AWS outbound connectivity via BGP

Reading time ~1 minute

Ahoy!

Today I spent some time hacking on AWS after having been faced with the issues of VPC private connectivity in my day job.

Its only a quick post today but the tldr is that, yes using either Amazon Direct Connect’s or AWS VPN service will enable you to shift the outbound connectivity away from AWS itself and back to your corporate routers. The code to have a play with this approach yourself is at https://github.com/Kahn/aws-outbound-bgp

When your considering this there is a few quick pros and cons.

Pros:

  • Failover is incredibly quick compared to solutions based on auto-scaling groups. BGP will is configured with 30 second timers by default by Amazon and a dead route will be removed even quicker.
  • You can work around the single route only options presented to you via the AWS console.
  • You can scale the solution out past N+1 if your so inclined
  • Your VPC stays more secure by sending your internet bound traffic back to your existing corporate environment ISP’s (Your watching those links right?) rather than the nearest IGW

Cons:

  • You loose literally all of the network elasticity that using AWS affords you by congesting your existing links with AWS originated traffic
  • Your now going to have to get some more of that PI space to address these hosts as your not going to be able to have Amazon EIP’s easily either.

In short I think this solution will is appealing to bigger enterprises who can easily handle the sort of transit bandwidth they require. Being able to simplfy routing across their AWS footprint (think multiple accounts per organization) does make the job of a security team and network team much easier.

Meanwhile, I am sure a small startup just wanting to avoid getting their office 4G link DOS’ed by server traffic will really not care at all about these options and just stick with NAT or HTTP Proxies.

That is all I have time for now but I hope this can help next time your considering how to get traffic out of your private VPCs. If you have any questions please feel free to use the comments or hit me up online.

Tackling Mount Warrigal VK2/CT-057

Ahoy!It's been a while between blogs, but after a recent journey out activating SOTA summits with Pascal [VK2IHL](https://www.qrz.com/db/...… Continue reading

QRO - Backpack portable HF power amplifier

Published on April 15, 2017

Stepping into the wide world of radio

Published on March 11, 2017