AWS Direct Connect · AWS Direct Connect User Guide Amazon's trademarks and trade dress may not be...

AWS Direct ConnectUser Guide

AWS Direct Connect: User GuideCopyright © 2018 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

AWS Direct Connect User Guide

Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any mannerthat is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks notowned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored byAmazon.


Table of ContentsWhat is AWS Direct Connect? ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

AWS Direct Connect Components .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Network Requirements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2AWS Direct Connect Limits ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2Resources .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Accessing a Remote AWS Region .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Accessing Public Services in a Remote Region .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Accessing VPCs in a Remote Region .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Routing Policies and BGP Communities ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Routing Policies ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4BGP Communities ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Getting Started .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Prerequisites ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Step 1: Sign Up for AWS .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Step 2: Request an AWS Direct Connect Connection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

(Sub-1 Gbps Only) Accept Your Hosted Connection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Step 3: Download the LOA-CFA .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Step 4: Create a Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Step 5: Download the Router Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Step 6: Verify Your Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15(Optional) Configure Redundant Connections .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Connections .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Creating a Connection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Downloading the LOA-CFA .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Viewing Connection Details ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Deleting a Connection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Accepting a Hosted Connection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Requesting Cross Connects ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Virtual Interfaces .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Prerequisites for Virtual Interfaces .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Creating a Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Creating a Public Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Creating a Private Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Downloading the Router Configuration File ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Viewing Virtual Interface Details ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Deleting a Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Creating a Hosted Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37Accepting a Hosted Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Adding or Removing a BGP Peer .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40Associating a Virtual Interface .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

LAGs .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Creating a LAG .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Updating a LAG .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46Associating a Connection with a LAG .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46Disassociating a Connection From a LAG .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Deleting a LAG .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Direct Connect Gateways .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48Creating a Direct Connect Gateway .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Associating and Disassociating Virtual Private Gateways .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Creating a Private Virtual Interface to the Direct Connect Gateway .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50Deleting a Direct Connect Gateway .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Using IAM ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53AWS Direct Connect Actions .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53AWS Direct Connect Resources .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

iii


AWS Direct Connect Keys .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Example Policy for AWS Direct Connect .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Using Tags .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55Tag Restrictions .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55Working with Tags .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Using the AWS CLI ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57Step 1: Create a Connection .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57Step 2: Download the LOA-CFA .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58Step 3: Create a Virtual Interface and get the Router Configuration .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Logging API Calls ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62AWS Direct Connect Information in CloudTrail .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Understanding AWS Direct Connect Log File Entries ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Monitoring Connections .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66Monitoring Tools ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

Automated Tools ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66Manual Tools ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Monitoring with Amazon CloudWatch .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67Metrics and Dimensions .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67Creating Alarms .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

Troubleshooting .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71Troubleshooting Layer 1 (Physical) Issues .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71Troubleshooting Layer 2 (Data Link) Issues .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72Troubleshooting Layer 3/4 (Network/Transport) Issues .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74Troubleshooting Routing Issues .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Document History .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78AWS Glossary .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

iv

AWS Direct Connect User GuideAWS Direct Connect Components

What is AWS Direct Connect?AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard 1-gigabit or 10-gigabit Ethernet fiber-optic cable. One end of the cable is connected to your router, theother to an AWS Direct Connect router. With this connection in place, you can create virtual interfacesdirectly to public AWS services (for example, to Amazon S3) or to Amazon VPC, bypassing Internetservice providers in your network path. An AWS Direct Connect location provides access to AWS inthe region with which it is associated, and you can use a single connection in a public region or AWSGovCloud (US) to access public AWS services in all other public regions.

The following diagram shows how AWS Direct Connect interfaces with your network.

Contents• AWS Direct Connect Components (p. 1)• Network Requirements (p. 2)• AWS Direct Connect Limits (p. 2)• Resources (p. 3)• Accessing a Remote AWS Region (p. 4)• Routing Policies and BGP Communities (p. 4)

AWS Direct Connect ComponentsThe following are the key components that you'll use for AWS Direct Connect.

1

AWS Direct Connect User GuideNetwork Requirements

Connection Create a connection in an AWS Direct Connectlocation to establish a network connectionfrom your premises to an AWS region. For moreinformation, see Connections (p. 17).

Virtual Interface Create a virtual interface to enable access toAWS services. A public virtual interface enablesaccess to public-facing services, such as AmazonS3. A private virtual interface enables accessto your VPC. For more information, see VirtualInterfaces (p. 29) and Prerequisites for VirtualInterfaces (p. 29).

Network RequirementsTo use AWS Direct Connect in an AWS Direct Connect location, your network must meet one of thefollowing conditions:

• Your network is colocated with an existing AWS Direct Connect location. For more information aboutavailable AWS Direct Connect locations, see AWS Direct Connect Product Details.

• You are working with an AWS Direct Connect partner who is a member of the AWS Partner Network(APN). For information, see APN Partners Supporting AWS Direct Connect.

• You are working with an independent service provider to connect to AWS Direct Connect.

In addition, your network must meet the following conditions:

• Your network must use single mode fiber with a 1000BASE-LX (1310nm) transceiver for 1 gigabitEthernet, or a 10GBASE-LR (1310nm) transceiver for 10 gigabit Ethernet.

• Auto-negotiation for the port must be disabled. Port speed and full-duplex mode must be configuredmanually.

• 802.1Q VLAN encapsulation must be supported across the entire connection, including intermediatedevices.

• Your device must support Border Gateway Protocol (BGP) and BGP MD5 authentication.

• (Optional) You can configure Bidirectional Forwarding Detection (BFD) on your network. AsynchronousBFD is automatically enabled for AWS Direct Connect virtual interfaces, but will not take effect untilyou configure it on your router.

AWS Direct Connect supports both the IPv4 and IPv6 communication protocols. IPv6 addresses providedby public AWS services are accessible through AWS Direct Connect public virtual interfaces.

AWS Direct Connect supports a maximum transmission unit (MTU) of up to 1522 bytes at the physicalconnection layer (14 bytes ethernet header + 4 bytes VLAN tag + 1500 bytes IP datagram + 4 bytes FCS).

AWS Direct Connect LimitsThe following table lists the limits related to AWS Direct Connect. Unless indicated otherwise, you canrequest an increase for any of these limits by using the AWS Direct Connect Limits form.

2

http://aws.amazon.com/directconnect/details

https://aws.amazon.com//directconnect/partners/

https://console.aws.amazon.com/support/home#/case/create?issueType=service-limit-increase&limitType=service-code-direct-connect

AWS Direct Connect User GuideResources

Component Limit Comments

Virtual interfaces per AWS Direct Connectconnection

50 This limit cannot be increased.

Active AWS Direct Connect connections perregion per account

10 This limit can be increased upon request.

Routes per Border Gateway Protocol (BGP)session on a private virtual interface


Routes per Border Gateway Protocol (BGP)session on a public virtual interface

1,000 This limit cannot be increased.

Number of connections per link aggregationgroup (LAG)


Number of link aggregation groups (LAGs)per region


Number of Direct Connect gateways peraccount


Virtual private gateways per Direct Connectgateway


Virtual interfaces per Direct Connectgateway


ResourcesThe following related resources can help you as you work with this service.

Resource Description

AWS Direct Connect product information General product overview.

Pricing Calculate monthly costs.

AWS Developer Tools Links to developer tools, SDKs, IDE toolkits, and commandline tools for developing and managing AWS applications.

AWS Direct Connect FAQ The top questions asked about this product.

AWS Direct Connect Forum A community-based forum for discussing technicalquestions related to AWS Direct Connect.

AWS Support Center The hub for creating and managing your AWS Supportcases. Also includes links to other helpful resources, suchas forums, technical FAQs, service health status, and AWSTrusted Advisor.

Contact Us A central contact point for inquiries concerning AWSbilling, account, events, abuse, and other issues.

3

http://aws.amazon.com/directconnect/

http://aws.amazon.com/directconnect/pricing/

https://aws.amazon.com/tools/

http://aws.amazon.com/directconnect/faqs/

https://forums.aws.amazon.com/forum.jspa?forumID=126

https://console.aws.amazon.com/support/home#/

https://aws.amazon.com/contact-us/

AWS Direct Connect User GuideAccessing a Remote AWS Region

Accessing a Remote AWS RegionAWS Direct Connect locations in public regions or AWS GovCloud (US) can access public services in anyother public region (excluding China (Beijing)). In addition, AWS Direct Connect connections in publicregions or AWS GovCloud (US) can be configured to access a VPC in your account in any other publicregion (excluding China (Beijing)). You can therefore use a single AWS Direct Connect connection to buildmulti-region services. All networking traffic remains on the AWS global network backbone, regardless ofwhether you access public AWS services or a VPC in another region.

Any data transfer out of a remote region is billed at the remote region data transfer rate. For moreinformation about data transfer pricing, see the Pricing section on the AWS Direct Connect detail page.

For more information about the routing polices and supported BGP communities for an AWS DirectConnect connection, see Routing Policies and BGP Communities (p. 4).

Accessing Public Services in a Remote RegionTo access public resources in a remote region, you must set up a public virtual interface and establish aBorder Gateway Protocol (BGP) session. For more information, see Virtual Interfaces (p. 29).

After you have created a public virtual interface and established a BGP session to it, your router learnsthe routes of the other public AWS regions. For more information about prefixes currently advertised byAWS, see AWS IP Address Ranges in the Amazon Web Services General Reference.

Accessing VPCs in a Remote RegionYou can create a Direct Connect gateway in any public region and use it to connect your AWS DirectConnect connection over a private virtual interface to VPCs in your account that are located in differentregions. For more information, see Direct Connect Gateways (p. 48).

Alternatively, you can create a public virtual interface for your AWS Direct Connect connection and thenestablish a VPN connection to your VPC in the remote region. For more information about configuringVPN connectivity to a VPC, see Scenarios for Using Amazon Virtual Private Cloud in the Amazon VPC UserGuide.

Routing Policies and BGP CommunitiesAWS Direct Connect applies inbound and outbound routing policies for a public AWS Direct Connectconnection. You can also make use of Border Gateway Protocol (BGP) community tags on advertisedAmazon routes and apply BGP community tags on the routes you advertise to Amazon.

Routing PoliciesIf you're using AWS Direct Connect to access public AWS services, you must specify the public IPv4prefixes or IPv6 prefixes to advertise over BGP.

The following inbound routing policies apply:

• You must own the public prefixes and they must be registered as such in the appropriate regionalinternet registry.

• Traffic must be destined to Amazon public prefixes. Transitive routing between connections is notsupported.

4

http://aws.amazon.com/directconnect/pricing/

http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenarios.html

AWS Direct Connect User GuideBGP Communities

• AWS Direct Connect performs inbound packet filtering to validate that the source of the trafficoriginated from your advertised prefix.

The following outbound routing policies apply:

• AS_PATH is used to determine the routing path, and AWS Direct Connect is the preferred path fortraffic sourced from Amazon. Only public ASNs are used internally for route selection.

• AWS Direct Connect advertises all local and remote AWS Region prefixes where available and includeson-net prefixes from other AWS non-region points of presence (PoP) where available; for example,CloudFront and Route 53.

• AWS Direct Connect advertises prefixes with a minimum path length of 3.• AWS Direct Connect advertises all public prefixes with the well-known NO_EXPORT BGP community.• If you have multiple AWS Direct Connect connections, you can adjust the load-sharing of inbound

traffic by advertising prefixes with similar path attributes.• The prefixes advertised by AWS Direct Connect must not be advertised beyond the network

boundaries of your connection; for example, these prefixes must not be included in any public internetrouting table.

BGP CommunitiesAWS Direct Connect supports a range of BGP community tags to help control the scope (regional orglobal) and route preference of traffic.

Scope BGP CommunitiesYou can apply BGP community tags on the public prefixes you advertise to Amazon to indicate how farto propagate your prefixes in the Amazon network—for the local AWS Region only, all regions within acontinent, or all public regions.

You can use the following BGP communities for your prefixes:

• 7224:9100—Local AWS Region• 7224:9200—All AWS regions for a continent (for example, North America–wide)• 7224:9300—Global (all public AWS Regions)

NoteIf you do not apply any community tags, prefixes are advertised to all public AWS regions(global) by default.

The communities 7224:1 – 7224:65535 are reserved by AWS Direct Connect.

In addition, the well-known NO_EXPORT BGP community is supported for both public and private virtualinterfaces.

AWS Direct Connect also provides BGP community tags on advertised Amazon routes. If you're usingAWS Direct Connect to access public AWS services, this enables you to create filters based on thesecommunity tags.

AWS Direct Connect applies the following BGP communities to its advertised routes:

• 7224:8100—Routes that originate from the same AWS Region in which the AWS Direct Connect pointof presence is associated.

• 7224:8200—Routes that originate from the same continent with which the AWS Direct Connect pointof presence is associated.

5

AWS Direct Connect User GuideBGP Communities

• No tag—Global (all public AWS Regions).

Communities that are not supported for an AWS Direct Connect public connection are removed.

Local Preference BGP CommunitiesYou can use local preference BGP community tags to achieve load balancing and route preference forincoming traffic to your network. For each prefix that you advertise over a BGP session, you can apply acommunity tag to indicate the priority of the associated path for returning traffic. Local preference BGPcommunity tags are supported for private virtual interfaces.

The following local preference BGP community tags are supported:

• 7224:7100—Low preference• 7224:7200—Medium preference• 7224:7300—High preference

Local preference BGP community tags are mutually exclusive. To load balance traffic across multiple AWSDirect Connect connections, apply the same community tag across the prefixes for the connections. Tosupport failover across multiple AWS Direct Connect connections, apply a community tag with a higherpreference to the prefixes for the primary or active virtual interface.

Local preference BGP community tags are evaluated before any AS_PATH attribute, and are evaluated inorder from lowest to highest preference (where highest preference is preferred).

6

AWS Direct Connect User GuidePrerequisites

Getting Started with AWS DirectConnect

AWS Direct Connect enables you to directly interface your on-premises network with a device at an AWSDirect Connect location. The following procedures demonstrate the common scenarios to get set up withan AWS Direct Connect connection. You can also refer to the article How do I provision an AWS DirectConnect connection? in the Knowledge Center.

You can set up an AWS Direct Connect connection in one of the following ways.

Port speed Method

1 Gbps or higher Connect directly to an AWS device from yourrouter at an AWS Direct Connect location.

1 Gbps or higher Work with a partner in the AWS Partner Network(APN) or a network provider that will help youconnect a router from your data center, office, orcolocation environment to an AWS Direct Connectlocation. The network provider does not have tobe a member of the APN to connect you.

Sub-1 Gbps Work with a partner in the AWS Partner Network(APN) who will create a hosted connection for you.Sign up for AWS, and then follow the instructionsto accept your hosted connection (p. 9).

Contents

• Prerequisites (p. 7)

• Step 1: Sign Up for AWS (p. 8)

• Step 2: Request an AWS Direct Connect Connection (p. 8)

• Step 3: Download the LOA-CFA (p. 10)

• Step 4: Create a Virtual Interface (p. 11)

• Step 5: Download the Router Configuration (p. 14)

• Step 6: Verify Your Virtual Interface (p. 15)

• (Optional) Configure Redundant Connections (p. 15)

PrerequisitesFor connections to AWS Direct Connect with port speeds of 1 Gbps or higher, ensure that your networkmeets the following requirements.

• Your network must use single mode fiber with a 1000BASE-LX (1310nm) transceiver for 1 gigabitEthernet, or a 10GBASE-LR (1310nm) transceiver for 10 gigabit Ethernet.

7

https://aws.amazon.com/premiumsupport/knowledge-center/provision-direct-connection/

https://aws.amazon.com/premiumsupport/knowledge-center/provision-direct-connection/

https://aws.amazon.com/directconnect/partners


AWS Direct Connect User GuideStep 1: Sign Up for AWS

• Auto-negotiation for the port must be disabled. Port speed and full-duplex mode must be configuredmanually.

• 802.1Q VLAN encapsulation must be supported across the entire connection, including intermediatedevices.

• Your device must support Border Gateway Protocol (BGP) and BGP MD5 authentication.

• (Optional) You can configure Bidirectional Forwarding Detection (BFD) on your network. AsynchronousBFD is automatically enabled for AWS Direct Connect virtual interfaces, but will not take effect untilyou configure it on your router.

Step 1: Sign Up for AWSTo use AWS Direct Connect, you need an AWS account if you don't already have one.

