Hey, everyone.
And welcome back.
Now, at this stage, we have been discussing about transit Gateway from the VPC attachment perspective.
Now, in today's video, we are going to discuss about one more attachment that is supported at the
transit gateway level, which is the VPN attachments.
So at a high level overview, the VPN attachment provides the option of creating the IPsec VPN connection
between your remote network and the transit gateway over the Internet.
And this can be seen from the diagram where on the right hand side you have the corporate data center
where you have established a IPsec VPN tunnel from the corporate data center towards the transit gateway
through the Internet.
Now, one of the benefits here again, is that the traffic that is going to flow is going to be encrypted.
Now, when we discuss about this kind of a functionality, there are certain points that we need to
remember.
First point to note is that a single tunnel has a maximum throughput of 1.25 GBS.
However, you have an option to establish multiple set of tunnels as well.
So in case if you establish multiple VPN tunnels, you can make use of the SMP enabled Transit Gateway,
which will allow you to scale beyond the maximum limit of 1.25 GBS.
Now, in case if you are not aware of ICMP at an overview, ICMP stands for Equal Cost Multipath Routing
and is a routing strategy where packets are forwarded to a single destination or multiple best path
with equal routing priority.
So let's go ahead and discuss more in detail about the ICAP and look into how the architecture would
really look like.
Now, if you look into this specific screenshot, you have multiple tunnels that are been established
and each tunnel, as we know, supports 1.25 GB over here.
So you can make use of ICMP to increase the overall bandwidth.
Now when you use the ICMP, one important part to remember is that the static routing is not really
supported, so you have to use the dynamic base routing option.
Second important point is that when you create a transit gateway, you must enable the VPN ICMP support.
So let's quickly look into it.
Now, whenever you go ahead and create a transit gateway, there is an explicit option of VPN, ICMP
support.
So this is the checkbox that you have to ensure is enabled in case if you would like to use the ICMP
grid.
Now let's also discuss about the actual VPN attachment where if you want to attach a VPN connection
to the transit gateway, you must specify the customer gateway.
This can also be seen in the screenshot associated with the VPN attachment.
You have a customer gateway, you can attach the existing customer gateway, or you can even use the
new customer gateway, as we are also discussing in the routing options.
In fact, this is related that in the routing options you must choose the dynamic and static is not
supported.
Now in case if you make use of the static VPNs, you have to add the static routes to the transit gateway
as well.
Now let's also quickly look into it.
So in the transit gateway, if you create an attachment of type VPN, it will ask you for the customer
gateway.
It can be existing.
You can also create a newer one and in the routing options you have a static and dynamic which you can
select from.
Now, let's also discuss some of the important configurations that you have to ensure.
If you have a ECP with multiple VPN tunnels associated with a transit gateway.
Now, one important thing that you have to take a note of is that you have to ensure that the customer
gateway is configured to perform ICMP for the traffic going out to a place for all the VPN tunnels.
Second important point is that you have to confirm that the customer gateway is advertising the on premise
prefix to the bus with the same BGP as path attribute.
We'll be discussing this in just a moment.
And for us to choose all the available ICMP path, the S path and the S number must match.
So let's look into an example configuration.
So let's say that you plan to use ICMP with a total of two VPN connections.
So the s number of your customer gateway is 65270.
For an example.
In this scenario you must configure your VPN as follows since there are two VPN.
First you have a VPN, A in VPN A you have a terminal one with the S spot and you have 65270.
Then you have a terminal two with the same path.
Then you have a VPN B which also has a terminal one and terminal two with the same as PATH.
Now when you have a configuration something similar to this, it sends out traffic with ICMP on all
the four VPN tunnels that you have established.
Great.
So these are some of the important pointers related to the VPN attachment at the transit gateway level.
And with this will conclude today's video.