How do you securely and reliably connect your office network, sitting in a physical building, to a virtual network in the cloud? This is the core challenge of hybrid connectivity, and solving it is a major part of the ANS-C01 exam. You need to understand the three main tools AWS gives you for this job: VPN, Direct Connect, and Transit Gateway, and more importantly, when to use each one.
Jump to a section
A simple way to picture Deploying Network Connectivity Services: VPN, Direct Connect, Transit Gateway
Because your office building is full of people who need to send sensitive documents to a partner company across town, you first set up a simple, encrypted postal system. This leads to the need for a more permanent, private tunnel between the two buildings for large shipments.
Your office building is your company's network inside a cloud (a Virtual Private Cloud, or VPC). The partner company is your on-premises data centre. The simple encrypted postal system is a VPN (Virtual Private Network). It uses the public internet (the regular streets) to send data, but it wraps each letter in a secure envelope (encryption), so no one can read it. It's cheap and quick to set up, but the speed and reliability depend entirely on the traffic on the public streets.
For large, important shipments (big data transfers), you need a more reliable solution. This is AWS Direct Connect. Instead of using the public streets, you hire a private courier company to dig a dedicated tunnel directly from your office's loading dock to the partner company's loading dock. This tunnel is a dedicated, private, physical connection that is much faster, more consistent, and more secure because it bypasses the public internet entirely.
Finally, your office building merges with two other buildings in different parts of the city. You need to connect all three. Instead of setting up separate postal systems between each pair (which is messy and hard to manage), you hire a central mailroom manager for all buildings. This central manager is AWS Transit Gateway. Every building (VPC or on-premises data centre) connects to this central hub only, and the hub routes mail (network traffic) between all of them. Adding a new building is simple: just connect it to the central hub once.
Think of your company's on-premises data centre (the servers and network gear sitting in your office building) as your home base. You also have resources running in the AWS Cloud, inside a Virtual Private Cloud (VPC). A VPC is your own private, isolated section of the AWS cloud where you launch virtual servers. The problem is that these two worlds are separate. To make them talk to each other, you need to build a bridge. AWS offers three main types of bridges: VPN, Direct Connect, and Transit Gateway.
First, the Virtual Private Network, or VPN. A VPN is a secure connection over the public internet. Imagine a secret tunnel built on a public highway. The 'public highway' is the internet. The 'secret tunnel' is an encrypted connection. When data travels through a VPN, it is wrapped in a protective layer called encryption, which scrambles the data so even if someone intercepts it, they cannot read it. A VPN uses something called IPSec (Internet Protocol Security) to set up this encryption. It is fast to deploy and cheap because it uses your existing internet connection. However, because it relies on the public internet, its performance can vary. If the internet is congested, your VPN will be slow. It is also less consistent than a dedicated line. On the exam, remember that a VPN is your go-to for a low-cost, moderately secure, quick-to-set-up connection.
Second, AWS Direct Connect. This is the private, direct line. Instead of using the public internet, you pay for a dedicated physical cable that runs from your on-premises data centre directly to an AWS Direct Connect location (a physical facility where cloud providers have their gear). This cable is a dedicated, private, and secure connection. Because it bypasses the public internet, it provides more consistent network performance, higher bandwidth, and lower latency. It is much more expensive than a VPN and takes weeks to set up because it involves physical infrastructure and coordinating with a telecom provider. AWS Direct Connect is used for large data transfers, real-time data feeds, or any application where a consistent, reliable connection is business-critical.
Third, AWS Transit Gateway. This is the central hub for your network. Without it, if you have three VPCs, one on-premises data centre, and a partner company's network to connect to, you would need to create many individual VPN connections between each pair. This is a spiderweb of connections called a 'mesh' and is very difficult to manage, scale, and secure. Transit Gateway solves this. You create one Transit Gateway, and then you connect every single network (VPC, on-premises data centre via VPN or Direct Connect) to that single Transit Gateway. The Transit Gateway then routes traffic between all of them. It acts like a network router in the cloud. This massively simplifies network management. You can also apply centralised routing policies from the Transit Gateway, controlling exactly which networks can talk to each other.