To sign up for an AWS account

1. Open https://aws.amazon.com/, and then choose Create an AWS Account.

NoteThis might be unavailable in your browser if you previously signed into the AWSManagement Console. In that case, choose Sign in to a different account, and then chooseCreate a new AWS account.

2. Follow the online instructions.

Part of the sign-up procedure involves receiving a phone call and entering a PIN using the phonekeypad.

Step 2: Request an AWS Direct ConnectConnection

For connections of 1 Gbps or higher, you can submit a connection request using the AWS Direct Connectconsole. Ensure that you have the following information:

• The port speed that you require: 1 Gbps or 10 Gbps. You cannot change the port speed after you'vecreated the connection request.

• The AWS Direct Connect location at which the connection will be terminated.

If you require a port speed less than 1 Gbps, you cannot request a connection using the console. Instead,contact an APN partner, who will create a hosted connection for you, which you then accept. Skip thefollowing procedure and go to (Sub-1 Gbps Only) Accept Your Hosted Connection (p. 9).

To create a new AWS Direct Connect connection

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.

2. In the navigation bar, select the region in which to connect to AWS Direct Connect. For moreinformation, see AWS Regions and Endpoints.

3. On the Welcome to AWS Direct Connect screen, choose Get Started with Direct Connect.

4. In the Create a Connection dialog box, do the following:

8

https://aws.amazon.com/

https://console.aws.amazon.com/directconnect/

http://docs.aws.amazon.com/general/latest/gr/rande.html

AWS Direct Connect User Guide(Sub-1 Gbps Only) Accept Your Hosted Connection

a. For Connection Name, enter a name for the connection.

b. For LAG Association, specify whether the connection is standalone, or if it should be associatedwith a link aggregation group (LAG) in your account. This option is only available if you have aLAG in your account. To associate the connection with a LAG, select the LAG ID. The connection iscreated with the same port speed and location as specified in the LAG. For more information, seeLink Aggregation Groups (p. 43).

c. For Location, select the appropriate AWS Direct Connect location.

d. If applicable, for Sub Location, choose the floor closest to you or your network provider. Thisoption is only available if the location has meet-me rooms (MMRs) in multiple floors of thebuilding.

e. Select the appropriate port speed, and then choose Create.

Your connection is listed on the Connections pane of the AWS Direct Connect console.

It can take up to 72 hours for AWS to review your request and provision a port for your connection.During this time, you may receive an email with a request for more information about your use case orthe specified location. The email is sent to the email address that you used when you signed up for AWS.You must respond within 7 days or the connection is deleted.

For more information about creating and working with AWS Direct Connect connections, seeConnections (p. 17).

(Sub-1 Gbps Only) Accept Your Hosted ConnectionIf you requested a sub-1G connection from your selected partner, they create a hosted connection foryou (you cannot create it yourself). You must accept it in the AWS Direct Connect console before you cancreate a virtual interface.

To accept a hosted connection


2. If necessary, select the region in which the hosted connection resides. For more information, seeAWS Regions and Endpoints.

3. In the navigation pane, choose Connections.

4. In the Connections pane, select the hosted connection.

9



AWS Direct Connect User GuideStep 3: Download the LOA-CFA

5. Select I understand that Direct Connect port charges apply once I click Accept Connection, andthen choose Accept Connection.

6. Go to Step 4 (p. 11) to continue setting up your AWS Direct Connect connection.

Step 3: Download the LOA-CFAAfter you request a connection, AWS makes a Letter of Authorization and Connecting Facility Assignment(LOA-CFA) available to you to download, or emails you with a request for more information. The LOA-CFA is the authorization to connect to AWS, and is required by the colocation provider or your networkprovider to establish the cross-network connection (cross-connect).

To download the LOA-CFA

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Connections and select your connection.3. Choose Actions, Download LOA-CFA.

NoteIf the link is not enabled, the LOA-CFA is not yet available for you to download. Check youremail for a request for more information. If it's still unavailable, or you haven't received anemail after 72 hours, contact AWS Support.

4. Optionally enter the name of your provider to have it to appear with your company name as therequester in the LOA-CFA. Choose Download. The LOA-CFA is downloaded to your computer as aPDF file.

5. After you've downloaded the LOA-CFA, do one of the following:

• If you're working with an APN member or network provider, send them the LOA-CFA so that theycan order a cross-connect for you at the AWS Direct Connect location. If they cannot order thecross-connect for you, you can contact the colocation provider (p. 22) directly.

• If you have equipment at the AWS Direct Connect location, contact the colocation provider torequest a cross-network connection. You must be a customer of the colocation provider, and youmust present them with the LOA-CFA that authorizes the connection to the AWS router, as well asthe necessary information to connect to your network.

10


https://aws.amazon.com/support/createCase

AWS Direct Connect User GuideStep 4: Create a Virtual Interface

AWS Direct Connect locations that are listed as multiple sites (for example, Equinix DC1-DC6 & DC10-DC11) are set up as a campus. If your or your network provider’s equipment is located in any of thesesites, you will be able to request a cross connect to your assigned port even if it resides in a differentbuilding on the campus.

ImportantA campus is treated as a single AWS Direct Connect location. To achieve high availability,configure connections to different AWS Direct Connect locations.

If you or your network partner experience issues establishing a physical connection, see TroubleshootingLayer 1 (Physical) Issues (p. 71).

Step 4: Create a Virtual InterfaceTo begin using your AWS Direct Connect connection, you must create a virtual interface. You can create aprivate virtual interface to connect to your VPC, or you can create a public virtual interface to connect topublic AWS services that aren't in a VPC. When you create a private virtual interface to a VPC, you needa private virtual interface for each VPC to which to connect. For example, you need three private virtualinterfaces to connect to three VPCs.

Before you begin, ensure that you have the following information:

• Connection: The AWS Direct Connect connection or link aggregation group (LAG) for which you arecreating the virtual interface.

• Virtual interface name: A name for the virtual interface.• Virtual interface owner: If you're creating the virtual interface for another account, you need the AWS

account ID of the other account.• (Private virtual interface only) Connection to: For connecting to a VPC in the same region, you need

the virtual private gateway for your VPC. The ASN for the Amazon side of the BGP session is inheritedfrom the virtual private gateway. When you create a virtual private gateway, you can specify your ownprivate ASN. Otherwise, Amazon provides a default ASN. For more information, see Create a VirtualPrivate Gateway in the Amazon VPC User Guide. For connecting to a VPC through a Direct Connectgateway, you need the Direct Connect gateway. For more information, see Direct Connect Gateways.

• VLAN: A unique virtual local area network (VLAN) tag that's not already in use on your connection. Thevalue must be between 1 and 4094 and must comply with the Ethernet 802.1Q standard. This tag isrequired for any traffic traversing the AWS Direct Connect connection.

• Address family: Whether the BGP peering session will be over IPv4 or IPv6.• Peer IP addresses: A virtual interface can support a BGP peering session for IPv4, IPv6, or one of each

(dual-stack). You cannot create multiple BGP sessions for the same IP addressing family on the samevirtual interface. The IP address ranges are assigned to each end of the virtual interface for the BGPpeering session.• IPv4:

• (Public virtual interface only) You must specify unique public IPv4 addresses (/30) that you own.• (Private virtual interface only) Amazon can generate private IPv4 addresses for you. If you specify

your own, ensure that you specify private CIDRs for your router interface and the AWS DirectConnect interface only (for example, do not specify other IP addresses from your local network).

• IPv6: Amazon automatically allocates you a /125 IPv6 CIDR. You cannot specify your own peer IPv6addresses.

• BGP information:• A public or private Border Gateway Protocol (BGP) Autonomous System Number (ASN) for your side

of the BGP session. If you are using a public ASN, you must own it. If you are using a private ASN, itmust be in the 64512 to 65535 range. Autonomous System (AS) prepending does not work if youuse a private ASN for a public virtual interface.

11

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/SetUpVPNConnections.html#vpn-create-vpg


http://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways.html


• An MD5 BGP authentication key. You can provide your own, or you can let Amazon generate one foryou.

• (Public virtual interface only) Prefixes you want to advertise: Public IPv4 routes or IPv6 routes toadvertise over BGP. You must advertise at least one prefix using BGP, up to a maximum of 1,000prefixes.

• IPv4: The IPv4 CIDR must not overlap with another public IPv4 CIDR announced via AWS DirectConnect. If you do not own public IPv4 addresses, your network provider might be able to provideyou with a public IPv4 CIDR. If not, contact AWS Support to request a /31 public IPv4 CIDR (andprovide a use case in your request).

• IPv6: Specify a prefix length of /64 or shorter.

To provision a public virtual interface to non-VPC services


2. In the navigation pane, choose Connections, select the connection to use, and then choose Actions,Create Virtual Interface.

3. In the Create a Virtual Interface pane, choose Public.

4. In the Define Your New Public Virtual Interface dialog box, do the following and choose Continue:

a. For Connection, select an existing physical connection on which to create the virtual interface.

b. For Virtual Interface Name, enter a name for the virtual interface.

c. For Virtual Interface Owner, select the My AWS Account option if the virtual interface is for yourAWS account.

d. For VLAN, enter the ID number for your virtual local area network (VLAN).

e. If you're configuring an IPv4 BGP peer, choose IPv4, and do the following:

• For Your router peer IP, enter the IPv4 CIDR destination address to which Amazon should sendtraffic.

• For Amazon router peer IP, enter the IPv4 CIDR address to use to send traffic to Amazon.

12




f. If you're configuring an IPv6 BGP peer, choose IPv6. The peer IPv6 addresses are automaticallyassigned from Amazon's pool of IPv6 addresses. You cannot specify custom IPv6 addresses.

g. For BGP ASN, enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) ofyour gateway.

h. To have AWS generate a BGP key, select the Auto-generate BGP key check box.

To provide your own BGP key, clear the Auto-generate BGP key check box. For BGPAuthentication Key, enter your BGP MD5 key.

i. For Prefixes you want to advertise, enter the IPv4 CIDR destination addresses (separated bycommas) to which traffic should be routed over the virtual interface.

5. Download your router configuration. For more information, see Step 5: Download the RouterConfiguration (p. 14).

NoteAWS requests additional information from you if your public prefixes or ASNs belong to an ISPor network carrier. This can be a document using an official company letterhead or an emailfrom the company's domain name verifying that the network prefix/ASN may be used by you.

When you create a public virtual interface, it can take up to 72 hours for AWS to review and approve yourrequest.

To provision a private virtual interface to a VPC

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Connections, select the connection to use, and choose Actions,

Create Virtual Interface.3. In the Create a Virtual Interface pane, select Private.

4. Under Define Your New Private Virtual Interface, do the following and choose Continue:

a. For Virtual Interface Name, enter a name for the virtual interface.

13


AWS Direct Connect User GuideStep 5: Download the Router Configuration

b. For Virtual Interface Owner, select the My AWS Account option if the virtual interface is for yourAWS account.

c. For Connection To, choose Virtual Private Gateway and select the virtual private gateway towhich to connect.

d. For VLAN, enter the ID number for your virtual local area network (VLAN).e. If you're configuring an IPv4 BGP peer, choose IPv4, and do the following:

• To have AWS generate your router IP address and Amazon IP address, select Auto-generatepeer IPs.

• To specify these IP addresses yourself, clear the Auto-generate peer IPs check box. For Yourrouter peer IP, enter the destination IPv4 CIDR address to which Amazon should send traffic.For Amazon router peer IP, enter the IPv4 CIDR address to use to send traffic to AWS.





5. Download your router configuration. For more information, see Step 5: Download the RouterConfiguration (p. 14).

NoteIf you use the VPC wizard to create a VPC, route propagation is automatically enabled for you.With route propagation, routes are automatically populated to the route tables in your VPC.If you choose, you can disable route propagation. For more information, see Enable RoutePropagation in Your Route Table in the Amazon VPC User Guide.

Step 5: Download the Router ConfigurationAfter you have created a virtual interface for your AWS Direct Connect connection, you can download therouter configuration file. The file contains the necessary commands to configure your router for use withyour private or public virtual interface.

To download a router configuration

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the Virtual Interfaces pane, select the virtual interface and then choose Actions, Download

Router Configuration.3. In the Download Router Configuration dialog box, do the following:

a. For Vendor, select the manufacturer of your router.b. For Platform, select the model of your router.c. For Software, select the software version for your router.

4. Choose Download, and then use the appropriate configuration for your router to ensure that youcan connect to AWS Direct Connect.

For example configuration files, see Example Router Configuration Files.

After you configure your router, the status of the virtual interface goes to UP. If the virtual interfaceremains down and you cannot ping the AWS Direct Connect device's peer IP address, see Troubleshooting

14

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/SetUpVPNConnections.html#vpn-configure-routing



http://docs.aws.amazon.com/directconnect/latest/UserGuide/create-vif.html#vif-example-router-files

AWS Direct Connect User GuideStep 6: Verify Your Virtual Interface

Layer 2 (Data Link) Issues (p. 72). If you can ping the peer IP address, see Troubleshooting Layer 3/4(Network/Transport) Issues (p. 74). If the BGP peering session is established but you cannot routetraffic, see Troubleshooting Routing Issues (p. 76).

Step 6: Verify Your Virtual InterfaceAfter you have established virtual interfaces to the AWS Cloud or to Amazon VPC, you can verify yourAWS Direct Connect connection using the following procedures.

To verify your virtual interface connection to the AWS Cloud

• Run traceroute and verify that the AWS Direct Connect identifier is in the network trace.

To verify your virtual interface connection to Amazon VPC

1. Using a pingable AMI, such as an Amazon Linux AMI, launch an EC2 instance into the VPC that isattached to your virtual private gateway. The Amazon Linux AMIs are available in the Quick Starttab when you use the instance launch wizard in the Amazon EC2 console. For more information,see Launch an Instance in the Amazon EC2 User Guide for Linux Instances. Ensure that the securitygroup that's associated with the instance includes a rule permitting inbound ICMP traffic (for theping request).

2. After the instance is running, get its private IPv4 address (for example, 10.0.0.4). The Amazon EC2console displays the address as part of the instance details.

3. Ping the private IPv4 address and get a response.

(Optional) Configure Redundant ConnectionsTo provide for failover, we recommend that you request and configure two dedicated connections toAWS, as shown in the following figure. These connections can terminate on one or two routers in yournetwork.

There are different configuration choices available when you provision two dedicated connections:

15

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-instance_linux.html

AWS Direct Connect User Guide(Optional) Configure Redundant Connections

• Active/Active (BGP multipath). This is the default configuration, where both connections are active.AWS Direct Connect supports multipathing to multiple virtual interfaces within the same location, andtraffic is load-shared between interfaces based on flow. If one connection becomes unavailable, alltraffic is routed through the other connection.

• Active/Passive (failover). One connection is handling traffic, and the other is on standby. If the activeconnection becomes unavailable, all traffic is routed through the passive connection. You need toprepend the AS path to the routes on one of your links for that to be the passive link.

How you configure the connections doesn't affect redundancy, but it does affect the policies thatdetermine how your data is routed over both connections. We recommend that you configure bothconnections as active.

If you use a VPN connection for redundancy, ensure that you implement a health check and failovermechanism, and check your route table routing.

To achieve high availability, we strongly recommend that you configure connections to different AWSDirect Connect locations. For more information about high availability options, see Multiple Data CenterHA Network Connectivity.

16


https://aws.amazon.com/answers/networking/aws-multiple-data-center-ha-network-connectivity/

https://aws.amazon.com/answers/networking/aws-multiple-data-center-ha-network-connectivity/

AWS Direct Connect User GuideCreating a Connection

ConnectionsTo create an AWS Direct Connect connection, you need the following information:

• AWS Direct Connect location

Work with a partner in the AWS Partner Network (APN) to help you establish network circuits betweenan AWS Direct Connect location and your data center, office, or colocation environment, or to providecolocation space within the same facility as the AWS Direct Connect location. For the list of AWS DirectConnect partners who belong to the APN, see APN Partners Supporting AWS Direct Connect.

• Port speed

AWS Direct Connect supports two port speeds: 1 Gbps: 1000BASE-LX (1310nm) over single-mode fiberand 10 Gbps: 10GBASE-LR (1310nm) over single-mode fiber. You cannot change the port speed afteryou've created the connection request. If you need to change the port speed, you must create andconfigure a new connection.

For port speeds less than 1 Gbps, you cannot request a connection using the console. Instead, you cancontact an APN partner who supports AWS Direct Connect and who can provision a hosted connectionfor you.

