem network. Choose one option that meets your network requirements.

  • AWS VGW (This is the default setting)
  • External Device (over Direct Connect or over Internet)
  • Azure VNG

as shown below.

transit_to_onprem-2

Transit Gateway Connect Type Performance HA Route Limit Deployment notes
AWS VGW 1.25Gbps Active/Active 100 VGW should be detached. Use the instruction here to build encryption between VGW and on-prem router.
External Device Up to 10Gbps Active/Standby Unlimited VGW should be attached. Aviatrix Transit Gateway establishes BGP + IPSEC with on-prem router.
Azure VNG 10Gbps Active/Active Unlimited VNG should be attached.

AWS VGW (VPN Gateway)

Aviatrix automates the process of discovering and connecting to AWS VGW. The instruction below is for connecting Aviatrix Transit GW to AWS VGW.

Before executing this step, a VGW must have already been created on AWS console.

Select the VGW ID in the dropdown menu.

As a result of this step, a Customer Gateway and a Site2Cloud Connection between the VGW to the Aviatrix Transit GW will be automatically created. The site2cloud IPSEC tunnel establishes a BGP session to exchange routes between on-prem and the cloud. You also can view them under Customer Gateways and Site-to-Site VPN Connections of the AWS console.

Important

You are responsible for building the connection between VGW and on-prem. The connection is either over the Internet, over Direct Connect or both.

We support two patterns of connections: Detached VGW and Attached VGW. The VGW should not be attached to the Transit VPC/VNet.

Currently, only one connection is supported on a specific Transit Gateway/VPC, regardless of which of the three options above is chosen.

VGW

Setting Value
VPC ID The Transit VPC ID where Transit GW was launched
Connection Name A unique name to identify the connection to VGW
Aviatrix Gateway BCP ASN The BGP AS number the Transit GW will use to exchange routes with VGW
Primary Aviatrix Gateway The Transit GW you created in Step 1
AWS VGW Account Name The Aviatrix account that VGW is created with. This account could be the same as the account used by Transit GW, or it could be by a different account
VGW Region The AWS region where VGW is created
VGW ID VGW that is created in the VGW Region in the AWS VGW Account

Note that the Aviatrix Transit GW can connect to a VGW that belongs to a different AWS account in a different region.

It takes a few minutes for the VPN connection to come up and routes from VGW to be propagated. When the IPSEC tunnel with a VGW is up, the Controller admin should receive an email notification.

If you log in to the AWS Console and select “service VPC” in the region where the VGW is, you should see Customer Gateway and VPN Connections have been created. Do not delete or modify them from AWS Console. These resources are deleted if you Disconnect the VGW.

You can check if routes are properly propagated by going to Multi-Cloud Transit > Advanced Config on the left sidebar, and selecting BGP. Select the Transit GW and click Details. The learned routes should be the list of the routes propagated from VGW. Scroll down to see the total number of learned routes.

External Device

The External Device option allows you to build IPSEC tunnel, GRE tunnel or Ethernet LAN directly to on-prem or in the cloud device. It bypasses the AWS VGW or Azure VPN gateway for exchanging routes with on-prem, thus overcoming the route limit by these native services.

To learn how to leverage External Device to connect to variety of devices, read more about External Device FAQ. Follow the instructions in this link to complete this Step.

Azure VNG

With this option, data packets are forwarded natively to on-prem through Azure Virtual Network Gateway (VNG) either over Express Route or Internet, and in the meantime, Aviatrix Transit Gateways are inserted in the data path between VNG and Spoke VNet. This allows you to run advanced function such as firewall inspection for on-prem to Spoke and between the Spokes.

See Multi-Cloud Transit Integration with Azure VNG.

Disconnect: Disconnect AWS VGW/External Device/Azure VNG

Use this section to disconnect AWS VGW/External Device/Azure VNG connections.

To disconnect or detach one of these connections:

  1. Click on the Connection Name dropdown menu and select the connection to disconnect.
  2. Click Detach.

View the Network Topology

After setting up your Multi-Cloud Transit Network Workflow, you can view the network topology by going to the Dashboard and reviewing the Map View.

Troubleshoot BGP

To troubleshoot BGP:

  1. Under Multi-Cloud Transit on the left sidebar, click BGP. The Transit GW will have BGP Mode as Enabled.
  2. Click the Transit GW and click Details to see Advertised Networks and Learned Networks.

Learned Networks are network CIDR blocks that BGP learned from VGW. Advertised Networks are Spoke VPC/VNet CIDRs.

You can also click Diagnostics. Select one of the show commands or type in yourself if you know the commands to see more BGP details.

To troubleshooting connectivity between a Spoke VPC/VNet instance and a on-prem host, follow these steps.

Disable Transit GW HA

If you need to disable a Transit GW HA (for example, if you deployed it in the wrong subnet or AZ), use the Gateway page to do so. A best practice is to make sure there is no traffic going through the backup Transit GW before disabling it.

  1. Go to the Gateway page and locate the Transit GW with “-hagw” in the gateway name extension.
  2. Highlight the gateway and click Delete.

Note that the Transit GW and its backup companion are in an active/active state, that is, both gateways could be forwarding traffic. As noted above, a best practice is to make sure there is no traffic going through the backup Transit GW before disabling it.

Transit Network APIs

There are multiple resources to help you automate Transit Network setup. Note that if you are building a Transit Network following the workflow, you should follow the Terraform example.

Extras

The above workflow abstracts and combines multiple existing Aviatrix features, such Encrypted Peering, Transitive Peering and Site2Cloud to bring you a wizard like experience so that you do not go to multiple pages on the Controller console when building the Transit network.

After you have built the Transit GW and Spokes, you can view the connection between Transit GW and VGW on the Site2Cloud page. You can also see the Spoke to Transit GW connections on the Peering page.

Important

Stay on the Transit Network page for any Spoke Gateway and Transit GW actions such as attaching a Spoke, detaching a Spoke, connecting to VGW and disconnecting from a VGW. Do not go to any other pages for these actions. For deleting a Spoke Gateway or Transit Gateway, go to the Gateway page, select the gateway and delete.