Direct Connect connections, VIFs and gateways

Direct Connect (DX) gives private, consistent bandwidth to AWS. Exam questions focus on picking the right VIF, scaling to many VPCs and building resilience.

Connection types

Type	Speeds	Notes
Dedicated	1, 10, 100 Gbps	Ordered from AWS, one port, many VIFs allowed
Hosted	50 Mbps to 25 Gbps	Provided by a partner, one VIF per hosted connection

If a design needs several VLANs on one connection for segmentation, use a dedicated connection. A hosted connection carries a single VIF.

Virtual interfaces

• Private VIF: reaches a VPC through a virtual private gateway or a Direct Connect gateway.
• Public VIF: reaches AWS public endpoints such as S3 and DynamoDB public IPs, not VPC private addresses.
• Transit VIF: connects to a Direct Connect gateway that is associated with a transit gateway.

A Direct Connect gateway is a global object. It lets one VIF reach VPCs in any Region (except China). It does not allow VPC-to-VPC traffic between the attached VPCs.

For many VPCs, use transit VIF, DX gateway and TGW. Private VIFs have a per-connection limit and become a management burden.

Resilience

Pick the model that matches the stated availability need:

• Maximum resiliency: two connections at each of two or more DX locations, on separate devices.
• High resiliency: one connection at each of two locations.
• Development only: a single connection.

A Site-to-Site VPN is a cheap backup. When both DX and VPN advertise the same prefix, AWS prefers Direct Connect. Use BGP with BFD for fast failover.

Controlling path selection

AWS evaluates the longest prefix first. For equal prefixes it uses local preference, then AS path length. AWS supports local preference BGP communities on private and transit VIFs: 7224:7100 (low), 7224:7200 (medium) and 7224:7300 (high). Use AS path prepending on your side to influence which path AWS prefers.

Encryption

DX is not encrypted by default. Options are IPsec VPN over a public VIF or a transit VIF, or MACsec on dedicated 10 and 100 Gbps connections.

Exam traps

• A Direct Connect gateway does not route between its attached VPCs; use a transit gateway for that.
• A public VIF does not reach VPC private IPs.
• Hosted connections carry one VIF; dedicated connections carry many.
• DX is not encrypted by default. Do not assume private means encrypted.
• Two VIFs on the same DX location do not give location resiliency.

Practice questions

Choose an answer, then review the explanation to check your understanding.

1. A company needs to reach 40 VPCs in several Regions and several accounts from one on-premises data center over a single Direct Connect connection. What is the most scalable design?

1. A.40 private VIFs
2. B.One transit VIF to a Direct Connect gateway associated with a transit gateway
3. C.One public VIF and 40 VPN connections
4. D.VPC peering between all VPCs and one private VIF

Show answer

Answer: B.A transit VIF to a Direct Connect gateway associated with a transit gateway scales far beyond the private VIF limit per connection.

2. Traffic from AWS should prefer the primary data center and use the second one only if the primary fails. Both advertise the same prefix over BGP. What do you configure?

1. A.Lower the local preference of the primary
2. B.Tag the secondary's routes with the low local preference BGP community, or prepend the AS path on the secondary
3. C.Disable BGP and use static routes
4. D.Use two VPN connections with ECMP

Show answer

Answer: B.AWS honours local preference communities and prefers a shorter AS path. Making the secondary less preferred keeps traffic on the primary until it fails.

3. Which option encrypts traffic between on-premises and AWS over Direct Connect?

1. A.Direct Connect is encrypted by default
2. B.A Site-to-Site VPN over a VIF, or MACsec on a dedicated connection
3. C.A private VIF with a security group
4. D.Direct Connect gateway encryption

Show answer

Answer: B.Direct Connect is not encrypted by default. Use IPsec VPN over a VIF, or MACsec on supported dedicated 10/100 Gbps ports.