For the ANS-C01 exam, you must understand how these three services interact. You can attach both VPN connections and Direct Connect connections to a Transit Gateway. This is a common exam scenario called a 'dynamic routing' setup. You use a routing protocol called BGP (Border Gateway Protocol) to dynamically exchange routing information between your on-premises network, the Direct Connect connection, and the Transit Gateway. BGP is like a GPS for your network traffic, telling it the best path to get from one location to another. If the Direct Connect line goes down, BGP automatically detects this and reroutes traffic over the VPN backup (which is also attached to the Transit Gateway). This is called 'failover'.
In summary, VPN is your cheap, fast, secure-enough option over the internet. Direct Connect is your expensive, high-performance, private option. Transit Gateway is your central hub that lets you manage all these connections (VPNs and Direct Connects) to multiple VPCs and on-premises environments from one place. The exam will test you on which scenario requires which service, and how to combine them for high availability and security.
Assess Connectivity Requirements
Determine the primary use case: is it for occasional secure access (VPN) or for high-bandwidth, consistent data transfer (Direct Connect)? This step also involves estimating bandwidth needs and deciding if a centralised hub (Transit Gateway) is needed for multiple VPCs. This matters because choosing the wrong service first wastes time and money.
Deploy the VPN Connection
Create a Customer Gateway object in AWS to represent the on-premises VPN device. Create a Virtual Private Gateway on the VPC. Then, create a Site-to-Site VPN connection and download the configuration. This step establishes the encrypted IPSec tunnel over the internet. It is the fastest connectivity method to deploy.
Order and Configure AWS Direct Connect
Submit a Direct Connect order through the AWS console. This triggers a physical cable installation process by a telecom provider to a Direct Connect location. Once the physical connection is active, create a Virtual Interface (VIF) to link the connection to a VPC or Transit Gateway. This step is critical for achieving dedicated, stable performance.
Deploy AWS Transit Gateway
Create a Transit Gateway in the desired AWS region. Attach all VPCs that need to be connected to the Transit Gateway. Then, attach the VPN and Direct Connect Virtual Interfaces to the same Transit Gateway. This step centralises all routing into one manageable hub, dramatically simplifying the network topology.
Configure Routing and Failover
Enable BGP dynamic routing on both the VPN and Direct Connect connections. In the Transit Gateway route table, set the route for the on-premises network to point to the Direct Connect attachment as the primary path, and the VPN attachment as the backup. This step ensures automatic failover: if the Direct Connect fails, BGP updates routes to send traffic over the VPN, ensuring business continuity.
An IT professional is tasked with connecting 'MegaCorp's' headquarters in London to their new workloads in AWS. The first step is to create a Site-to-Site VPN connection. The IT pro configures a Customer Gateway (representing the on-premises VPN device) and a Virtual Private Gateway (representing the AWS side of the VPN) on the VPC. They then configure the on-premises firewall to establish the encrypted IPSec tunnel. This works, but the finance team complains the connection is slow for large data uploads.
To solve this, the IT pro initiates an order for AWS Direct Connect. This involves:
Working with a telecom provider to install a physical fibre cable from the office to a Direct Connect location in London.
Once the cable is installed, creating a Virtual Interface (VLAN) on the Direct Connect connection to link back to the VPC.
Testing the connection to ensure it is stable and fast.
Now, the company acquires a smaller firm and runs its servers in a second AWS account. They need to connect the London office, the original AWS account's VPC, and the new AWS account's VPC. Creating a spiderweb of VPNs would be a management nightmare. So, the IT pro deploys an AWS Transit Gateway. They:
Create a Transit Gateway in the main AWS account.
Attach the original VPC to the Transit Gateway.
Attach the new company's VPC (through a cross-account resource share) to the same Transit Gateway.
Attach the Direct Connect Virtual Interface and the backup VPN connection to the Transit Gateway.
Finally, they configure the Transit Gateway route tables. They set up the Direct Connect as the primary route for traffic to the on-premises data centre, and the VPN as the backup. They also add a static route for the new company's VPC so they can talk to each other. They test failover by simulating a failure of the Direct Connect line. BGP automatically detects the failure and shifts traffic over the VPN backup. This ensures cost savings (cheap backup) and reliability (private primary line) are achieved in one centralised, managed hub.
