Customer routers and customer gateways
Both a Site-to-Site VPN and a Direct Connect circuit terminate on equipment you own. What differs is whether AWS needs a resource representing it.
Site-to-Site VPN: a customer gateway
Section titled “Site-to-Site VPN: a customer gateway”- A customer gateway (CGW) is an AWS resource describing your on-premises endpoint — its public IP address, and its BGP ASN if you are using dynamic routing.
- The physical device it describes is your router or software VPN appliance.
- You configure three things: the virtual private gateway or transit gateway in AWS, the customer gateway resource in AWS, and the device itself.
- Each VPN connection provides two tunnels; configure both, or the connection has a single point of failure that stays invisible until AWS performs maintenance on one endpoint.
- Routing can be static or BGP. BGP is what makes failover automatic.
Direct Connect: your router, no customer gateway
Section titled “Direct Connect: your router, no customer gateway”- Direct Connect uses your on-premises router directly. There is no customer gateway resource.
- You order the circuit through your network provider or an AWS Direct Connect Partner.
- BGP is required, not optional — every virtual interface has a BGP session.
- You configure virtual interfaces: a private VIF to reach VPCs, a public VIF to reach AWS public endpoints such as Amazon S3, a transit VIF to reach a transit gateway.
Side by side
Section titled “Side by side”| Site-to-Site VPN | Direct Connect | |
|---|---|---|
| AWS-side resource for your equipment | Customer gateway | None |
| Path | Public internet | Dedicated circuit |
| Routing | Static or BGP | BGP only |
| Configured in AWS and on-premises | Both | Both, plus a provider |
| Capacity | Per-tunnel; aggregate with ECMP | 1, 10, 100 or 400 Gbps on a dedicated connection; sub-port speeds on a hosted connection |
| Encryption | IPsec, always | Not by default |
Running both
Section titled “Running both”A Direct Connect circuit with a VPN backup — the standard hybrid arrangement — needs both: your router for the circuit, and a customer gateway resource for the VPN. Running an IPsec VPN over Direct Connect, for encryption rather than for backup, needs both as well.