After you've requested the connection, AWS makes a Letter of Authorization and Connecting FacilityAssignment (LOA-CFA) available to you to download, or emails you with a request for more information.If you receive a request for more information, you must respond within 7 days or the connection isdeleted. The LOA-CFA is the authorization to connect to AWS, and is required by your network providerto order a cross connect for you. You cannot order a cross connect for yourself in the AWS Direct Connectlocation if you do not have equipment there; your network provider does this for you.

For information about associating a connection with a link aggregation group (LAG), see Associating aConnection with a LAG (p. 46).

After you've created a connection, create a virtual interface to connect to public and private AWSresources. For more information, see Virtual Interfaces (p. 29).

Topics• Creating a Connection (p. 17)• Viewing Connection Details (p. 19)• Deleting a Connection (p. 19)• Accepting a Hosted Connection (p. 20)

Creating a ConnectionYou can create a standalone connection, or you can create a connection to associate with a LAG in youraccount. If you associate a connection with a LAG, it's created with the same port speed and location asspecified in the LAG.

If you do not have equipment at an AWS Direct Connect location, first contact an AWS partner at theAWS Partner Network (APN). For more information, see APN Partners Supporting AWS Direct Connect.

To create a new connection


17




AWS Direct Connect User GuideDownloading the LOA-CFA

2. In the navigation bar, select the region in which to connect to AWS Direct Connect. For moreinformation, see AWS Regions and Endpoints.

3. In the navigation pane, choose Connections, Create Connection.

4. In the Create a Connection dialog box, enter the following values, and then choose Create:

a. For Connection Name, enter a name for the connection.

b. For LAG Association, specify whether the connection is standalone, or if it should be associatedwith a LAG. If you associate the connection with a LAG, select the LAG ID.

c. For Location, select the appropriate AWS Direct Connect location.

d. If applicable, for Sub Location, choose the floor closest to you or your network provider. Thisoption is only available if the location has meet-me rooms (MMRs) in multiple floors of thebuilding.

e. Select the appropriate port speed that is compatible with your existing network.

To create a connection using the command line or API

• create-connection (AWS CLI)

• CreateConnection (AWS Direct Connect API)

Downloading the LOA-CFAAfter AWS has processed your connection request, you can download the Letter of Authorization andConnecting Facility Assignment (LOA-CFA).

To download the LOA-CFA



3. Choose Actions, Download LOA-CFA.

NoteIf the link is not enabled, the LOA-CFA is not yet available for you to download. Check youremail for a request for more information. If it's still unavailable, or you haven't received anemail after 72 hours, contact AWS Support.

4. In the dialog box, optionally enter the name of your provider to have it appear with your companyname as the requester in the LOA-CFA. Choose Download. The LOA-CFA is downloaded to yourcomputer as a PDF file.

5. Send the LOA-CFA to your network provider or colocation provider so that they can order a crossconnect for you. The contact process can vary for each colocation provider. For more information,see Requesting Cross Connects at AWS Direct Connect Locations (p. 22).

18


http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-connection.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateConnection.html



AWS Direct Connect User GuideViewing Connection Details

The LOA-CFA expires after 90 days. If your connection is not up after 90 days, we send you an emailalerting you that the LOA-CFA has expired. To refresh the LOA-CFA with a new issue date, download itagain from the AWS Direct Connect console. If you do not take any action, we delete the connection.

NotePort-hour billing starts 90 days after you created the connection, or after the connectionbetween your router and the AWS Direct Connect endpoint is established, whichever comesfirst. For more information, see AWS Direct Connect Pricing. If you no longer want theconnection after you've reissued the LOA-CFA, you must delete the connection yourself. Formore information, see Deleting a Connection (p. 19).

To download the LOA-CFA using the command line or API

• describe-loa (AWS CLI)• DescribeLoa (AWS Direct Connect API)

Viewing Connection DetailsYou can view the current status of your connection. You can also view your connection ID (for example,dxcon-12nikabc) and verify that it matches the connection ID on the Letter of Authorization andConnecting Facility Assignment (LOA-CFA) that you received or downloaded.

To view details about a connection

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. If necessary, change the region in the navigation bar. For more information, see Regions and

Endpoints.3. In the navigation pane, choose Connections.4. In the Connections pane, select a connection to view its details.

The service provider associated with the connection is listed in the Provided By column.

To describe a connection using the command line or API

• describe-connections (AWS CLI)• DescribeConnections (AWS Direct Connect API)

Deleting a ConnectionYou can delete a connection as long as there are no virtual interfaces attached to it. Deleting yourconnection stops all port hour charges for this connection. AWS Direct Connect data transfer charges areassociated with virtual interfaces. Any cross connect or network circuit charges are independent of AWSDirect Connect and must be cancelled separately. For more information about how to delete a virtualinterface, see Deleting a Virtual Interface (p. 36).

If the connection is part of a link aggregation group (LAG), you cannot delete the connection if doing sowill cause the LAG to fall below its setting for minimum number of operational connections.

To delete a connection


Endpoints.

19

https://aws.amazon.com/directconnect/pricing/

http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-loa.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLoa.html




http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-connections.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnections.html




AWS Direct Connect User GuideAccepting a Hosted Connection

3. In the navigation pane, choose Connections.4. In the Connections pane, select the connection to delete, and then choose Actions, Delete

Connection.5. In the Delete Connection dialog box, choose Delete.

To delete a connection using the command line or API

• delete-connection (AWS CLI)• DeleteConnection (AWS Direct Connect API)

Accepting a Hosted ConnectionIf you are interested in purchasing a hosted connection, you must contact a partner in the AWS PartnerNetwork (APN). The partner provisions the connection for you. After the connection is configured, itappears in the Connections pane in the AWS Direct Connect console.

Before you can begin using a hosted connection, you must accept the connection.

To accept a hosted connection


Endpoints.3. In the navigation pane, choose Connections.4. In the Connections pane, select a connection.

5. Select I understand that Direct Connect port charges apply once I click Accept Connection, andthen choose Accept Connection.

To accept a hosted connection using the command line or API

• confirm-connection (AWS CLI)

20

http://docs.aws.amazon.com/cli/latest/reference/directconnect/delete-connection.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteConnection.html




http://docs.aws.amazon.com/cli/latest/reference/directconnect/confirm-connection.html

AWS Direct Connect User GuideAccepting a Hosted Connection

• ConfirmConnection (AWS Direct Connect API)

21

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmConnection.html


Requesting Cross Connects at AWSDirect Connect Locations

After you have downloaded your Letter of Authorization and Connecting Facility Assignment (LOA-CFA),you need to complete your cross-network connection, also known as a cross connect. If you already haveequipment located in an AWS Direct Connect location, contact the appropriate provider to complete thecross connect. For specific instructions for each provider, see the table below. Contact your provider forcross connect pricing. After the cross connect is established, you can create the virtual interfaces usingthe AWS Direct Connect console.

Some locations are set up as a campus. For more information, see AWS Direct Connect Locations.

If you do not already have equipment located in an AWS Direct Connect location, you can work withone of the partners in the AWS Partner Network (APN) to help you to connect to an AWS Direct Connectlocation. For a list of partners in the APN with experience connecting to AWS Direct Connect, see APNPartners supporting AWS Direct Connect. You need to share the LOA-CFA with your selected provider tofacilitate your cross connect request.

An AWS Direct Connect connection can provide access to resources in other regions. For moreinformation, see Accessing a Remote AWS Region (p. 4).

NoteIf the cross connect is not completed within 90 days, the authority granted by the LOA-CFAexpires. To renew a LOA-CFA that has expired, you can download it again from the AWS DirectConnect console. For more information, see Downloading the LOA-CFA (p. 18).

• Asia Pacific (Tokyo) (p. 22)• Asia Pacific (Seoul) (p. 23)• Asia Pacific (Singapore) (p. 23)• Asia Pacific (Sydney) (p. 23)• Asia Pacific (Mumbai) (p. 24)• Canada (Central) (p. 24)• China (Beijing) (p. 24)• EU (Frankfurt) (p. 24)• EU (Ireland) (p. 25)• EU (London) (p. 26)• EU (Paris) (p. 26)• South America (São Paulo) (p. 26)• US East (N. Virginia) (p. 27)• US East (Ohio) (p. 27)• AWS GovCloud (US) (p. 28)• US West (N. California) (p. 28)• US West (Oregon) (p. 28)

Asia Pacific (Tokyo)

Location How to request a connection

AT Tokyo Chuo Data Center,Tokyo

Requests for cross connects can be submitted by contacting JunkoIkenishi at [email protected].

22

https://aws.amazon.com/directconnect/details/#AWS_Direct_Connect_Locations

http://aws.amazon.com/directconnect/partners/

http://aws.amazon.com/directconnect/partners/

mailto:[email protected]



Chief Telecom LY, Taipei Requests for cross connects can be submitted by contacting ChiefTelecom at [email protected].

Equinix OS1, Osaka Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix TY2, Tokyo Requests for cross connects can be submitted by contacting Equinixat [email protected].

Asia Pacific (Seoul)


KINX Gasan Data Center, Seoul Requests for cross connects can be submitted by contacting KINX [email protected].

LG U+ Pyeong-Chon MegaCenter, Seoul

Requests for cross connects can be made by submitting the LOAdocument to [email protected] and [email protected].

Asia Pacific (Singapore)


Equinix SG2, Singapore Requests for cross connects can be submitted by contacting Equinixat [email protected].

Global Switch, Singapore Requests for cross connects can be submitted by contacting GlobalSwitch at [email protected].

GPX Mumbai Requests for cross connects can be submitted by contacting GPX [email protected].

iAdvantage MEGA-i, Hong Kong Requests for cross connects can be submitted by contactingiAdvantage at [email protected] or by placing an order atiAdvantage Cabling Order e-Form.

Menara AIMS, Kuala Lumpur Existing AIMS customers can request a X-Connect order via theCustomer Service portal by filling out the Engineering Work OrderRequest Form and contacting [email protected] ifthere are any problems submitting the request.

Asia Pacific (Sydney)


Equinix SY3, Sydney Requests for cross connects can be submitted by contacting Equinixat [email protected].

Global Switch SY6, Sydney Requests for cross connects can be submitted by contacting GlobalSwitch at [email protected].

NEXTDC C1, Canberra Requests for cross connects can be submitted by contactingNEXTDC at [email protected].

23











https://cable.iadvantage.net







NEXTDC M1, Melbourne Requests for cross connects can be submitted by contactingNEXTDC at [email protected].

NEXTDC P1, Perth Requests for cross connects can be submitted by contactingNEXTDC at [email protected].

Asia Pacific (Mumbai)


GPX Mumbai Requests for cross connects can be submitted by contacting GPX [email protected].

NetMagic DC2, Bangalore Requests for cross connects can be submitted by contactingNetMagic Sales and Marketing toll-free at 18001033130 or [email protected].

Sify Rabale, Mumbai Requests for cross connects can be submitted by contacting Sify [email protected].

STT GDC Pvt. Ltd. VSB, Chennai Requests for cross connects can be submitted by contacting STT [email protected]

Canada (Central)


Allied 250 Front St W, Toronto Requests for cross connects can be submitted by [email protected].

Cologix MTL3, Montreal Requests for cross connects can be submitted by contacting Cologixat [email protected].

Cologix VAN2, Vancouver Requests for cross connects can be submitted by contacting Cologixat [email protected].

eStruxture, Montreal Requests for cross connects can be submitted by contactingeStruxture at [email protected].

China (Beijing)


Sinnet Jiuxianqiao IDC Requests for cross connects can be submitted by contacting Sinnetat [email protected].

EU (Frankfurt)


CE Colo, Prague Requests for cross connects can be submitted by contacting CE Coloat [email protected].

24















Equinix AM3, Amsterdam Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix FR5, Frankfurt Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix HE6, Helsinki Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix ITConic MD2, Madrid Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix MU1, Munich Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix WA1, Warsaw Requests for cross connects can be submitted by contacting Equinixat [email protected].

IPB, Berlin Requests for cross connects can be submitted by contacting IPB [email protected].

Interxion FRA6, Frankfurt Requests for cross connects can be submitted by contactingInterxion at [email protected].

Interxion MAD2, Madrid Requests for cross connects can be submitted by contactingInterxion at [email protected].

Interxion MRS1, Marseille Requests for cross connects can be submitted by contactingInterxion at [email protected].

Interxion STO1, Stockholm Requests for cross connects can be submitted by contactingInterxion at [email protected].

Interxion VIE2, Vienna Requests for cross connects can be submitted by contactingInterxion at [email protected].

Interxion ZUR1, Zurich Requests for cross connects can be submitted by contactingInterxion at [email protected].

Telehouse Voltaire, Paris Requests for cross connects can be submitted by creating a requestat the Customer Portal.

Request type: DFM/SFM Layout/Connectivity/MMR CircuitCommissioning

EU (Ireland)


Digital Realty (UK), Docklands Requests for cross connects can be submitted by contacting DigitalRealty (UK) at [email protected].

Eircom Clonshaugh Requests for cross connects can be submitted by contacting Eircomat [email protected].

Equinix LD5, London (Slough) Requests for cross connects can be submitted by contacting Equinixat [email protected].

25














https://thparis.force.com/login






Interxion DUB2, Dublin Requests for cross connects can be submitted by contactingInterxion at [email protected].

Interxion MRS1, Marseille Requests for cross connects can be submitted by contactingInterxion at [email protected].

Teraco CT1, Cape Town Requests for cross connects can be submitted by contactingTeraco at [email protected] for existing Teraco customers [email protected] for new customers.

Teraco JB1, Johannesburg Requests for cross connects can be submitted by contactingTeraco at [email protected] for existing Teraco customers [email protected] for new customers.

EU (London)


Digital Realty (UK), Docklands Requests for cross connects can be submitted by contacting DigitalRealty (UK) at [email protected].

Equinix LD5, London (Slough) Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix MA3, Manchester Requests for cross connects can be submitted by contacting Equinixat [email protected].

Telehouse West, London Requests for cross-connects can be submitted by contactingTelehouse UK at [email protected].

EU (Paris)


Equinix PA3, Paris Requests for cross connects can be submitted by contacting Equinixat [email protected].

Telehouse Voltaire, Paris Requests for cross connects can be submitted by creating a requestat the Customer Portal.

Request type: DFM/SFM Layout/Connectivity/MMR CircuitCommissioning

South America (São Paulo)


Equinix RJ2, Rio de Janeiro Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix SP4, São Paulo Requests for cross connects can be submitted by contacting Equinixat [email protected].

Tivit Requests for cross connects can be submitted by contacting Tivit [email protected].

26












https://thparis.force.com/login





US East (N. Virginia)


165 Halsey Street, Newark Refer to the resources on http://www.165halsey.com/colocation-services/connectivity/ or contact [email protected].

CoreSite NY1, New York Requests for cross connects can be submitted by placing an order atthe CoreSite Customer Portal. After you complete the form, reviewthe order for accuracy, and then approve it using the MyCoreSitewebsite.

CoreSite VA1, Reston Requests for cross connects can be submitted by placing an order atthe CoreSite Customer Portal. After you complete the form, reviewthe order for accuracy, and then approve it using the MyCoreSitewebsite.

Digital Realty ATL1, Atlanta Requests for cross connects can be submitted by contacting DigitalRealty at [email protected].

Equinix DC2/DC11, Ashburn Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix DA2, Dallas Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix MI1, Miami Requests for cross connects can be submitted by contacting Equinixat [email protected].

Lightower, Philadelphia Requests for cross connects can be submitted by contactingLightower at [email protected].

Markley, One Summer Street,Boston

Requests for cross connects can be submitted on the customerportal: https://portal.markleygroup.com. For new queries, [email protected].

US East (Ohio)


Cologix COL2, Columbus Requests for cross connects can be submitted by contacting Cologixat [email protected].

Cologix MIN3, Minneapolis Requests for cross connects can be submitted by contacting Cologixat [email protected].

CyrusOne West III, Houston Requests for cross connects and requests for information can besubmitted on the customer portal: https://cyrusone.com/about-enterprise-data-center-provider/customer-support/.

Equinix CH2, Chicago Requests for cross connects can be submitted by contacting Equinixat [email protected].

QTS Chicago Requests for cross connects can be submitted by contacting QTS [email protected].

27

http://www.165halsey.com/colocation-services/connectivity/

http://www.165halsey.com/colocation-services/connectivity/


https://mycoresite.coresite.com/login







https://portal.markleygroup.com




https://cyrusone.com/about-enterprise-data-center-provider/customer-support/

https://cyrusone.com/about-enterprise-data-center-provider/customer-support/




AWS GovCloud (US)


Equinix SV5, San Jose Requests for cross connects can be submitted by contacting Equinixat [email protected].

