Transit Gateway GRE Tunneling in AWS Workflow

​

Introduction

1. Building underlay connectivity with AWS Direct Connect 10 Gbps capacity.
2. Deploying Aviatrix Transit Solution.
3. Establishing connectivity between edge router and Aviatrix Transit Gateway to form GRE tunnel.
4. Building GRE tunnel and BGP over GRE.
5. Enabling ECMP Load Balancing to achieve high performance.

• Multi Cloud Global Transit FAQ
• Global Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)
• Aviatrix Transit Gateway to External Devices
• Transit Network Design Patterns

​

The key ideas for this solution are:

• The edge (WAN) router runs a BGP session to AWS VGW via AWS Direct Connect where the edge router advertises its GRE IPs. AWS VGW advertises the AWS Transit VPC CIDR.
• Leverage edge router BGP ECMP feature.
• Configure multiple GRE tunnels for greater aggregate throughput.

​

Prerequisites

• Upgrade Aviatrix Controller to the latest version.
• In this example, we are going to deploy the below VPCs in AWS:
  • AWS Aviatrix Transit VPC (i.e. 10.1.0.0/16) by utilizing Aviatrix feature Create a VPC with Aviatrix FireNet VPC option enabled
  • AWS Aviatrix Spoke VPC (i.e. 192.168.1.0/24) by utilizing Aviatrix feature Create a VPC as the previous step or manually deploying it in each cloud portal. Moreover, feel free to use your existing cloud network.
• Edge router has high throughput supported on hardware interface(s) and GRE tunnel(s)

​

Building Underlay Connectivity with AWS Direct Connect

​

Building AWS Direct Connect

​

Associating AWS VGW to AWS Transit VPC

1. Log in to the AWS VPC Portal and select Virtual Private Gateways under the Virtual Private Network (VPN) sidebar.
2. Select the Virtual Private Gateway that you have the private virtual interface to AWS Direct Connect
3. Click Actions.
4. Select Attach to VPC.
5. Select the AWS Transit VPC and click Attach to VPC.

​

Deploying the Aviatrix Multicloud Transit Solution

​

Step 2.1. Deploy Aviatrix Multicloud Transit Gateway and HA in AWS

• Follow this step to Deploy the Aviatrix Transit Gateway to launch Aviatrix Transit gateway and enable HA with insane mode enabled in the AWS Transit VPC.
• In this example, sizes c5n.2xlarge and c5n.4xlarge are selected to benchmark performance.

​

Enabling Route Propagation on the Subnet Route Table where Aviatrix Transit Gateway Locates on AWS Portal

1. Log in to the AWS VPC portal and locate the subnet route table where the Aviatrix Transit Gateway is located.
2. Select Route Propagation tab.
3. Click Edit route propagation.
4. Locate the AWS VGW that is associated with this Transit VPC and mark the Propagate checkbox.
5. Click Save.
6. Check that the Propagate status is Yes.

​

Deploying Spoke Gateway and HA

​

Attaching Spoke Gateways to Transit Network

​

Building Connectivity between Edge Router and Aviatrix Transit Gateway

​

Checking Whether the edge router has Learned AWS Transit VPC CIDR via the BGP Session Between Edge Router and AWS Direct Connect

1. Log in to the edge router (i.e. Cisco ASR).
2. Check whether edge router has learned AWS Transit VPC CIDR via the BGP session between edge router and AWS Direct Connect by issuing the related “show ip bgp” command.

#show ip bgp

​

Preparing IP for GRE source IP on Edge Router

1. Create a loopback interface and assign an IP to itself as a GRE source IP.

#configure t

  (config)#interface Loopback77

  (config-if)#ip address 192.168.77.1 255.255.255.255

​

Advertising that GRE source IP on Edge Router to the BGP Session Between Edge Router and AWS Direct Connect

1. Create a prefix list that defines GRE source IP on edge router for BGP advertisement.

#configure t

(config)#ip prefix-list Router-to-VGW description Advertised GRE source CIDRs 192.168.77.X/32 to build GRE tunnels

(config)#ip prefix-list Router-to-VGW seq 10 permit 192.168.77.1/32

2. Apply this prefix list to outgoing BGP advertisements

#configure t

(config)#router bgp 65000

(config-router)#address-family ipv4

(config-router-af)#neighbor 169.254.253.17 prefix-list Router-to-VGW out

​

Checking Route Propagation Info on AWS Portal

1. Log in to the AWS VPC portal and locate the subnet route table where Aviatrix Transit Gateway is located.
2. Select the VPC > Route tables tab.
3. Check whether there is a route entry “GRE source IP on edge router pointing to AWS VGW.”

​

Confirming that Edge Router and Aviatrix Transit Gateway can Reach each other’s IP for GRE Tunnel

1. Click + Connection.
2. Enter the following values:

3. Click Connect to generate GRE tunnel and its BGP session.

​

Downloading the GRE Configuration Sample

1. Find the connection you created and click the vertical ellipsis .
2. Click Download Configuration.
3. Enter the following values:

4. Click Download.

​

Configuring GRE tunnel on Edge Router

1. Open the downloaded GRE configuration file.
2. Populate these values as follows based on your setup throughout the Tunnel Interface Configuration.

