> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploying Aviatrix UserVPN with AWS TGW

> This document describes how to deploy the Aviatrix UserVPN solution with an AWS TGW (Transit Gateway). See Overview of AWS Transit Gateway Orchestrator Features for more information about AWS TGW.

This document describes how to deploy the Aviatrix UserVPN solution with an AWS
TGW (Transit Gateway). See
[Overview of AWS Transit Gateway Orchestrator Features](https://legacy.docs.aviatrix.com/documentation/latest/network/tgw-vpc-attachment-create.html/tgw/tgw-overview)
for more information about AWS TGW.

## Use AWS Transit Gateway to Access Multiple VPCs in One Region

This reference guide will show how you can use an AWS Transit Gateway (TGW) to
allow remote users to connect to multiple VPCs in the same region. Please see
the overview images below for reference. In this walkthrough, it is assumed you
have created VPCs in your environment. If not, you can create and deploy VPCs
directly from Aviatrix CoPilot. See
[Create a VPC](https://legacy.docs.aviatrix.com/documentation/latest/platform-administration/copilot/vpc-vnet-create.html).

<img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/uservpn-sd.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=2fc16bb1baea9335030d3332bc32121e" alt="VPN with TGW One Region" width="1966" height="1238" data-path="images/guides/uservpn/uservpn-sd.png" />

### Creating a TGW

The first step is to <a href={"/docs/enterprise/" + "10.1" +
"/concepts-architectures/components/tgw/tgw-landing-page"}>create a TGW</a> from
Aviatrix CoPilot.

Enable Split Tunnel mode for this gateway.

<img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/create-tgw.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=b0ad626f7bff73b35a2f7640b00c7f63" alt="Create TGW" width="1080" height="820" data-path="images/guides/uservpn/create-tgw.png" />

To learn more about Transit Gateway deployment, see

<a href={"/docs/enterprise/" + "10.1" + "/concepts-architectures/components/tgw/tgw-orchestrator-faq"}>Aviatrix AWS Transit Gateway Orchestrator FAQ</a>
.

### Creating a Security Domain

Now,

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/network-segmentation-secured#segmentenable"}>create</a>
three security domains:

1. Shared Service Domain
2. Dev Domain
3. Prod Domain

### Building Connection Policies

You have now created Network Domains. The next step is to use

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/network-segmentation-secured#segmentenable"}>connection policies</a>
to connect:

1. The Shared Service Domain to the Dev Domain.
2. The Shared Service Domain to the Prod Domain.

<Note>
  You can call these domains any name and use as many domains as needed. As seen
  in the images below, Dev and Prod are simply called Domain 1 and Domain 2.
</Note>

### Attaching VPCs to TGW

The next step is to

<a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity"}>
  attach your existing VPCs
</a>

to the Transit Gateway (TGW) created above. Use the Shared Service Domain for
this attachment.

### Launching a VPN Gateway

After attaching VPCs to the TGW, <a href={"/docs/enterprise/" + "10.1" +
"/guides/uservpn/user-vpn-gateway-default-vpn-create"}>create a VPN Gateway</a>
so users can access the instances in the VPCs. Use the VPC, Shared Service
Domain, and region used above.

A new VPN Gateway will be created in the Shared Service VPC.

### Adding Dev and Prod Domains to Split Tunnel Mode

1. Return to the TGW you created and
   [edit](https://legacy.docs.aviatrix.com/documentation/latest/uservpn/uservpn-admin-guide/user-vpn-user-edit.html)
   it.
2. In the Split Tunnel section that appeared when you enabled Split Tunnel mode,
   In the Additional CIDRs field of the Split Tunnel section, add the IPv4 CIDR
   ranges for the Dev and Prod VPCs.
3. Click **Save**.

### Configuring Aviatrix VPN Client

1. [Add a new VPN User](https://legacy.docs.aviatrix.com/documentation/latest/uservpn/uservpn-admin-guide/user-vpn-user-create.html).
   For the VPC ID, use the Shared Service VPC ID.
2. Download your UserVPN configuration file.
3. <a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/user-vpn-client-download"}>Download</a>
   the latest Aviatrix VPN Client from the Docs page.
4. After installing the client, import your UserVPN configuration file to the
   Aviatrix VPN Client. Once the client is open, click **+** and choose your
   .ovpn file.
5. After the configuration file is imported, click **Connect**.

<img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/avtx-vpn-client-setup.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=bc419c2911f8e4a6353916ae3200c78f" alt="Aviatrix VPN Client Setup" width="1536" height="1662" data-path="images/guides/uservpn/avtx-vpn-client-setup.png" />

You are now connected via the Aviatrix VPN Client. Test that everything has been
correctly configured.

1. Find and save the Private IP address of the EC2 instance running in either
   Dev or Prod VPCs. These IPs can be found in the AWS Console page under the
   EC2 banner.
2. Open a terminal on your computer and see if you can ping the EC2 instance
   using its private IP address. If you are connected to the Aviatrix VPN
   Client, you should see a response.
3. To check, disconnect from the Aviatrix VPN Client. You should not see a
   response.

See below for an example of a proper ping response.

<img src="https://mintcdn.com/aviatrix-14b37c43/MwMAaVUDwCmP6YfF/images/guides/uservpn/ping-test.png?fit=max&auto=format&n=MwMAaVUDwCmP6YfF&q=85&s=252dbec899ffcedef4e1f6d5961b6d7a" alt="Ping Test" width="1232" height="662" data-path="images/guides/uservpn/ping-test.png" />

### Last Steps

One last option for testing

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/network-segmentation-secured#segmentenable"}>connection policies</a>
:

* As a test, remove either the Dev or Prod Domain from the Connected list.
* Remove Dev from the "Connected" list for the Shared Service Policy and run a
  Ping test. You should receive no response from the EC2 instance in the
  Development VPC.