US West (N. California)


CoreSite LA1, Los Angeles Requests for cross connects can be submitted by placing an order atthe CoreSite Customer Portal. After you complete the form, reviewthe order for accuracy, and then approve it using the MyCoreSitewebsite.

CoreSite SV4, Santa Clara Requests for cross connects can be submitted by placing an order atthe CoreSite Customer Portal. After you complete the form, reviewthe order for accuracy, and then approve it using the MyCoreSitewebsite.

Equinix LA3, El Segundo Requests for cross connects can be submitted by contacting Equinixat [email protected].

Equinix SV5, San Jose Requests for cross connects can be submitted by contacting Equinixat [email protected].

PhoenixNAP, Phoenix Requests for cross connects can be submitted by contactingphoenixNAP Provisioning at [email protected].

US West (Oregon)


CoreSite DE1, Denver Requests for cross connects can be submitted by placing an order atthe CoreSite Customer Portal. After you complete the form, reviewthe order for accuracy, and then approve it using the MyCoreSitewebsite.

EdgeConneX, Portland Requests for cross connects can be submitted by placing an orderon the EdgeOS Customer Portal. After you have submitted theform, EdgeConneX will provide a service order form for approval.You can send questions to [email protected].

Equinix SE2, Seattle Requests for cross connects can be submitted by contacting Equinixat [email protected].

Pittock Block, Portland Requests for cross connects can be submitted by email [email protected], or by phone at +1 503 226 6777.

Switch SUPERNAP 8, Las Vegas Requests for cross connects can be submitted by contacting SwitchSUPERNAP at [email protected].

TierPoint Seattle Requests for cross connects can be submitted by contactingTierPoint at [email protected].

28








https://edgeos.edgeconnex.com/portal/






AWS Direct Connect User GuidePrerequisites for Virtual Interfaces

Virtual InterfacesYou must create a virtual interface to begin using your AWS Direct Connect connection. You can createa private virtual interface to connect to your VPC, or you can create a public virtual interface to connectto AWS services that aren't in a VPC, such as Amazon S3 and Amazon Glacier. You can configure multiplevirtual interfaces on a single AWS Direct Connect connection. For private virtual interfaces, you need oneprivate virtual interface for each VPC to connect to from the AWS Direct Connect connection, or you canuse a Direct Connect gateway. For more information, see Direct Connect Gateways.

To connect to other AWS services using IPv6 addresses, check the service documentation to verify thatIPv6 addressing is supported.

We advertise appropriate Amazon prefixes to you so you can reach either your VPCs or other AWSservices. You can access all AWS prefixes through this connection; for example, Amazon EC2, AmazonS3, and Amazon.com. You do not have access to non-Amazon prefixes. For a current list of prefixesadvertised by AWS, see AWS IP Address Ranges in the Amazon Web Services General Reference.

NoteWe recommend that you use a firewall filter (based on the source/destination address ofpackets) to control traffic to and from some prefixes. If you're using a prefix filter (route map),ensure that it accepts prefixes with an exact match or longer. Prefixes advertised from AWSDirect Connect may be aggregated and may differ from the prefixes defined in your prefix filter.

To use your AWS Direct Connect connection with another AWS account, you can create a hosted virtualinterface for that account. The owner of the other account must accept the hosted virtual interface tobegin using it. A hosted virtual interface works the same as a standard virtual interface and can connectto public resources or a VPC.

A sub-1G connection only supports one virtual interface.

Contents• Prerequisites for Virtual Interfaces (p. 29)• Creating a Virtual Interface (p. 30)• Viewing Virtual Interface Details (p. 36)• Deleting a Virtual Interface (p. 36)• Creating a Hosted Virtual Interface (p. 37)• Accepting a Hosted Virtual Interface (p. 39)• Adding or Removing a BGP Peer (p. 40)• Associating a Virtual Interface with a Connection or LAG (p. 41)

Prerequisites for Virtual InterfacesTo create a virtual interface, you need the following information:

• Connection: The AWS Direct Connect connection or link aggregation group (LAG) for which you arecreating the virtual interface.

• Virtual interface name: A name for the virtual interface.• Virtual interface owner: If you're creating the virtual interface for another account, you need the AWS

account ID of the other account.• (Private virtual interface only) Connection to: For connecting to a VPC in the same region, you need

the virtual private gateway for your VPC. The ASN for the Amazon side of the BGP session is inherited

29


http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

AWS Direct Connect User GuideCreating a Virtual Interface

from the virtual private gateway. When you create a virtual private gateway, you can specify your ownprivate ASN. Otherwise, Amazon provides a default ASN. For more information, see Create a VirtualPrivate Gateway in the Amazon VPC User Guide. For connecting to a VPC through a Direct Connectgateway, you need the Direct Connect gateway. For more information, see Direct Connect Gateways.

• VLAN: A unique virtual local area network (VLAN) tag that's not already in use on your connection. Thevalue must be between 1 and 4094 and must comply with the Ethernet 802.1Q standard. This tag isrequired for any traffic traversing the AWS Direct Connect connection.

• Address family: Whether the BGP peering session will be over IPv4 or IPv6.• Peer IP addresses: A virtual interface can support a BGP peering session for IPv4, IPv6, or one of each

(dual-stack). You cannot create multiple BGP sessions for the same IP addressing family on the samevirtual interface. The IP address ranges are assigned to each end of the virtual interface for the BGPpeering session.• IPv4:

• (Public virtual interface only) You must specify unique public IPv4 addresses (/30) that you own.• (Private virtual interface only) Amazon can generate private IPv4 addresses for you. If you specify

your own, ensure that you specify private CIDRs for your router interface and the AWS DirectConnect interface only (for example, do not specify other IP addresses from your local network).

• IPv6: Amazon automatically allocates you a /125 IPv6 CIDR. You cannot specify your own peer IPv6addresses.

• BGP information:• A public or private Border Gateway Protocol (BGP) Autonomous System Number (ASN) for your side

of the BGP session. If you are using a public ASN, you must own it. If you are using a private ASN, itmust be in the 64512 to 65535 range. Autonomous System (AS) prepending does not work if youuse a private ASN for a public virtual interface.

• An MD5 BGP authentication key. You can provide your own, or you can let Amazon generate one foryou.

• (Public virtual interface only) Prefixes you want to advertise: Public IPv4 routes or IPv6 routes toadvertise over BGP. You must advertise at least one prefix using BGP, up to a maximum of 1,000prefixes.• IPv4: The IPv4 CIDR must not overlap with another public IPv4 CIDR announced via AWS Direct

Connect. If you do not own public IPv4 addresses, your network provider might be able to provideyou with a public IPv4 CIDR. If not, contact AWS Support to request a /31 public IPv4 CIDR (andprovide a use case in your request).

• IPv6: Specify a prefix length of /64 or shorter.

Creating a Virtual InterfaceYou can create a public virtual interface to connect to public resources (non-VPC services), or a privatevirtual interface to connect to your VPC.

Before you begin, ensure that you have read the information in Prerequisites for VirtualInterfaces (p. 29).

Creating a Public Virtual InterfaceTo provision a public virtual interface

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Connections, select the connection to use, and then choose Actions,

Create Virtual Interface.3. In the Create a Virtual Interface pane, choose Public.

30






AWS Direct Connect User GuideCreating a Public Virtual Interface

4. In the Define Your New Public Virtual Interface dialog box, do the following and choose Continue:

a. For Connection, select an existing physical connection on which to create the virtual interface.

b. For Virtual Interface Name, enter a name for the virtual interface.

c. For Virtual Interface Owner, select the My AWS Account option if the virtual interface is for yourAWS account.









i. For Prefixes you want to advertise, enter the IPv4 CIDR destination addresses (separated bycommas) to which traffic should be routed over the virtual interface.

5. Download the router configuration for your device. For more information, see Downloading theRouter Configuration File (p. 33).

To create a public virtual interface using the command line or API

• create-public-virtual-interface (AWS CLI)

• CreatePublicVirtualInterface (AWS Direct Connect API)

31

http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-public-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePublicVirtualInterface.html

AWS Direct Connect User GuideCreating a Private Virtual Interface

Creating a Private Virtual InterfaceYou can provision a private virtual interface to a virtual private gateway in the same region as your AWSDirect Connect connection. For more information about provisioning a private virtual interface to a directconnect gateway, see Direct Connect Gateways (p. 48).

To provision a private virtual interface to a VPC


2. In the navigation pane, choose Connections, select the connection to use, and choose Actions,Create Virtual Interface.

3. In the Create a Virtual Interface pane, select Private.




c. For Connection To, choose Virtual Private Gateway and select the virtual private gateway towhich to connect.






32


AWS Direct Connect User GuideDownloading the Router Configuration File




NoteIf you use the VPC wizard to create a VPC, route propagation is automatically enabled for you.With route propagation, routes are automatically populated to the route tables in your VPC.If you choose, you can disable route propagation. For more information, see Enable RoutePropagation in Your Route Table in the Amazon VPC User Guide.

After you've created the virtual interface, you can download the router configuration for your device. Formore information, see Downloading the Router Configuration File (p. 33).

To create a private virtual interface using the command line or API

• create-private-virtual-interface (AWS CLI)• CreatePrivateVirtualInterface (AWS Direct Connect API)

Downloading the Router Configuration FileAfter you've created the virtual interface, you can download the router configuration file for your router.

To download a router configuration

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the Virtual Interfaces pane, select the virtual interface and then choose Actions, Download

Router Configuration.3. In the Download Router Configuration dialog box, do the following:

a. For Vendor, select the manufacturer of your router.b. For Platform, select the model of your router.c. For Software, select the software version for your router.

4. Choose Download, and then use the appropriate configuration for your router to ensure that youcan connect to AWS Direct Connect.

Example Router Configuration FilesThe following are example extracts of router configuration files.

Cisco IOS

interface GigabitEthernet0/1no ip address

interface GigabitEthernet0/1.VLAN_NUMBERdescription "Direct Connect to your Amazon VPC or AWS Cloud"encapsulation dot1Q VLAN_NUMBERip address YOUR_PEER_IP

router bgp CUSTOMER_BGP_ASNneighbor AWS_PEER_IP remote-as AWS_ASN

33



http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-private-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePrivateVirtualInterface.html



neighbor AWS_PEER_IP password MD5_keynetwork 0.0.0.0 exit

! Optionally configure Bidirectional Forwarding Detection (BFD).

interface GigabitEthernet0/1.VLAN_NUMBER bfd interval 300 min_rx 300 multiplier 3 router bgp CUSTOMER_BGP_ASN neighbor AWS_PEER_IP fall-over bfd

! NAT Configuration for Public Virtual Interfaces (Optional)

ip access-list standard NAT-ACL permit anyexit

ip nat inside source list NAT-ACL interface GigabitEthernet0/1.VLAN_NUMBER overload

interface GigabitEthernet0/1.VLAN_NUMBER ip nat outsideexit

interface interface-towards-customer-local-network ip nat insideexit

Cisco NX-OS

feature interface-vlanvlan VLAN_NUMBERname "Direct Connect to your Amazon VPC or AWS Cloud"

interface VlanVLAN_NUMBER ip address YOUR_PEER_IP/30 no shutdown

interface Ethernet0/1 switchport switchport mode trunk switchport trunk allowed vlan VLAN_NUMBER no shutdown

router bgp CUSTOMER_BGP_ASN address-family ipv4 unicast network 0.0.0.0 neighbor AWS_PEER_IP remote-as AWS_ASN password 0 MD5_key address-family ipv4 unicast

! Optionally configure Bidirectional Forwarding Detection (BFD).

feature bfdinterface VlanVLAN_NUMBERbfd interval 300 min_rx 300 multiplier 3router bgp CUSTOMER_BGP_ASNneighbor AWS_PEER_IP remote-as AWS_ASNbfd

! NAT Configuration for Public Virtual Interfaces (Optional)

ip access-list standard NAT-ACL permit any anyexit

34


ip nat inside source list NAT-ACL VlanVLAN_NUMBER overload

interface VlanVLAN_NUMBER ip nat outsideexit

interface interface-towards-customer-local-network ip nat insideexit

Juniper JunOS

configure exclusiveedit interfaces ge-0/0/1set description "Direct Connect to your Amazon VPC or AWS Cloud"set flexible-vlan-taggingset mtu 1522edit unit 0set vlan-id VLAN_NUMBERset family inet mtu 1500set family inet address YOUR_PEER_IPtop

edit policy-options policy-statement EXPORT-DEFAULTedit term DEFAULTset from route-filter 0.0.0.0/0 exactset then acceptupedit term REJECTset then rejecttop

set routing-options autonomous-system CUSTOMER_BGP_ASN

edit protocols bgp group EBGPset type externalset peer-as AWS_ASN

edit neighbor AWS_PEER_IPset local-address YOUR_PEER_IPset export EXPORT-DEFAULTset authentication-key "MD5_key"topcommit checkcommit and-quit

# Optionally configure Bidirectional Forwarding Detection (BFD).

set protocols bgp group EBGP neighbor AWS_PEER_IP bfd-liveness-detection minimum-interval 300 set protocols bgp group EBGP neighbor AWS_PEER_IP bfd-liveness-detection multiplier 3

# NAT Configuration for Public Virtual Interfaces (Optional)

set security policies from-zone trust to-zone untrust policy PolicyName match source-address anyset security policies from-zone trust to-zone untrust policy PolicyName match destination-address anyset security policies from-zone trust to-zone untrust policy PolicyName match application anyset security policies from-zone trust to-zone untrust policy PolicyName then permit

set security nat source rule-set SNAT-RS from zone trustset security nat source rule-set SNAT-RS to zone untrustset security nat source rule-set SNAT-RS rule SNAT-Rule match source-address 0.0.0.0/0

35

AWS Direct Connect User GuideViewing Virtual Interface Details

set security nat source rule-set SNAT-RS rule SNAT-Rule then source-nat interface

commit checkcommit and-quit

Viewing Virtual Interface DetailsYou can view the current status of your virtual interface; the connection state, name, and location; VLANand BGP details; and peer IP addresses.

To view details about a virtual interface

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. If necessary, change the region in the navigation bar. For more information, see AWS Regions and

Endpoints.3. In the navigation pane, choose Virtual Interfaces.4. In the Virtual Interfaces pane, select a virtual interface to view its details.

To describe virtual interfaces using the command line or API

• describe-virtual-interfaces (AWS CLI)• DescribeVirtualInterfaces (AWS Direct Connect API)

Deleting a Virtual InterfaceBefore you can delete a connection, you must delete its virtual interface. The number of virtualinterfaces configured on a connection is listed in the # VIs column in the Connection pane. Deleting avirtual interface stops AWS Direct Connect data transfer charges associated with the virtual interface.

36




http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-virtual-interfaces.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeVirtualInterfaces.html

AWS Direct Connect User GuideCreating a Hosted Virtual Interface

To delete a virtual interface


2. If necessary, change the region in the navigation bar. For more information, see AWS Regions andEndpoints.

3. In the navigation pane, choose Virtual Interfaces.

4. In the Virtual Interfaces pane, select a virtual interface, and then choose Actions, Delete VirtualInterface.

5. In the Delete Virtual Interface dialog box, choose Delete.

To delete a virtual interface using the command line or API

• delete-virtual-interface (AWS CLI)

• DeleteVirtualInterface (AWS Direct Connect API)

Creating a Hosted Virtual InterfaceYou can create a public or private hosted virtual interface. Before you begin, ensure that you have readthe information in Prerequisites for Virtual Interfaces (p. 29).

To create a hosted private virtual interface




4. In the Connections pane, select the connection to which to add a virtual interface and chooseActions, Create Virtual Interface.

5. Select the Private option.

6. Under Define Your New Private Virtual Interface, do the following:


b. For Virtual Interface Owner, choose Another AWS Account. For Account ID, enter the AWSaccount ID number to associate as the owner of this virtual interface.

c. For VLAN, enter the ID number for your virtual local area network (VLAN).

d. If you're configuring an IPv4 BGP peer, choose IPv4, and do the following:



e. If you're configuring an IPv6 BGP peer, choose IPv6. The peer IPv6 addresses are automaticallyassigned from Amazon's pool of IPv6 addresses. You cannot specify custom IPv6 addresses.

f. For BGP ASN, enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) ofyour gateway.

g. Select the Auto-generate BGP key check box if you would like AWS to generate one for you.


37




http://docs.aws.amazon.com/cli/latest/reference/directconnect/delete-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteVirtualInterface.html




AWS Direct Connect User GuideCreating a Hosted Virtual Interface

7. Choose Continue. The new interface is added to the list of virtual interfaces on the VirtualInterfaces pane.

8. After the hosted virtual interface is accepted by the owner of the other AWS account, you candownload the router configuration file (p. 33).

To create a hosted public virtual interface




4. In the Connections pane, select the connection to which to add a virtual interface and chooseActions, Create Virtual Interface.

5. Select the Public option.

6. In the Define Your New Public Virtual Interface dialog box, do the following:


b. For Virtual Interface Owner, choose Another AWS Account. For Account ID, enter the AWSaccount ID number to associate as the owner of this virtual interface.

c. For VLAN, enter the ID number for your virtual local area network (VLAN).

d. If you're configuring an IPv4 BGP peer, choose IPv4, and do the following:



e. If you're configuring an IPv6 BGP peer, choose IPv6. The peer IPv6 addresses are automaticallyassigned from Amazon's pool of IPv6 addresses. You cannot specify custom IPv6 addresses.

f. For BGP ASN, enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) ofyour gateway.

g. To have AWS generate a BGP key, select the Auto-generate BGP key check box.


h. For Prefixes you want to advertise, enter the IPv4 CIDR destination addresses (separated bycommas) to which traffic should be routed over the virtual interface.

7. Choose Continue. The new interface is added to the list of virtual interfaces on the VirtualInterfaces pane.

8. After the hosted virtual interface is accepted by the owner of the other AWS account, you candownload the router configuration file (p. 33).

To create a hosted private virtual interface using the command line or API

• allocate-private-virtual-interface (AWS CLI)

• AllocatePrivateVirtualInterface (AWS Direct Connect API)

To create a hosted public virtual interface using the command line or API

• allocate-public-virtual-interface (AWS CLI)

• AllocatePublicVirtualInterface (AWS Direct Connect API)

38




http://docs.aws.amazon.com/cli/latest/reference/directconnect/allocate-private-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocatePrivateVirtualInterface.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/allocate-public-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocatePublicVirtualInterface.html

AWS Direct Connect User GuideAccepting a Hosted Virtual Interface

Accepting a Hosted Virtual InterfaceBefore you can begin using a hosted virtual interface, you must accept the virtual interface. For a privatevirtual interface, you must also have an existing virtual private gateway or Direct Connect Gateway.

To accept a hosted virtual interface



3. In the navigation pane, choose Virtual Interfaces.

4. In the Virtual Interfaces pane, select the virtual interface to view its details.

5. Select the I understand that I will be responsible for data transfer charges incurred for thisinterface check box and choose Accept Virtual Interface.

6. (Private virtual interface) In the Accept Virtual Interface dialog box, select a virtual private gatewayor Direct Connect gateway, and choose Accept.

7. After you've accepted the hosted virtual interface, the owner of the AWS Direct Connect connectioncan download the router configuration file. The Download Router Configuration option is notavailable for the account that accepts the hosted virtual interface.

To accept a hosted private virtual interface using the command line or API

• confirm-private-virtual-interface (AWS CLI)

• ConfirmPrivateVirtualInterface (AWS Direct Connect API)

39




http://docs.aws.amazon.com/cli/latest/reference/directconnect/confirm-private-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmPrivateVirtualInterface.html

AWS Direct Connect User GuideAdding or Removing a BGP Peer

To accept a hosted public virtual interface using the command line or API

• confirm-public-virtual-interface (AWS CLI)• ConfirmPublicVirtualInterface (AWS Direct Connect API)

Adding or Removing a BGP PeerA virtual interface can support a single IPv4 BGP peering session and a single IPv6 BGP peering session.You can add an IPv6 BGP peering session to a virtual interface that has an existing IPv4 BGP peeringsession. Alternately, you can add an IPv4 BGP peering session to a virtual interface that has an existingIPv6 BGP peering session.

You cannot specify your own peer IPv6 addresses for an IPv6 BGP peering session. Amazon automaticallyallocates you a /125 IPv6 CIDR.

Multiprotocol BGP is not supported. IPv4 and IPv6 operate in dual-stack mode for the virtual interface.

To add a BGP peer

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Virtual Interfaces and select the virtual interface.3. Choose Actions, Add Peering.4. (Private virtual interface) To add an IPv4 BGP peer, do the following:

• To have AWS generate your router IP address and Amazon IP address, select Auto-generate peerIPs.

• To specify these IP addresses yourself, clear the Auto-generate peer IPs check box. For Yourrouter peer IP, enter the destination IPv4 CIDR address to which Amazon should send traffic. Inthe Amazon router peer IP field, enter the IPv4 CIDR address to use to send traffic to AWS.

5. (Public virtual interface) To add an IPv4 BGP peer, do the following:

• For Your router peer IP, enter the IPv4 CIDR destination address where traffic should be sent.• For Amazon router peer IP, enter the IPv4 CIDR address to use to send traffic to AWS.

6. (Private or public virtual interface) To add an IPv6 BGP peer, the Auto-generate peer IPs is selectedby default. The peer IPv6 addresses are automatically assigned from Amazon's pool of IPv6addresses; you cannot specify custom IPv6 addresses.

40

http://docs.aws.amazon.com/cli/latest/reference/directconnect/confirm-public-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmPublicVirtualInterface.html


AWS Direct Connect User GuideAssociating a Virtual Interface

7. In the BGP ASN field, enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN)of your gateway; for example, a number between 1 and 65534. For a public virtual interface, theASN must be private or already whitelisted for the virtual interface.

8. Select the Auto-generate BGP key check box to have AWS to generate one for you.

To provide your own BGP key, clear the Auto-generate BGP key check box. For BGP AuthenticationKey, enter your BGP MD5 key.

9. Choose Continue.

If your virtual interface has both an IPv4 and IPv6 BGP peering session, you can delete one of the BGPpeering sessions (but not both).

To delete a BGP peer

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Virtual Interfaces and select the virtual interface.3. Choose Actions, Delete Peering.4. To delete the IPv4 BGP peer, choose IPv4. To delete the IPv6 BGP peer, choose IPv6.5. Choose Delete.

To create a BGP peer using the command line or API

• create-bgp-peer (AWS CLI)• CreateBGPPeer (AWS Direct Connect API)

To delete a BGP peer using the command line or API

• delete-bgp-peer (AWS CLI)• DeleteBGPPeer (AWS Direct Connect API)

Associating a Virtual Interface with a Connectionor LAG

You can associate a virtual interface with a link aggregation group (LAG), or another connection.

You cannot associate a virtual interface if the target connection or LAG has an existing associated virtualinterface with the following matching attributes:

41


http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-bgp-peer.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateBGPPeer.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/delete-bgp-peer.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteBGPPeer.html

AWS Direct Connect User GuideAssociating a Virtual Interface

• A conflicting VLAN number• (Public virtual interfaces) The same IP address range for the Amazon router, or for the customer router• (Private virtual interfaces) The same virtual private gateway and the same IP address range for the

Amazon router, or for the customer router

You cannot disassociate a virtual interface from a connection or LAG, but you can re-associate it or deleteit. For more information, see Deleting a Virtual Interface (p. 36).

ImportantConnectivity to AWS is temporarily interrupted during the association process.

To associate a virtual interface with a connection

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Virtual Interfaces, and select the virtual interface.3. Choose Actions, Associate Connection or LAG.4. Choose the required connection, select the confirmation check box, and choose Continue.

You can use the same procedure above to associate a virtual interface with a LAG. Alternatively, you canuse the LAGs screen.

To associate a virtual interface with a LAG

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose LAGs, and select the LAG.3. Choose Actions, Associate Virtual Interface.4. Choose the required virtual interface, select the confirmation check box, and choose Continue.

To associate a virtual interface using the command line or API

• associate-virtual-interface (AWS CLI)• AssociateVirtualInterface (AWS Direct Connect API)

42



http://docs.aws.amazon.com/cli/latest/reference/directconnect/associate-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateVirtualInterface.html

AWS Direct Connect User GuideCreating a LAG

Link Aggregation GroupsA link aggregation group (LAG) is a logical interface that uses the Link Aggregation Control Protocol(LACP) to aggregate multiple 1 gigabit or 10 gigabit connections at a single AWS Direct Connectendpoint, allowing you to treat them as a single, managed connection.

You can create a LAG from existing connections, or you can provision new connections. After you'vecreated the LAG, you can associate existing connections (whether standalone or part of another LAG)with the LAG.

The following rules apply:

• All connections in the LAG must use the same bandwidth. The following bandwidths are supported: 1Gbps and 10 Gbps.

• You can have a maximum of 4 connections in a LAG. Each connection in the LAG counts towards youroverall connection limit for the region.

• All connections in the LAG must terminate at the same AWS Direct Connect endpoint.

When you create a LAG, you can download the Letter of Authorization and Connecting FacilityAssignment (LOA-CFA) for each new physical connection individually from the AWS Direct Connectconsole. For more information, see Downloading the LOA-CFA (p. 18).

All LAGs have an attribute that determines the minimum number of connections in the LAG that mustbe operational for the LAG itself to be operational. By default, new LAGs have this attribute set to 0. Youcan update your LAG to specify a different value—doing so means that your entire LAG becomes non-operational if the number of operational connections falls below this threshold. This attribute can beused to prevent over-utilization of the remaining connections.

All connections in a LAG operate in Active/Active mode.

NoteWhen you create a LAG or associate more connections with the LAG, we may not be able toguarantee enough available ports on a given AWS Direct Connect endpoint.

Topics

• Creating a LAG (p. 43)

• Updating a LAG (p. 46)

• Associating a Connection with a LAG (p. 46)

• Disassociating a Connection From a LAG (p. 47)

• Deleting a LAG (p. 47)

Creating a LAGYou can create a LAG by provisioning new connections, or aggregating existing connections.

You cannot create a LAG with new connections if this results in you exceeding the overall connectionslimit for the region.

43


To create a LAG with new connections


2. In the navigation pane, choose LAGs, Create LAG.

3. Choose Request new Connections, and provide the following information.

• Location: Select the location for the LAG.

• LAG Name: Specify a name for the LAG.

• Connection Bandwidth: Select the port speed for the connections.

• Number of new Connections: Specify the number of connections that must be provisioned in theLAG.

4. Choose Create.

To create a LAG from existing connections, the connections must be on the same AWS device (terminateat the same AWS Direct Connect endpoint), and they must use the same bandwidth. You cannot migratea connection from an existing LAG if removing the connection causes the original LAG to fall below itssetting for minimum number of operational connections.

ImportantFor existing connections, connectivity to AWS is interrupted during the creation of the LAG.

To create a LAG from existing connections


2. In the navigation pane, choose LAGs, Create LAG.

3. Choose Use existing Connections, and select the required connections.

4. For LAG Name, specify a name for the LAG. For Set Minimum Links, specify the minimum numberof connections that must be operational for the LAG itself to be operational. If you do not specify avalue, we assign a default value of 0.

44




5. Select the confirmation check box and choose Create.

After you've created a LAG, you can view its details in the AWS Direct Connect console.

To view information about your LAG

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose LAGs, and select the LAG.3. You can view information about the LAG, including its ID, the AWS Direct Connect endpoint on which

the connections terminate (AWS Device), and the number of connections in the LAG (Port Count).

After you've created a LAG, you can associate or disassociate connections from it. For more information,see Associating a Connection with a LAG (p. 46) and Disassociating a Connection From aLAG (p. 47).

To create a LAG using the command line or API

• create-lag (AWS CLI)• CreateLag (AWS Direct Connect API)

To describe your LAGs using the command line or API

• describe-lags (AWS CLI)

45


http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-lag.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateLag.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-lags.html

AWS Direct Connect User GuideUpdating a LAG

• DescribeLags (AWS Direct Connect API)

To download the LOA-CFA using the command line or API

• describe-loa (AWS CLI)• DescribeLoa (AWS Direct Connect API)

Updating a LAGYou can update a LAG to change its name, or to change the value for the minimum number ofoperational connections.

NoteIf you adjust the threshold value for the minimum number if operational connections, ensurethat the new value does not cause the LAG to fall below the threshold and become non-operational.

To update a LAG

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose LAGs, and select the LAG.3. Choose Actions, Update LAG.4. For LAG Name, specify a new name for the LAG. For Minimum Links, adjust the value for the

minimum number of operational connections.5. Choose Continue.

To update a LAG using the command line or API

• update-lag (AWS CLI)• UpdateLag (AWS Direct Connect API)

Associating a Connection with a LAGYou can associate an existing connection with a LAG. The connection can be standalone, or it can be partof another LAG. The connection must be on the same AWS device and must use the same bandwidth asthe LAG. If the connection is already associated with another LAG, you cannot re-associate it if removingthe connection causes the original LAG to fall below its threshold for minimum number of operationalconnections.

Associating a connection to a LAG automatically re-associates its virtual interfaces to the LAG.

ImportantConnectivity to AWS over the connection is interrupted during association.

To associate a connection with a LAG

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose LAGs, and select the LAG.3. Choose Actions, Associate Connection.4. Select the connection from the list of available connections.5. Select the confirmation check box and choose Continue.

46

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLags.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-loa.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLoa.html


http://docs.aws.amazon.com/cli/latest/reference/directconnect/update-lag.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateLag.html


AWS Direct Connect User GuideDisassociating a Connection From a LAG

To associate a connection using the command line or API

• associate-connection-with-lag (AWS CLI)• AssociateConnectionWithLag (AWS Direct Connect API)

Disassociating a Connection From a LAGYou can disassociate a connection from a LAG to convert it to a standalone connection. You cannotdisassociate a connection if this will cause the LAG to fall below its threshold for minimum number ofoperational connections.

Disassociating a connection from a LAG does not automatically disassociate any virtual interfaces.You must associate the virtual interface with the connection separately. For more information, seeAssociating a Virtual Interface with a Connection or LAG (p. 41).

ImportantConnectivity to AWS over the connection is interrupted during disassociation.

To disassociate a connection from a LAG

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose LAGs, and select the LAG.3. Choose Actions, Disassociate Connection.4. Select the connection from the list of available connections.5. Select the confirmation check box, and choose Continue.

To disassociate a connection using the command line or API

• disassociate-connection-from-lag (AWS CLI)• DisassociateConnectionFromLag (AWS Direct Connect API)

Deleting a LAGIf you no longer need a LAG, you can delete it. You cannot delete a LAG if it has virtual interfacesassociated with it—you must first delete the virtual interfaces, or associate them with a different LAG orconnection. Deleting a LAG does not delete the connections in the LAG; you must delete the connectionsyourself. For more information, see Deleting a Connection (p. 19).

To delete a LAG

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose LAGs, and select the LAG.3. Choose Actions, Delete LAG.4. Select the confirmation check box and choose Continue.

To delete a LAG using the command line or API

• delete-lag (AWS CLI)• DeleteLag (AWS Direct Connect API)

47

http://docs.aws.amazon.com/cli/latest/reference/directconnect/associate-connection-with-lag.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateConnectionWithLag.html


http://docs.aws.amazon.com/cli/latest/reference/directconnect/disassociate-connection-from-lag.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DisassociateConnectionFromLag.html


http://docs.aws.amazon.com/cli/latest/reference/directconnect/delete-lag.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteLag.html


Direct Connect GatewaysYou can use an AWS Direct Connect gateway to connect your AWS Direct Connect connection over aprivate virtual interface to one or more VPCs in your account that are located in the same or differentregions. You associate a Direct Connect gateway with the virtual private gateway for the VPC, and thencreate a private virtual interface for your AWS Direct Connect connection to the Direct Connect gateway.You can attach multiple private virtual interfaces to your Direct Connect gateway.

A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway inany public region and access it from all other public regions.

In the following diagram, the Direct Connect gateway enables you to use your AWS Direct Connectconnection in the US East (N. Virginia) region to access VPCs in your account in both the US East (N.Virginia) and US West (N. California) regions.

The following rules apply:

• You cannot use a Direct Connect gateway to connect to a VPC in the China regions.• You cannot use a Direct Connect gateway that's in your account to connect to a VPC that's in a

different AWS account. To associate a Direct Connect gateway with a virtual private gateway, it mustbe in the same account as the virtual private gateway.

• There are limits for creating and using Direct Connect gateways. For more information, see AWS DirectConnect Limits (p. 2).

• The VPCs to which you connect through a Direct Connect gateway cannot have overlapping CIDRblocks. If you add an IPv4 CIDR block to a VPC that's associated with a Direct Connect gateway, ensurethat the CIDR block does not overlap with an existing CIDR block for any other associated VPC. Formore information, see Adding IPv4 CIDR Blocks to a VPC in the Amazon VPC User Guide.

• You cannot create a public virtual interface to a Direct Connect gateway.• A Direct Connect gateway supports communication between attached private virtual interfaces and

associated virtual private gateways only. The following traffic flows are not supported:• Direct communication between the VPCs that are associated with the Direct Connect gateway.• Direct communication between the virtual interfaces that are attached to the Direct Connect

gateway.

48

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html#vpc-resize

AWS Direct Connect User GuideCreating a Direct Connect Gateway

• Direct communication between a virtual interface attached to a Direct Connect gateway and a VPNconnection on a virtual private gateway that's associated with the same Direct Connect gateway.

• You cannot associate a virtual private gateway with more than one Direct Connect gateway and youcannot attach a private virtual interface to more than one Direct Connect gateway.

• A virtual private gateway that you associate with a Direct Connect gateway must be attached to a VPC.• You cannot tag a Direct Connect gateway.

To connect your AWS Direct Connect connection to a VPC in the same region only, you can create a DirectConnect gateway or you can create a private virtual interface and attach it to the virtual private gatewayfor the VPC. For more information, see Creating a Private Virtual Interface (p. 32) and VPN CloudHub.

To use your AWS Direct Connect connection with a VPC in another account, you can create a hostedprivate virtual interface for that account. When the owner of the other account accepts the hostedvirtual interface, they can choose to attach it to either a virtual private gateway or a Direct Connectgateway in their account. For more information, see Virtual Interfaces (p. 29).

Contents• Creating a Direct Connect Gateway (p. 49)• Associating and Disassociating Virtual Private Gateways (p. 49)• Creating a Private Virtual Interface to the Direct Connect Gateway (p. 50)• Deleting a Direct Connect Gateway (p. 52)

Creating a Direct Connect GatewayYou can create a Direct Connect gateway in any supported public region.

To create a Direct Connect gateway

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Direct Connect Gateways.3. Choose Create Direct Connect Gateway.4. Specify the following information, and choose Create.

• Name: Enter a name to help you identify the Direct Connect gateway.• Amazon side ASN: Specify the ASN for the Amazon side of the BGP session. The ASN must be in

the 64,512 to 65,534 range or 4,200,000,000 to 4,294,967,294 range.

To create a Direct Connect gateway using the command line or API

• create-direct-connect-gateway (AWS CLI)• CreateDirectConnectGateway (AWS Direct Connect API)

Associating and Disassociating Virtual PrivateGateways

To associate a virtual private gateway with a Direct Connect gateway, you must be in the region in whichthe virtual private gateway is located. The virtual private gateway must be attached to the VPC to whichyou want to connect. For more information, see Create a Virtual Private Gateway in the Amazon VPC UserGuide.

49

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPN_CloudHub.html


http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-direct-connect-gateway.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGateway.html

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html#vpn-create-vpg


to the Direct Connect Gateway

NoteIf you are planning to use the virtual private gateway for a Direct Connect gateway and adynamic VPN connection, set the ASN on the virtual private gateway to the value you requirefor the VPN connection. Otherwise, the ASN on the virtual private gateway can be set to anypermitted value. The Direct Connect gateway advertises all connected VPCs over the ASNassigned to it.

To associate a virtual private gateway


2. Use the region selector to select the region in which your virtual private gateway is located.

3. In the navigation pane, choose Direct Connect Gateways and select the Direct Connect gateway.

4. Choose Actions, Associate Virtual Private Gateway.

5. Select the virtual private gateways to associate, and choose Associate.

You can view all the virtual private gateways in all regions that are associated with the Direct Connectgateway by choosing Virtual Gateway Associations. To disassociate a virtual private gateway from aDirect Connect gateway, you must be in the region in which the virtual private gateway is located.

To disassociate a virtual private gateway


2. Use the region selector to switch to the region in which your virtual private gateway is located.

3. In the navigation pane, choose Direct Connect Gateways and select the Direct Connect gateway.

4. Choose Actions, Disassociate Virtual Private Gateway.

5. Select the virtual private gateways to disassociate, and choose Disassociate.

To associate a virtual private gateway using the command line or API

• create-direct-connect-gateway-association (AWS CLI)

• CreateDirectConnectGatewayAssociation (AWS Direct Connect API)

To view the virtual private gateways associated with a Direct Connect gateway using thecommand line or API

• describe-direct-connect-gateway-associations (AWS CLI)

• DescribeDirectConnectGatewayAssociations (AWS Direct Connect API)

To disassociate a virtual private gateway using the command line or API

• delete-direct-connect-gateway-association (AWS CLI)

• DeleteDirectConnectGatewayAssociation (AWS Direct Connect API)

Creating a Private Virtual Interface to the DirectConnect Gateway

To connect your AWS Direct Connect connection to the remote VPC, you must create a private virtualinterface for your connection and specify the Direct Connect gateway to which to connect.

50



http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-direct-connect-gateway-association.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGatewayAssociation.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-direct-connect-gateway-associations.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAssociations.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/delete-direct-connect-gateway-association.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGatewayAssociation.html


to the Direct Connect Gateway

NoteIf you're accepting a hosted private virtual interface, you can associate it with a Direct Connectgateway in your account. For more information, see Accepting a Hosted Virtual Interface (p. 39).

To provision a private virtual interface to a Direct Connect gateway


2. In the navigation pane, choose Connections, select the connection to use, and choose Actions,Create Virtual Interface.

3. In the Create a Virtual Interface pane, select Private.




c. For Connection To, choose Direct Connect Gateway and select the Direct Connect gateway.







h. To have AWS generate a BGP key, select the Auto-generate BGP key check box .

51


AWS Direct Connect User GuideDeleting a Direct Connect Gateway


After you've created the virtual interface, you can download the router configuration for your device. Formore information, see Downloading the Router Configuration File (p. 33).

To create a private virtual interface using the command line or API

• create-private-virtual-interface (AWS CLI)• CreatePrivateVirtualInterface (AWS Direct Connect API)

To view the virtual interfaces that are attached to a Direct Connect gateway using thecommand line or API

• describe-direct-connect-gateway-attachments (AWS CLI)• DescribeDirectConnectGatewayAttachments (AWS Direct Connect API)

Deleting a Direct Connect GatewayIf you no longer require a Direct Connect gateway, you can delete it. You must first disassociate (p. 49)all associated virtual private gateways and delete (p. 36) the attached private virtual interface.

To delete a Direct Connect gateway

1. Open the AWS Direct Connect console at https://console.aws.amazon.com/directconnect/.2. In the navigation pane, choose Direct Connect Gateways and select the Direct Connect gateway.3. Choose Actions, Delete Direct Connect Gateway.4. Choose Delete.

To delete a Direct Connect gateway using the command line or API

• delete-direct-connect-gateway (AWS CLI)• DeleteDirectConnectGateway (AWS Direct Connect API)

52

http://docs.aws.amazon.com/cli/latest/reference/directconnect/create-private-virtual-interface.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePrivateVirtualInterface.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-direct-connect-gateway-attachments.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAttachments.html


http://docs.aws.amazon.com/cli/latest/reference/directconnect/delete-direct-connect-gateway.html

http://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGateway.html

AWS Direct Connect User GuideAWS Direct Connect Actions

Using AWS Identity and AccessManagement with AWS DirectConnect

You can use AWS Identity and Access Management with AWS Direct Connect to specify which AWS DirectConnect actions a user under your AWS account can perform. For example, you could create an IAMpolicy that gives only certain users in your organization permission to use the DescribeConnectionsaction to retrieve data about your AWS Direct Connect connections.

Permissions granted using IAM cover all the AWS resources you use with AWS Direct Connect, so youcannot use IAM to control access to AWS Direct Connect data for specific resources. For example, youcannot give a user access to AWS Direct Connect data for only a specific virtual interface.

ImportantUsing AWS Direct Connect with IAM doesn't change how you use AWS Direct Connect. There areno changes to AWS Direct Connect actions, and no new AWS Direct Connect actions related tousers and access control. For an example of a policy that covers AWS Direct Connect actions, seeExample Policy for AWS Direct Connect (p. 54).

AWS Direct Connect ActionsIn an IAM policy, you can specify any or all actions that AWS Direct Connect offers.The action name must include the lowercase prefix directconnect:. For example:directconnect:DescribeConnections, directconnect:CreateConnection, ordirectconnect:* (for all AWS Direct Connect actions). For a list of the actions, see the AWS DirectConnect API Reference.

AWS Direct Connect ResourcesAWS Direct Connect does not support resource-level permissions; therefore, you cannot control access tospecific AWS Direct Connect resources. You must use an asterisk (*) to specify the resource when writinga policy to control access to AWS Direct Connect actions.

AWS Direct Connect KeysAWS Direct Connect implements the following policy keys:

• aws:CurrentTime (for date/time conditions)• aws:EpochTime (the date in epoch or UNIX time, for use with date/time conditions)• aws:SecureTransport (Boolean representing whether the request was sent using SSL)• aws:SourceIp (the requester's IP address, for use with IP address conditions)• aws:UserAgent (information about the requester's client application, for use with string conditions)

53

AWS Direct Connect User GuideExample Policy for AWS Direct Connect

If you use aws:SourceIp, and the request comes from an Amazon EC2 instance, the instance's public IPaddress is used to determine if access is allowed.

NoteFor services that use only SSL, such as Amazon Relational Database Service and AmazonRoute 53, the aws:SecureTransport key has no meaning.

Key names are case-insensitive. For example, aws:CurrentTime is equivalent to AWS:currenttime.

For more information about policy keys, see Condition in IAM User Guide.

Example Policy for AWS Direct ConnectThis section shows a simple policy for controlling user access to AWS Direct Connect.

NoteIn the future, AWS Direct Connect might add new actions that should logically be included inthe following policy, based on the policy’s stated goals.

Example

The following sample policy allows a group to retrieve any AWS Direct Connect data, but not create ordelete any resources.

{ "Statement": [ { "Effect": "Allow", "Action": [ "directconnect:Describe*" ], "Resource": "*" } ]}

For more information about writing IAM policies, see Overview of IAM Policies in the IAM User Guide.

54

http://docs.aws.amazon.com/IAM/latest/UserGuide/AccessPolicyLanguage_ElementDescriptions.html#Condition

http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

AWS Direct Connect User GuideTag Restrictions

Using Tags with AWS Direct ConnectYou can optionally assign tags to your AWS Direct Connect resources to categorize or manage them. Atag consists of a key and an optional value, both of which you define.

You can tag the following AWS Direct Connect resources.

Resource Amazon Resource Name (ARN)

Connections arn:aws:directconnect:region:account-id:dxcon/connection-id

Virtual interfaces arn:aws:directconnect:region:account-id:dxvif/virtual-interface-id

Link aggregation group (LAG) arn:aws:directconnect:region:account-id:dxlag/lag-id

For example, you have two AWS Direct Connect connections in a region, each in different locations.Connection dxcon-11aa22bb is a connection serving production traffic, and is associated with virtualinterface dxvif-33cc44dd. Connection dxcon-abcabcab is a redundant (backup) connection, andis associated with virtual interface dxvif-12312312. You might choose to tag your connections andvirtual interfaces as follows, to help distinguish them:

Resource ID Tag key Tag value

Purpose Productiondxcon-11aa22bb

Location Amsterdam

dxvif-33cc44dd Purpose Production

Purpose Backupdxcon-abcabcab

Location Frankfurt

dxvif-12312312 Purpose Backup

Tag RestrictionsThe following rules and restrictions apply to tags:

• Maximum number of tags per resource: 50• Maximum key length: 128 Unicode characters• Maximum value length: 265 Unicode characters• Tag keys and values are case sensitive.• The aws: prefix is reserved for AWS use — you can't create or delete tag keys or values with this prefix.

Tags with this prefix do not count against your tags per resource limit.• Allowed characters are letters, spaces, and numbers representable in UTF-8, plus the following special

characters: + - = . _ : / @

55

AWS Direct Connect User GuideWorking with Tags

• Cost allocation tags are not supported; therefore, tags that you apply to AWS Direct Connect resourcescannot be used for cost allocation tracking.

Working with TagsCurrently, you can work with tags using the AWS Direct Connect API, the AWS CLI, the AWS Tools forWindows PowerShell, or an AWS SDK only. To apply or remove tags, you must specify the AmazonResource Name (ARN) for the resource. For more information, see Amazon Resource Names (ARNs) andAWS Service Namespaces in the Amazon Web Services General Reference.

To add a tag using the AWS CLI

Use the tag-resource command:

aws directconnect tag-resource --resource-arn arn:aws:directconnect:region:account-id:resource-type/resource-id --tags "key=key,value=value"

To describe your tags using the AWS CLI

Use the describe-tags command:

aws directconnect describe-tags --resource-arns arn:aws:directconnect:region:account-id:resource-type/resource-id

To delete a tag using the AWS CLI

Use the untag-resource command:

aws directconnect untag-resource --resource-arn arn:aws:directconnect:region:account-id:resource-type/resource-id --tag-keys key

56

http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html

http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/tag-resource.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/describe-tags.html

http://docs.aws.amazon.com/cli/latest/reference/directconnect/untag-resource.html

AWS Direct Connect User GuideStep 1: Create a Connection

Using the AWS CLIYou can use the AWS CLI to create and work with AWS Direct Connect resources.

The following example uses the AWS CLI commands to create an AWS Direct Connect connection,download the Letter of Authorization and Connecting Facility Assignment (LOA-CFA), and provision aprivate or public virtual interface.

Before you begin, ensure that you have installed and configured the AWS CLI. For more information, seethe AWS Command Line Interface User Guide.

Contents• Step 1: Create a Connection (p. 57)• Step 2: Download the LOA-CFA (p. 58)• Step 3: Create a Virtual Interface and get the Router Configuration (p. 58)

Step 1: Create a ConnectionThe first step is to submit a connection request. Ensure that you know the port speed that you requireand the AWS Direct Connect location. For more information, see Connections (p. 17).

To create a connection request

1. Describe the AWS Direct Connect locations for your current region. In the output that's returned,take note of the location code for the location in which you want to establish the connection.

aws directconnect describe-locations

{ "locations": [ { "locationName": "NAP do Brasil, Barueri, Sao Paulo", "locationCode": "TNDB" }, { "locationName": "Tivit - Site Transamerica (Sao Paulo)", "locationCode": "TIVIT" } ]}

2. Create the connection and specify a name, the port speed, and the location code. In the outputthat's returned, take note of the connection ID. You need the ID to get the LOA-CFA in the next step.

aws directconnect create-connection --location TIVIT --bandwidth 1Gbps --connection-name "Connection to AWS"

{ "ownerAccount": "123456789012", "connectionId": "dxcon-fg31dyv6", "connectionState": "requested", "bandwidth": "1Gbps", "location": "TIVIT",

57

http://docs.aws.amazon.com/cli/latest/userguide/

AWS Direct Connect User GuideStep 2: Download the LOA-CFA

"connectionName": "Connection to AWS", "region": "sa-east-1"}

Step 2: Download the LOA-CFAAfter you've requested a connection, you can get the LOA-CFA using the describe-loa command. Theoutput is base64-encoded. You must extract the relevant LOA content, decode it, and create a PDF file.

To get the LOA-CFA using Linux or Mac OS X

In this example, the final part of the command decodes the content using the base64 utility, and sendsthe output to a PDF file.

aws directconnect describe-loa --connection-id dxcon-fg31dyv6 --output text --query loaContent|base64 --decode > myLoaCfa.pdf

To get the LOA-CFA using Windows

In this example, the output is extracted to a file called myLoaCfa.base64. The second command uses thecertutil utility to decode the file and send the output to a PDF file.

aws directconneawsct describe-loa --connection-id dxcon-fg31dyv6 --output text --query loaContent > myLoaCfa.base64

certutil -decode myLoaCfa.base64 myLoaCfa.pdf

After you've downloaded the LOA-CFA, send it to your network provider or colocation provider.

Step 3: Create a Virtual Interface and get theRouter Configuration

After you have placed an order for an AWS Direct Connect connection, you must create a virtual interfaceto begin using it. You can create a private virtual interface to connect to your VPC, or you can create apublic virtual interface to connect to AWS services that aren't in a VPC. You can create a virtual interfacethat supports IPv4 or IPv6 traffic.

Before you begin, ensure that you've read the prerequisites in Prerequisites for Virtual Interfaces (p. 29).

When you create a virtual interface using the AWS CLI, the output includes generic router configurationinformation. If you want router configuration that's specific to your device, use the AWS Direct Connectconsole. For more information, see Downloading the Router Configuration File (p. 33).

To create a private virtual interface

1. Get the ID of the virtual private gateway (vgw-xxxxxxxx) that's attached to your VPC. You need the IDto create the virtual interface in the next step.

aws ec2 describe-vpn-gateways

{

58

AWS Direct Connect User GuideStep 3: Create a Virtual Interfaceand get the Router Configuration

"VpnGateways": [ { "State": "available", "Tags": [ { "Value": "DX_VGW", "Key": "Name" } ], "Type": "ipsec.1", "VpnGatewayId": "vgw-ebaa27db", "VpcAttachments": [ { "State": "attached", "VpcId": "vpc-24f33d4d" } ] } ]}

2. Create a private virtual interface. You must specify a name, a VLAN ID, and a BGP AutonomousSystem Number (ASN).

For IPv4 traffic, you need private IPv4 addresses for each end of the BPG peering session. You canspecify your own IPv4 addresses, or you can let Amazon generate the addresses for you. In thefollowing example, the IPv4 addresses are generated for you.

aws directconnect create-private-virtual-interface --connection-id dxcon-fg31dyv6 --new-private-virtual-interface virtualInterfaceName=PrivateVirtualInterface,vlan=101,asn=65000,virtualGatewayId=vgw-ebaa27db,addressFamily=ipv4

{ "virtualInterfaceState": "pending", "asn": 65000, "vlan": 101, "customerAddress": "192.168.1.2/30", "ownerAccount": "123456789012", "connectionId": "dxcon-fg31dyv6", "addressFamily": "ipv4", "virtualGatewayId": "vgw-ebaa27db", "virtualInterfaceId": "dxvif-ffhhk74f", "authKey": "asdf34example", "routeFilterPrefixes": [], "location": "TIVIT", "bgpPeers": [ { "bgpStatus": "down", "customerAddress": "192.168.1.2/30", "addressFamily": "ipv4", "authKey": "asdf34example", "bgpPeerState": "pending", "amazonAddress": "192.168.1.1/30", "asn": 65000 } "customerRouterConfig": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<logical_connection id=\"dxvif-ffhhk74f\">\n <vlan>101</vlan>\n <customer_address>192.168.1.2/30</customer_address>\n <amazon_address>192.168.1.1/30</amazon_address>\n <bgp_asn>65000</bgp_asn>\n <bgp_auth_key>asdf34example</bgp_auth_key>\n <amazon_bgp_asn>7224</amazon_bgp_asn>\n <connection_type>private</connection_type>\n</logical_connection>\n", "amazonAddress": "192.168.1.1/30",

59


"virtualInterfaceType": "private", "virtualInterfaceName": "PrivateVirtualInterface"}

To create a private virtual interface that supports IPv6 traffic, use the same command as above andspecify ipv6 for the addressFamily parameter. You cannot specify your own IPv6 addresses forthe BGP peering session; Amazon allocates you IPv6 addresses.

3. To view the router configuration information in XML format, describe the virtual interface youcreated. Use the --query parameter to extract the customerRouterConfig information, and the--output parameter to organize the text into tab-delimited lines.

aws directconnect describe-virtual-interfaces --virtual-interface-id dxvif-ffhhk74f --query virtualInterfaces[*].customerRouterConfig --output text

<?xml version="1.0" encoding="UTF-8"?><logical_connection id="dxvif-ffhhk74f"> <vlan>101</vlan> <customer_address>192.168.1.2/30</customer_address> <amazon_address>192.168.1.1/30</amazon_address> <bgp_asn>65000</bgp_asn> <bgp_auth_key>asdf34example</bgp_auth_key> <amazon_bgp_asn>7224</amazon_bgp_asn> <connection_type>private</connection_type></logical_connection>

To create a public virtual interface

1. To create a public virtual interface, you must specify a name, a VLAN ID, and a BGP AutonomousSystem Number (ASN).

For IPv4 traffic, you must also specify public IPv4 addresses for each end of the BPG peering session,and public IPv4 routes that you will advertise over BGP. The following example creates a publicvirtual interface for IPv4 traffic.

aws directconnect create-public-virtual-interface --connection-id dxcon-fg31dyv6 --new-public-virtual-interface virtualInterfaceName=PublicVirtualInterface,vlan=2000,asn=65000,amazonAddress=203.0.113.1/30,customerAddress=203.0.113.2/30,addressFamily=ipv4,routeFilterPrefixes=[{cidr=203.0.113.0/30},{cidr=203.0.113.4/30}]

{ "virtualInterfaceState": "verifying", "asn": 65000, "vlan": 2000, "customerAddress": "203.0.113.2/30", "ownerAccount": "123456789012", "connectionId": "dxcon-fg31dyv6", "addressFamily": "ipv4", "virtualGatewayId": "", "virtualInterfaceId": "dxvif-fgh0hcrk", "authKey": "asdf34example", "routeFilterPrefixes": [ { "cidr": "203.0.113.0/30" }, { "cidr": "203.0.113.4/30" } ],

60


"location": "TIVIT", "bgpPeers": [ { "bgpStatus": "down", "customerAddress": "203.0.113.2/30", "addressFamily": "ipv4", "authKey": "asdf34example", "bgpPeerState": "verifying", "amazonAddress": "203.0.113.1/30", "asn": 65000 } ], "customerRouterConfig": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<logical_connection id=\"dxvif-fgh0hcrk\">\n <vlan>2000</vlan>\n <customer_address>203.0.113.2/30</customer_address>\n <amazon_address>203.0.113.1/30</amazon_address>\n <bgp_asn>65000</bgp_asn>\n <bgp_auth_key>asdf34example</bgp_auth_key>\n <amazon_bgp_asn>7224</amazon_bgp_asn>\n <connection_type>public</connection_type>\n</logical_connection>\n", "amazonAddress": "203.0.113.1/30", "virtualInterfaceType": "public", "virtualInterfaceName": "PublicVirtualInterface"}

To create a public virtual interface that supports IPv6 traffic, you can specify IPv6 routes that youwill advertise over BGP. You cannot specify IPv6 addresses for the peering session; Amazon allocatesIPv6 addresses to you. The following example creates a public virtual interface for IPv6 traffic.

aws directconnect create-public-virtual-interface --connection-id dxcon-fg31dyv6 --new-public-virtual-interface virtualInterfaceName=PublicVirtualInterface,vlan=2000,asn=65000,addressFamily=ipv6,routeFilterPrefixes=[{cidr=2001:db8:64ce:ba00::/64},{cidr=2001:db8:64ce:ba01::/64}]

2. To view the router configuration information in XML format, describe the virtual interface youcreated. Use the --query parameter to extract the customerRouterConfig information, and the--output parameter to organize the text into tab-delimited lines.

aws directconnect describe-virtual-interfaces --virtual-interface-id dxvif-fgh0hcrk --query virtualInterfaces[*].customerRouterConfig --output text

<?xml version="1.0" encoding="UTF-8"?><logical_connection id="dxvif-fgh0hcrk"> <vlan>2000</vlan> <customer_address>203.0.113.2/30</customer_address> <amazon_address>203.0.113.1/30</amazon_address> <bgp_asn>65000</bgp_asn> <bgp_auth_key>asdf34example</bgp_auth_key> <amazon_bgp_asn>7224</amazon_bgp_asn> <connection_type>public</connection_type></logical_connection>

61

AWS Direct Connect User GuideAWS Direct Connect Information in CloudTrail

Logging AWS Direct Connect APICalls in AWS CloudTrail

AWS Direct Connect is integrated with AWS CloudTrail, a service that captures API calls made by or onbehalf of your AWS account. This information is collected and written to log files that are stored in anAmazon Simple Storage Service (S3) bucket that you specify. API calls are logged when you use the AWSDirect Connect API, the AWS Direct Connect console, a back-end console, or the AWS CLI. Using theinformation collected by CloudTrail, you can determine what request was made to AWS Direct Connect,the source IP address the request was made from, who made the request, when it was made, and so on.

To learn more about CloudTrail, including how to configure and enable it, see the AWS CloudTrail UserGuide.

Topics• AWS Direct Connect Information in CloudTrail (p. 62)• Understanding AWS Direct Connect Log File Entries (p. 62)

AWS Direct Connect Information in CloudTrailIf CloudTrail logging is turned on, calls made to all AWS Direct Connect actions are captured in log files.All of the AWS Direct Connect actions are documented in the AWS Direct Connect API Reference. Forexample, calls to the CreateConnection, CreatePrivateVirtualInterface, and DescribeConnectionsactions generate entries in CloudTrail log files.

Every log entry contains information about who generated the request. For example, if a request is madeto create a new connection to AWS Direct Connect (CreateConnection), CloudTrail logs the user identityof the person or service that made the request. The user identity information helps you determinewhether the request was made with root credentials or AWS Identity and Access Management (IAM) usercredentials, with temporary security credentials for a role or federated user, or by another service inAWS. For more information about CloudTrail fields, see CloudTrail Event Reference in the AWS CloudTrailUser Guide.

You can store your log files in your bucket for as long as you want, but you can also define Amazon S3lifecycle rules to archive or delete log files automatically. By default, your log files are encrypted by usingAmazon S3 server-side encryption (SSE).

Understanding AWS Direct Connect Log FileEntries

CloudTrail log files can contain one or more log entries composed of multiple JSON-formatted events.A log entry represents a single request from any source and includes information about the requestedaction, any input parameters, the date and time of the action, and so on. The log entries do not appear inany particular order. That is, they do not represent an ordered stack trace of the public API calls.

The following log file record shows that a user called the CreateConnection action.

62

http://docs.aws.amazon.com/awscloudtrail/latest/userguide/

http://docs.aws.amazon.com/awscloudtrail/latest/userguide/

http://docs.aws.amazon.com/directconnect/latest/APIReference/

http://docs.aws.amazon.com/awscloudtrail/latest/userguide/eventreference.html

AWS Direct Connect User GuideUnderstanding AWS Direct Connect Log File Entries

{ "Records": [{ "eventVersion": "1.0", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-04-04T12:23:05Z" } } }, "eventTime": "2014-04-04T17:28:16Z", "eventSource": "directconnect.amazonaws.com", "eventName": "CreateConnection", "awsRegion": "us-west-2", "sourceIPAddress": "127.0.0.1", "userAgent": "Coral/Jakarta", "requestParameters": { "location": "EqSE2", "connectionName": "MyExampleConnection", "bandwidth": "1Gbps" }, "responseElements": { "location": "EqSE2", "region": "us-west-2", "connectionState": "requested", "bandwidth": "1Gbps", "ownerAccount": "123456789012", "connectionId": "dxcon-fhajolyy", "connectionName": "MyExampleConnection" } }, ...additional entries ]}

The following log file record shows that a user called the CreatePrivateVirtualInterface action.

{ "Records": [ { "eventVersion": "1.0", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-04-04T12:23:05Z" } } }, "eventTime": "2014-04-04T17:39:55Z", "eventSource": "directconnect.amazonaws.com",

63


"eventName": "CreatePrivateVirtualInterface", "awsRegion": "us-west-2", "sourceIPAddress": "127.0.0.1", "userAgent": "Coral/Jakarta", "requestParameters": { "connectionId": "dxcon-fhajolyy", "newPrivateVirtualInterface": { "virtualInterfaceName": "MyVirtualInterface", "customerAddress": "[PROTECTED]", "authKey": "[PROTECTED]", "asn": -1, "virtualGatewayId": "vgw-bb09d4a5", "amazonAddress": "[PROTECTED]", "vlan": 123 } }, "responseElements": { "virtualInterfaceId": "dxvif-fgq61m6w", "authKey": "[PROTECTED]", "virtualGatewayId": "vgw-bb09d4a5", "customerRouterConfig": "[PROTECTED]", "virtualInterfaceType": "private", "asn": -1, "routeFilterPrefixes": [], "virtualInterfaceName": "MyVirtualInterface", "virtualInterfaceState": "pending", "customerAddress": "[PROTECTED]", "vlan": 123, "ownerAccount": "123456789012", "amazonAddress": "[PROTECTED]", "connectionId": "dxcon-fhajolyy", "location": "EqSE2" } }, ...additional entries ]}

The following log file record shows that a user called the DescribeConnections action.

{ "Records": [ { "eventVersion": "1.0", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-04-04T12:23:05Z" } } }, "eventTime": "2014-04-04T17:27:28Z", "eventSource": "directconnect.amazonaws.com", "eventName": "DescribeConnections", "awsRegion": "us-west-2", "sourceIPAddress": "127.0.0.1", "userAgent": "Coral/Jakarta", "requestParameters": null,

64


"responseElements": null }, ...additional entries ]}

The following log file record shows that a user called the DescribeVirtualInterfaces action.

{ "Records": [ { "eventVersion": "1.0", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/Alice", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice", "sessionContext": { "attributes": { "mfaAuthenticated": "false", "creationDate": "2014-04-04T12:23:05Z" } } }, "eventTime": "2014-04-04T17:37:53Z", "eventSource": "directconnect.amazonaws.com", "eventName": "DescribeVirtualInterfaces", "awsRegion": "us-west-2", "sourceIPAddress": "127.0.0.1", "userAgent": "Coral/Jakarta", "requestParameters": { "connectionId": "dxcon-fhajolyy" }, "responseElements": null }, ...additional entries ]}

65

AWS Direct Connect User GuideMonitoring Tools

Monitoring AWS Direct ConnectMonitoring is an important part of maintaining the reliability, availability, and performance of your AWSDirect Connect resources. You should collect monitoring data from all of the parts of your AWS solutionso that you can more easily debug a multi-point failure if one occurs. Before you start monitoring AWSDirect Connect; however, you should create a monitoring plan that includes answers to the followingquestions:

• What are your monitoring goals?• What resources will you monitor?• How often will you monitor these resources?• What monitoring tools will you use?• Who will perform the monitoring tasks?• Who should be notified when something goes wrong?

The next step is to establish a baseline for normal AWS Direct Connect performance in your environment,by measuring performance at various times and under different load conditions. As you monitor AWSDirect Connect, store historical monitoring data so that you can compare it with current performancedata, identify normal performance patterns and performance anomalies, and devise methods to addressissues.

To establish a baseline, you should monitor the usage, state, and health of your physical AWS DirectConnect connections.

Topics• Monitoring Tools (p. 66)• Monitoring with Amazon CloudWatch (p. 67)

Monitoring ToolsAWS provides various tools that you can use to monitor an AWS Direct Connect connection. You canconfigure some of these tools to do the monitoring for you, while some of the tools require manualintervention. We recommend that you automate monitoring tasks as much as possible.

Automated Monitoring ToolsYou can use the following automated monitoring tools to watch AWS Direct Connect and report whensomething is wrong:

• Amazon CloudWatch Alarms – Watch a single metric over a time period that you specify, and performone or more actions based on the value of the metric relative to a given threshold over a number oftime periods. The action is a notification sent to an Amazon SNS topic. CloudWatch alarms do notinvoke actions simply because they are in a particular state; the state must have changed and beenmaintained for a specified number of periods. For more information, see Monitoring with AmazonCloudWatch (p. 67).

• AWS CloudTrail Log Monitoring – Share log files between accounts, monitor CloudTrail log files in realtime by sending them to CloudWatch Logs, write log processing applications in Java, and validate thatyour log files have not changed after delivery by CloudTrail. For more information, see Logging AWSDirect Connect API Calls in AWS CloudTrail (p. 62) and Working with CloudTrail Log Files in the AWSCloudTrail User Guide.

66

http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-working-with-log-files.html

AWS Direct Connect User GuideManual Tools

Manual Monitoring ToolsAnother important part of monitoring an AWS Direct Connect connection involves manually monitoringthose items that the CloudWatch alarms don't cover. The AWS Direct Connect and CloudWatch consoledashboards provide an at-a-glance view of the state of your AWS environment.