• <tunnel_number1>: the primary GRE tunnel interface number connecting Aviatrix Transit Primary Gateway (i.e. 11)
• <tunnel_number2>: the secondary GRE tunnel interface number connecting Aviatrix Transit HA Gateway (i.e. 12)
• <ios_wan_interface1>: the IP which is assigned on the Loopback interface as an GRE source IP (i.e. 192.168.77.1)
• <ios_wan_interface2>: the IP which is assigned on the Loopback interface as an GRE source IP (i.e. 192.168.77.1)

3. Copy and paste the updated Tunnel Interface Configuration into the edge router.

interface Tunnel 11
ip address 169.254.61.205 255.255.255.252
ip mtu 1436
ip tcp adjust-mss 1387
tunnel source 192.168.77.1
tunnel destination 10.1.0.185
ip virtual-reassembly
no keepalive
exit

interface Tunnel 12
ip address 169.254.173.77 255.255.255.252
ip mtu 1436
ip tcp adjust-mss 1387
tunnel source 192.168.77.1
tunnel destination 10.1.1.27
ip virtual-reassembly
no keepalive
exit

​

Configuring BGP over GRE tunnel on Edge Router

1. Open the downloaded GRE configuration file and copy and paste the BGP Routing Configuration into edge router.

router bgp 65000
bgp log-neighbor-changes
neighbor 169.254.61.206 remote-as 65212
neighbor 169.254.61.206 timers 10 30 30
neighbor 169.254.173.78 remote-as 65212
neighbor 169.254.173.78 timers 10 30 30
!
address-family ipv4
redistribute connected
neighbor 169.254.61.206 activate
neighbor 169.254.61.206 soft-reconfiguration inbound
neighbor 169.254.173.78 activate
neighbor 169.254.173.78 soft-reconfiguration inbound
maximum-paths 4
exit-address-family

2. Create a prefix list that defines CIDR where server locates in on-prem/co-location for BGP advertisement.

#configure t

(config)#ip prefix-list Router-To-Transit-GRE description Advertised on-prem CIDRs 10.220.5.0/24

(config)#ip prefix-list Router-To-Transit-GRE seq 10 permit 10.220.5.0/24

3. Apply the prefix list to outgoing BGP advertisements.

#configure t

(config)#router bgp 65000

(config-router)#address-family ipv4

(config-router-af)#neighbor 169.254.61.206 prefix-list Router-To-Transit-GRE out

(config-router-af)#neighbor 169.254.173.78 prefix-list Router-To-Transit-GRE out

​

Verifying GRE Tunnel Status on Aviatrix Controller

1. In CoPilot, go to Networking > Connectivity > External Connections (S2C) tab.
2. Find the connection that you created. The green dot next to the Connection Name indicates the connection is Up.

3. Go to Cloud Fabric > Gateways > Transit Gateways.
4. Select the Transit Primary Gateway that was created in the previous step.
5. Click Details/Diag.
6. Click the Connections sub-tab.
7. Find the connection that you created with Connection Name in the previous step and check the Tunnel Status.

​

Verifying BGP Session Status

1. Go to Diagnostics > Cloud Routes > BGP Info.
2. Find the connection that you created with Connection Name in the previous step and check the status. The Status should be Established. If some external connections for the selected Transit Gateway are Not Established, the overall BGP Status for the Transit Gateway is Partially Established.

​

Configuring ECMP Load Balancing for High Performance

​

Building Multiple GRE tunnels between Edge Router and Aviatrix Transit Gateway

1. Building multiple GRE tunnels by repeating Build connectivity between edge router and Aviatrix Transit Gateway.
2. Build multiple BGP over GRE tunnels by repeating Build GRE tunnel and BGP over GRE.

​

Enabling BGP ECMP feature on Aviatrix Transit Gateway

1. In CoPilot, go to Cloud Fabric > Gateways > Transit Gateways and select the Transit Gateway that was created in the previous step.
2. On the Settings sub-tab, under Border Gateway Protocol, toggle the BGP ECMP setting to On.

​

Verifying BGP ECMP feature on Aviatrix Controller

1. With the same Transit Gateway selected, click the VPC/VNet Route Tables tab.
2. Select the Transit Primary Gateway that was created in the previous step.
3. Click the Gateway Routes sub-tab.
4. Search for the on-prem CIDR in the Destination column.
5. Check whether there are multiple GRE tunnels with same Metric and Weight under the same route entry.

​

Enabling the BGP ECMP feature on Edge Router

1. Configure “maximum-paths” with higher number of equal-cost routes in BGP settings so that BGP will install in the routing table. In this example, we configure “maximum-paths 8” to achieve high performance over multiple GRE tunnels.

#configure t

(config)#router bgp 65000

(config-router)#address-family ipv4

(config-router-af)#maximum-paths 8

2. Modify ECMP Load Balancing algorithm depending on traffic type.

#configure t

(config)#ip cef load-sharing algorithm include-ports source destination

​

Verifying the BGP ECMP feature on Edge Router

​

Ready to Go

​

Performance Benchmarks

​

End-to-End traffic via Aviatrix to Cisco ASR

​

Multiple flows result by using iperf3 tool with TCP 128 connections

​

Single flow result by using iperf3 tool with TCP 1 connection: