> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Transit Gateway BGP Over LAN in AWS Workflow

> Steps to build an Aviatrix Transit Gateway to External Device connection using BGP over LAN in AWS, enabling communication without tunneling protocols like IPsec or GRE.

This document describes steps to build an Aviatrix Transit Gateway to External
Device using BGP over LAN in AWS.

Refer to the following sections for the BGP over LAN workflows in other clouds:

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/routing/transit-externaldevice-azure-bgpolan"}>Azure Multicloud Transit BGP over LAN Workflow</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/routing/transit-externaldevice-gcp-multipeer-bgpolan"}>Multicloud Transit BGP over LAN in GCP Workflow</a>

## Introduction

Transit BGP to LAN allows Aviatrix Transit Gateways to communicate with a pair
of instances in the same VPC in AWS without running any tunneling protocol such
as IPsec or GRE. One use case is to interoperate with third-party virtual
appliances such as SD-WAN cloud instances that do not have the capability to
support BGP over any tunneling protocols.

For example, integrating with SD-WAN gateways can be deployed as below, where an
Aviatrix Multicloud Transit Gateway connects to a third-party cloud instance in
the same VPC in AWS.

<img src="https://mintcdn.com/aviatrix-14b37c43/DtLW-mqMRi95qZN9/images/guides/connectivity/routing/sd-wan-integ-aws.png?fit=max&auto=format&n=DtLW-mqMRi95qZN9&q=85&s=11edc7cbea02ebf5c22ecd38082c8c8d" alt="sd_wan_integ_aws" width="1396" height="988" data-path="images/guides/connectivity/routing/sd-wan-integ-aws.png" />

*Configuration Overview*

The following is an overview on the steps to configure the BGP over LAN
solution:

1. [Deploy Aviatrix Transit Solution](#deploying-the-aviatrix-multicloud-transit-solution)
2. [Launch third-party cloud instances](#launching-third-party-cloud-instances)
3. [Build BGP over LAN](#building-bgp-over-lan)

For more information about Multicloud Transit Network and External Device,
please see:

* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/connectivity/transit-network-faq"}>Multi Cloud Global Transit FAQ</a>
* [Global Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)](https://legacy.docs.aviatrix.com/documentation/latest/network/gateway-transit-create.html)
* [Aviatrix Transit Gateway to External Devices](https://legacy.docs.aviatrix.com/documentation/latest/network/transit-to-externaldevice.html)
* <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/architecture/connectivity/multi-cloud-design-patterns"}>Transit Network Design Patterns</a>

<Note>
  - This solution supports only <a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/connectivity/activemesh-about"}>ActiveMesh 2.0</a>, please check this doc [How to migrate to ActiveMesh 2.0](https://legacy.docs.aviatrix.com/documentation/latest/network/activemesh-migration.html) for migration detail.
  - This solution is available to AWS and Azure. The AWS workflow in this document is just an example. Please adjust the topology depending on your requirements.
  - **Controller 8.2 or later**: An instance size that supports at least 2 interfaces is required, such as t3.small and t2.medium in AWS.
  - **Controller 6.3 to 8.1**: An instance size that supports at least 5 interfaces is required, such as c4.4xlarge, c5.4xlarge, and c5n.4xlarge in AWS.
  - LAN interfaces for Aviatrix Transit Primary and third-party cloud instance must be in the same Availability Zone.
</Note>

## The key ideas for this solution are:

* A BGP session is established between a third-party cloud instance and an
  Aviatrix Transit Gateway via each LAN interface in the same VPC.
* Data plane traffic also runs between a third-party cloud instance and Aviatrix
  Transit Gateway via each LAN interface without a tunnel protocol such as IPsec
  and GRE.

## Prerequisites

* <a href={"/docs/enterprise/" + "10.1" + "/guides/maintenance/upgrade-overview"}>Upgrade</a>
  Aviatrix Controller to at least version 6.3 for the instance with a minimum of
  5 interfaces and Controller version to 8.2 for the instance with a minimum of
  2 interfaces.
* In this example, you are going to deploy the below VPCs in AWS:
  * Transit VPC (i.e. 10.1.0.0/16) by utilizing Aviatrix feature
    <a href={"/docs/enterprise/" + "10.1" + "/reference/ui/cloud-resources/cloud-networks#create-vpcvnet"}>Create a VPC</a>
    with Aviatrix FireNet VPC option enabled.
  * Spoke VPCs (i.e. 192.168.1.0/24 and 192.168.2.0/24) by utilizing Aviatrix
    feature
    <a href={"/docs/enterprise/" + "10.1" + "/reference/ui/cloud-resources/cloud-networks#create-vpcvnet"}>Create a VPC</a>
    as the previous step or manually deploying it in each cloud portal.
    Moreover, feel free to use your existing cloud network.
* Third-party cloud instance supports high throughput.

<a id="deploying-the-aviatrix-multicloud-transit-solution" />

## Deploying the Aviatrix Multicloud Transit Solution

Refer to
[Global Transit Network Workflow Instructions](https://legacy.docs.aviatrix.com/documentation/latest/network/gateway-transit-create.html)
for the below steps. Please adjust the topology depending on your requirements.

1. Deploy the
   [Aviatrix Multicloud Transit Gateway and HA](https://legacy.docs.aviatrix.com/documentation/latest/network/gateway-transit-create.html)
   with High Performance Encryption Mode enabled. In this example, size
   c5n.4xlarge is selected to benchmark [performance](#performance-benchmark).

2. Deploy a
   [Spoke Gateway and HA](https://legacy.docs.aviatrix.com/documentation/latest/network/gateway-spoke-create.html)
   to launch Aviatrix Spoke gateway and enable HA with High Performance
   Encryption Mode enabled in the Spoke VPC. In this example, size c5n.4xlarge
   is selected to benchmark [performance](#performance-benchmark).

3. To resize an existing Aviatrix Gateway to t3.small or t2.medium (2
   interfaces), only for BGP over LAN, ensure FireNet option is disabled, see
   [Resizing Aviatrix Gateway Instances](https://legacy.docs.aviatrix.com/documentation/latest/network/gateway-resize.html?expand=true)

4. Attach
   [Spoke Gateways to Transit Network](https://legacy.docs.aviatrix.com/documentation/latest/network/spoke-attach-transit.html).

<a id="launching-third-party-cloud-instances" />

## Launching Third-Party Cloud Instances

Deploy third-party cloud instances in the same VPC where the Aviatrix Transit
Gateways are located.

1. Create a third-party cloud instance and put the MGMT interface in the public
   gateway subnet.
2. Create a new public WAN subnet and a dedicated routing table for the WAN
   interface if needed.
3. Create a new private LAN subnet and a dedicated routing table (optional) for
   the LAN interface.
4. Make sure the function "Source/Dest check on third-party cloud instance's
   interfaces" is disabled.

<Note>
  The primary Aviatrix Transit Gateway must be deployed in the same Available
  Zone (AZ) as the first third-party cloud instance. The HA Transit Gateway if
  deployed must reside in the same AZ as the second cloud instance.
</Note>

<a id="building-bgp-over-lan" />

## Building BGP over LAN

Configure BGP over LAN on the Aviatrix Transit Gateway.

1. In CoPilot, go to Networking > Connectivity > External Connections (S2C).
2. Click *External Connection*.
3. In the Add External Connection dialog, select *External Device* and *BGP over
   LAN*.
4. Enter the following information in the fields.

| Setting                          | Value                                                                                                                                                                                                   |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Transit VPC Name                 | Select the Transit VPC ID where Transit GW was launched                                                                                                                                                 |
| Connection Name                  | Provide a unique name to identify the connection to external device                                                                                                                                     |
| Aviatrix Transit Gateway BGP ASN | Configure a BGP AS number that the Transit GW will use to exchange routes with external device                                                                                                          |
| Primary Aviatrix Transit Gateway | Select the Transit GW                                                                                                                                                                                   |
| Enable Remote Gateway HA         | Check this option in this example to connect two external devices                                                                                                                                       |
| Remote BGP AS Number             | Configure a BGP AS number that third-party cloud primary instance will use to exchange routes with Aviatrix Transit Primary                                                                             |
| Remote LAN IP                    | Use the private IP of the LAN interface of the third-party cloud primary instance                                                                                                                       |
| Local LAN IP                     | Leave it blank and the Controller will assign an IP in the same subnet as the Remote LAN IP. Optionally configure an IP of your choosing within the same subnet of the Remote LAN IP.                   |
| Remote BGP AS Number (Backup)    | Configure a BGP AS number that the third-party cloud HA instance will use to exchange routes with Aviatrix Transit HA.                                                                                  |
| Remote LAN IP (Backup)           | Use the private IP of the LAN interface of the third-party cloud HA instance.                                                                                                                           |
| Local LAN IP (Backup)            | Leave it blank and the Controller will assign an IP in the same subnet as the Remote LAN IP (Backup). Optionally configure an IP of your choosing within the same subnet as the Remote LAN IP (Backup). |

5. Click *Save* to generate BGP session over LAN.

## Downloading the BGP over LAN configuration

1. On the External Connections (S2C) tab, click the vertical ellipsis
   <img src="https://mintcdn.com/aviatrix-14b37c43/DtLW-mqMRi95qZN9/images/guides/connectivity/routing/threedot.png?fit=max&auto=format&n=DtLW-mqMRi95qZN9&q=85&s=516b20b89d4d7e5676f53271547074a2" alt="20" width="24" height="34" data-path="images/guides/connectivity/routing/threedot.png" /> and select *Download
   Configuration*.
2. Select the Vendor type, Platform, and Software.
3. Click *Download*.

## Configuring BGP over LAN on Third-Party Cloud Instance

1. Open the downloaded BGP over LAN configuration file.
2. Configure the related BGP and LAN settings in the third-party cloud instance.

### Verifying the LAN Connection Status

You can check the tunnel status by going to Diagnostics > Cloud Routes >
External Connections and checking the Tunnel Status column for the external
connection.

### Verifying the BGP Session Status

You can check the BGP Session status by going to Diagnostics > Cloud Routes >
BGP Info. The Status should be Established. If some external connections for the
selected Transit Gateway are Not Established, the overall BGP Status for the
Transit Gateway is Partially Established.

## Ready to Go

At this point, run connectivity and performance tests to ensure everything is
working correctly. You can do this with the

<a href={"/docs/enterprise/" + "10.1" + "/reference/ui/diagnostics/diagnostic-tools"}>Diagnostic Tools</a>
.

<a id="performance-benchmark" />

## Performance Benchmark

### End-to-End traffic via Aviatrix - Aviatrix

The performance test is done with a pair of Aviatrix Transit Gateways as the
third-party cloud instances, as shown below.

#### Multiple flows result by using iperf3 tool with TCP 128 connections

| Aviatrix Gateway size | Throughput (Gbps) |
| --------------------- | ----------------- |
| C5n.4xlarge           | 23 - 24           |