• The AWS Direct Connect console shows:• Connection status (see the State column)• Virtual interface status (see the State column)

• The CloudWatch home page shows:• Current alarms and status• Graphs of alarms and resources• Service health status

In addition, you can use CloudWatch to do the following:• Create customized dashboards to monitor the services you care about• Graph metric data to troubleshoot issues and discover trends• Search and browse all your AWS resource metrics• Create and edit alarms to be notified of problems

Monitoring with Amazon CloudWatchYou can monitor physical AWS Direct Connect connections using CloudWatch, which collects andprocesses raw data from AWS Direct Connect into readable, near real-time metrics. By default,CloudWatch provides AWS Direct Connect metric data in 5-minute intervals. You can optionally viewdata in 1-minute intervals.

For more information about Amazon CloudWatch, see the Amazon CloudWatch User Guide.

NoteIf your connection is a hosted connection from an AWS Direct Connect partner, you cannot viewCloudWatch metrics for the hosted connection.

Topics• AWS Direct Connect Metrics and Dimensions (p. 67)• Creating CloudWatch Alarms to Monitor AWS Direct Connect Connections (p. 69)

AWS Direct Connect Metrics and DimensionsAWS Direct Connect sends the following metrics about your AWS Direct Connect connections at 30-second intervals to Amazon CloudWatch. Amazon CloudWatch then aggregates these data points to 1-minute or 5-minute intervals. You can use the following procedures to view the metrics for AWS DirectConnect connections.

To view metrics using the CloudWatch console

Metrics are grouped first by the service namespace, and then by the various dimension combinationswithin each namespace.

1. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.2. In the navigation pane, choose Metrics.

67

http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/CloudWatch_Dashboards.html

http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/

https://console.aws.amazon.com/cloudwatch/

AWS Direct Connect User GuideMetrics and Dimensions

3. Under All metrics, choose the DX metric namespace.

4. Choose Connection Metrics, and select the metric dimension to view the metrics (for example, forthe AWS Direct Connect connection).

5. (Optional) To return data for the selected metric in 1-minute intervals, choose Graphed metrics, andselect 1 Minute from the Period list.

To view metrics using the AWS Direct Connect console


2. In the navigation pane, choose Connections and select your connection.

3. The Monitoring tab displays the metrics for your connection.

To view metrics using the AWS CLI

• At a command prompt, use the following command:

aws cloudwatch list-metrics --namespace "AWS/DX"

The following metrics are available from AWS Direct Connect. Metrics are currently available for AWSDirect Connect physical connections only.

Metric Description

ConnectionState The state of the connection. 0 indicates DOWN and 1indicates UP.

Units: Boolean

ConnectionBpsEgress The bit rate for outbound data from the AWS side of theconnection.

The number reported is the aggregate over thespecified time period (5 minutes by default, 1 minuteminimum).

Units: Bits per second

ConnectionBpsIngress The bit rate for inbound data to the AWS side of theconnection.


Units: Bits per second

ConnectionPpsEgress The packet rate for outbound data from the AWS side ofthe connection.


Units: Packets per second

68


AWS Direct Connect User GuideCreating Alarms

Metric Description

ConnectionPpsIngress The packet rate for inbound data to the AWS side of theconnection.


Units: Packets per second

ConnectionCRCErrorCount The number of times cyclic redundancy check (CRC)errors are observed for the data received at theconnection.

Units: Integer

ConnectionLightLevelTx Indicates the health of the fiber connection for egress(outbound) traffic from the AWS side of the connection.

This metric is available for connections with 10 Gbpsport speeds only.

Units: dBm

ConnectionLightLevelRx Indicates the health of the fiber connection for ingress(inbound) traffic to the AWS side of the connection.

This metric is available for connections with 10 Gbpsport speeds only.

Units: dBm

You can filter the AWS Direct Connect data using the following dimensions.

Dimension Description

ConnectionId This dimension filters the data by the AWS Direct Connectconnection.

Creating CloudWatch Alarms to Monitor AWS DirectConnect ConnectionsYou can create a CloudWatch alarm that sends an Amazon SNS message when the alarm changes state.An alarm watches a single metric over a time period that you specify, and sends a notification to anAmazon SNS topic based on the value of the metric relative to a given threshold over a number of timeperiods.

For example, you can create an alarm that monitors the state of an AWS Direct Connect connection andsends a notification when the connection state is DOWN for 5 consecutive 1-minute periods.

To create an alarm for connection state

1. Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/.2. In the navigation pane, choose Alarms, Create Alarm.

69

https://console.aws.amazon.com/cloudwatch/

AWS Direct Connect User GuideCreating Alarms

3. Choose the DX Metrics category.4. Select the AWS Direct Connect connection and choose the ConnectionState metric. Choose Next.5. Configure the alarm as follows, and choose Create Alarm when you are done:

• Under Alarm Threshold, enter a name and description for your alarm. For Whenever, choose <and enter 1. Enter 5 for the consecutive periods.

• Under Actions, select an existing notification list or choose New list to create a new one.• Under Alarm Preview, select a period of 1 minute.

For more examples of creating alarms, see Creating Amazon CloudWatch Alarms in the AmazonCloudWatch User Guide.

70

http://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html

AWS Direct Connect User GuideTroubleshooting Layer 1 (Physical) Issues

Troubleshooting AWS Direct Connect

The following topics can help you troubleshoot issues with your AWS Direct Connect connection.

Topics

• Troubleshooting Layer 1 (Physical) Issues (p. 71)

• Troubleshooting Layer 2 (Data Link) Issues (p. 72)

• Troubleshooting Layer 3/4 (Network/Transport) Issues (p. 74)

• Troubleshooting Routing Issues (p. 76)

Troubleshooting Layer 1 (Physical) IssuesIf you or your network provider are having difficulty establishing physical connectivity to an AWS DirectConnect device, use the following steps to troubleshoot the issue.

1. Verify with the colocation provider that the cross connect is complete. Ask them or your networkprovider to provide you with a cross connect completion notice and compare the ports with thoselisted on your LOA-CFA.

2. Verify that your router or your provider's router is powered on and that the ports are activated.

3. Ensure that the routers are using the correct optical transceiver, auto-negotiation is disabled, andport speed and full-duplex mode are manually configured. For more information, see NetworkRequirements.

4. Verify that the router is receiving an acceptable optical signal over the cross connect.

5. Try flipping (also known as rolling) the Tx/Rx fiber strands.

6. Check the Amazon CloudWatch metrics for AWS Direct Connect. You can verify the AWS DirectConnect device's Tx/Rx optical readings (10-Gbps port speeds only), physical error count, andoperational status. For more information, see Monitoring with Amazon CloudWatch.

7. Contact the colocation provider and request a written report for the Tx/Rx optical signal across thecross connect.

8. If the above steps do not resolve physical connectivity issues, contact AWS Support and provide thecross connect completion notice and optical signal report from the colocation provider.

The following flow chart contains the steps to diagnose issues with the physical connection.

71

http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html#overview_requirements

http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html#overview_requirements

http://docs.aws.amazon.com/directconnect/latest/UserGuide/monitoring-cloudwatch.html


AWS Direct Connect User GuideTroubleshooting Layer 2 (Data Link) Issues

Troubleshooting Layer 2 (Data Link) IssuesIf your AWS Direct Connect physical connection is up but your virtual interface is down, use the followingsteps to troubleshoot the issue.

1. If you cannot ping the Amazon peer IP address, verify that your peer IP address is configured correctlyand in the correct VLAN. Ensure that the IP address is configured in the VLAN subinterface and not thephysical interface (for example, GigabitEthernet0/0.123 instead of GigabitEthernet0/0).

72

AWS Direct Connect User GuideTroubleshooting Layer 2 (Data Link) Issues

2. Verify if the router has a MAC address entry from the AWS endpoint in your address resolutionprotocol (ARP) table.

3. Ensure that any intermediate devices between endpoints have VLAN trunking enabled for your802.1Q VLAN tag. ARP cannot be established on the AWS side until AWS receives tagged traffic.

4. Clear your or your provider's ARP table cache.

5. If the above steps do not establish ARP or you still cannot ping the Amazon peer IP, contact AWSSupport.

The following flow chart contains the steps to diagnose issues with the data link.

73



AWS Direct Connect User GuideTroubleshooting Layer 3/4 (Network/Transport) Issues

If the BGP session is still not established after verifying these steps, see Troubleshooting Layer 3/4(Network/Transport) Issues (p. 74). If the BGP session is established but you are experiencing routingissues, see Troubleshooting Routing Issues (p. 76).

Troubleshooting Layer 3/4 (Network/Transport)Issues

If your AWS Direct Connect physical connection is up and you can ping the Amazon peer IP address, butyour virtual interface is down and the BGP peering session cannot be established, use the following stepsto troubleshoot the issue.

1. Ensure that your BGP local Autonomous System Number (ASN) and Amazon's ASN are configuredcorrectly.

2. Ensure that the peer IPs for both sides of the BGP peering session are configured correctly.

3. Ensure that your MD5 authentication key is configured and exactly matches the key in thedownloaded router configuration file. Check that there are no extra spaces or characters.

4. Verify that you or your provider are not advertising more than 100 prefixes for private virtualinterfaces or 1,000 prefixes for public virtual interfaces. These are hard limits and cannot be exceeded.

5. Ensure that there are no firewall or ACL rules that are blocking TCP port 179 or any high-numberedephemeral TCP ports. These ports are necessary for BGP to establish a TCP connection between thepeers.

6. Check your BGP logs for any errors or warning messages.

7. If the above steps do not establish the BGP peering session, contact AWS Support.

The following flow chart contains the steps to diagnose issues with the BGP peering session.

74


AWS Direct Connect User GuideTroubleshooting Layer 3/4 (Network/Transport) Issues

75

AWS Direct Connect User GuideTroubleshooting Routing Issues

If the BGP peering session is established but you are experiencing routing issues, see TroubleshootingRouting Issues (p. 76).

Troubleshooting Routing IssuesIf your virtual interface is up and you've established a BGP peering session but you cannot route trafficover the virtual interface, use the following steps to troubleshoot the issue.

1. Ensure that you are advertising a route for your on-premises network prefix over the BGP session. Fora private virtual interface, this can be a private or public network prefix. For a public virtual interface,this must be your publicly routable network prefix.

2. For a private virtual interface, ensure that your VPC security groups and network ACLs allow inboundand outbound traffic for your on-premises network prefix. For more information, see Security Groupsand Network ACLs in the Amazon VPC User Guide.

3. For a private virtual interface, ensure that your VPC route tables have prefixes pointing to the virtualprivate gateway to which your private virtual interface is connected. For example, if you prefer to haveall your traffic routed towards your on-premises network by default, you can add the default route(0.0.0.0/0 and/or ::/0) with the virtual private gateway as the target in your VPC route tables.

• Alternatively, enable route propagation to automatically update routes in your route tables basedon your dynamic BGP route advertisement. You can have up to 100 propagated routes per routetable. This limit cannot be increased. For more information, see Enabling and Disabling RoutePropagation in the Amazon VPC User Guide.

4. If the above steps do not resolve your routing issues, contact AWS Support.

The following flow chart contains the steps to diagnose routing issues.

76

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_ACLs.html

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html#EnableDisableRouteProp

http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Route_Tables.html#EnableDisableRouteProp


AWS Direct Connect User GuideTroubleshooting Routing Issues

77


Document History• API version: 2012-10-25

The following table describes the important changes since the last release of the AWS Direct ConnectUser Guide.

Change Description Release Date

Localpreference BGPcommunities

You can use local preference BGP community tags to achieveload balancing and route preference for incoming traffic toyour network. For more information, see Local Preference BGPCommunities (p. 6).

2018-02-06

AWS DirectConnectgateway

You can use a Direct Connect gateway to connect your AWSDirect Connect connection to VPCs in remote regions. For moreinformation, see Direct Connect Gateways (p. 48).

2017-11-01

AmazonCloudWatchmetrics

You can view CloudWatch metrics for your AWS Direct Connectconnections. For more information, see Monitoring with AmazonCloudWatch (p. 67).

2017-06-29

Linkaggregationgroups

You can create a link aggregation group (LAG) to aggregatemultiple AWS Direct Connect connections. For more information,see Link Aggregation Groups (p. 43).

2017-02-13

IPv6 support Your virtual interface can now support an IPv6 BGP peering session.For more information, see Adding or Removing a BGP Peer (p. 40).

2016-12-01

Taggingsupport

You can now tag your AWS Direct Connect resources. For moreinformation, see Using Tags with AWS Direct Connect (p. 55).

2016-11-04

Self-serviceLOA-CFA

You can now download your Letter of Authorization andConnecting Facility Assignment (LOA-CFA) using the AWS DirectConnect console or API.

2016-06-22

New locationin SiliconValley

Updated topic to include the addition of the new Silicon Valleylocation in the US West (N. California) region.

2016-06-03

New locationin Amsterdam

Updated topic to include the addition of the new Amsterdamlocation in the EU (Frankfurt) region.

2016-05-19

New locationsin Portland,Oregon andSingapore

Updated topic to include the addition of the new Portland, Oregonand Singapore locations in the US West (Oregon) and Asia Pacific(Singapore) regions.

2016-04-27

New locationin Sao Paulo,Brasil

Updated topic to include the addition of the new Sao Paulo locationin the South America (São Paulo) region.

2015-12-09

New locationsin Dallas,London, Silicon

Updated topics to include the addition of the new locations inDallas (US East (N. Virginia) region), London (EU (Ireland) region),Silicon Valley (AWS GovCloud (US) region), and Mumbai (Asia Pacific(Singapore) region).

2015-11-27

78



Valley, andMumbai

New locationin the China(Beijing) region

Updated topics to include the addition of the new Beijing locationin the China (Beijing) region.

2015-04-14

New Las Vegaslocation inthe US West(Oregon)region

Updated topics to include the addition of the new AWS DirectConnect Las Vegas location in the US West (Oregon) region.

2014-11-10

New EU(Frankfurt)region

Updated topics to include the addition of the new AWS DirectConnect locations serving the EU (Frankfurt) region.

2014-10-23

New locationsin the AsiaPacific(Sydney)region

Updated topics to include the addition of the new AWS DirectConnect locations serving the Asia Pacific (Sydney) region.

2014-07-14

Support forAWS CloudTrail

Added a new topic to explain how you can use CloudTrail to logactivity in AWS Direct Connect. For more information, see LoggingAWS Direct Connect API Calls in AWS CloudTrail (p. 62).

2014-04-04

Support foraccessingremote AWSregions

Added a new topic to explain how you can access public resourcesin a remote region. For more information, see Accessing a RemoteAWS Region (p. 4).

2013-12-19

Supportfor hostedconnections

Updated topics to include support for hosted connections. 2013-10-22

New locationin the EU(Ireland) region

Updated topics to include the addition of the new AWS DirectConnect location serving the EU (Ireland) region.

2013-06-24

New Seattlelocation inthe US West(Oregon)region

Updated topics to include the addition of the new AWS DirectConnect location in Seattle serving the US West (Oregon) region.

2013-05-08

Support forusing IAM withAWS DirectConnect

Added a topic about using AWS Identity and Access Managementwith AWS Direct Connect. For more information, see Using AWSIdentity and Access Management with AWS Direct Connect (p. 53).

2012-12-21

New AsiaPacific(Sydney)region

Updated topics to include the addition of the new AWS DirectConnect location serving the Asia Pacific (Sydney) region.

2012-12-14

79



New AWSDirect Connectconsole, andthe US East (N.Virginia) andSouth America(Sao Paulo)regions

Replaced the AWS Direct Connect Getting Started Guide with theAWS Direct Connect User Guide. Added new topics to cover thenew AWS Direct Connect console, added a billing topic, addedrouter configuration information, and updated topics to include theaddition of two new AWS Direct Connect locations serving the USEast (N. Virginia) and South America (Sao Paulo) regions.

2012-08-13

Supportfor the EU(Ireland),Asia Pacific(Singapore),and Asia Pacific(Tokyo) regions

Added a new troubleshooting section and updated topics to includethe addition of four new AWS Direct Connect locations serving theUS West (Northern California), EU (Ireland), Asia Pacific (Singapore),and Asia Pacific (Tokyo) regions.

2012-01-10

Support forthe US West(NorthernCalifornia)region

Updated topics to include the addition of the US West (NorthernCalifornia) region.

2011-09-08

Public release The first release of AWS Direct Connect. 2011-08-03

80


AWS GlossaryFor the latest AWS terminology, see the AWS Glossary in the AWS General Reference.

81

http://docs.aws.amazon.com/general/latest/gr/glos-chap.html

AWS Direct Connect · AWS Direct Connect User Guide Amazon's trademarks and trade dress may not be...

Documents

Transcript of AWS Direct Connect · AWS Direct Connect User Guide Amazon's trademarks and trade dress may not be...