The ANS-C01 exam aggressively tests your ability to compare and contrast the three core connectivity services. It is not enough to know what each one is; you must know the specific constraints, use cases, and the order of operations. The examiners love to set traps around routing and failover.
The key concepts they test with pattern traps are: - BGP ASN Requirements: The exam will test that a Direct Connect public VIF or a VPN must use a public or private BGP Autonomous System Number (ASN). A common trap is to use a reserved or unassigned ASN. You must use a public ASN (not in the private range) or a private ASN (from the 64512-65535 range). - Transit Gateway Route Propagation: A common question involves a VPC attached to a Transit Gateway but not being able to reach the on-premises network. The trap is that the route propagation for the VPN attachment to the Transit Gateway route table is not enabled. The correct answer is to enable propagation. - Direct Connect Virtual Interface Types: They test the difference between a Private VIF (for connecting to a VPC) and a Public VIF (for accessing public AWS services like S3). A trap question might ask for a private connection to S3, which is wrong—you need a public VIF or a Gateway VIF. - VPN CloudHub: A classic exam scenario involves connecting multiple remote offices using multiple VPN connections. The correct architecture is to terminate all VPN connections on a single Virtual Private Gateway and use dynamic routing (BGP). This is called a VPN CloudHub. A common trap is suggesting a mesh of VPNs between offices, which is more complex and not the recommended design. - Transit Gateway Peering: The exam tests when to use Transit Gateway Peering (connecting two Transit Gateways in different regions). The trap is thinking you can connect VPCs in different regions using a single Transit Gateway. A Transit Gateway is region-specific. To connect VPCs across regions, you need to peer two Transit Gateways from different regions. - High Availability Design: A key concept is designing for redundancy. You are expected to know that a single VPN tunnel is a single point of failure. The correct answer is to deploy two VPN tunnels using two different Customer Gateway devices on-premises, or two separate VPN connections for high availability. Similarly, for Direct Connect, you need connections to two separate Direct Connect locations for true redundancy.
Trap patterns to internalise: - The question describes a 'low cost' requirement and offers Direct Connect as an option. The trap is selecting Direct Connect. The correct answer is VPN. - The question describes a 'consistent, high-bandwidth' requirement and offers VPN. The trap is selecting VPN. The correct answer is Direct Connect. - The question describes connecting three VPCs and an on-premises network and suggests creating six individual VPN connections. The trap is that this is the only valid answer. The correct answer is to use a Transit Gateway to centrally manage the connections.
A VPN uses the public internet with encryption, is cheap and quick to deploy, but performance suffers from internet congestion.
AWS Direct Connect is a dedicated, private, physical cable offering consistent performance and is used for large-scale or latency-sensitive workloads.
AWS Transit Gateway acts as a central network hub to simplify connecting multiple VPCs and on-premises networks together.
For high availability, always deploy two VPN tunnels or two Direct Connect connections, ideally across separate physical locations.
BGP (Border Gateway Protocol) is the dynamic routing protocol used to exchange routes between your on-premises network and AWS, enabling automatic failover.
A Transit Gateway can terminate both a Direct Connect and a VPN, allowing you to use the Direct Connect as primary and the VPN as a cost-effective backup.
These come up on the exam all the time. Here's how to tell them apart.
VPN (Site-to-Site)
Uses the public internet for data transit
Cheaper and faster to deploy (minutes to hours)
Performance is variable and depends on internet congestion
AWS Direct Connect
Uses a dedicated, private physical cable
Expensive and takes weeks to deploy
Provides consistent, low-latency, high-bandwidth performance
Mistake
A VPN and Direct Connect provide the same level of performance and reliability because they both connect my network to AWS.
Correct
Direct Connect provides a dedicated, private, physical connection that offers consistent performance, lower latency, and higher reliability because it bypasses the public internet. A VPN relies on the public internet, so its performance can vary due to congestion.
This mistake happens because beginners see both as 'connections to the cloud' without understanding the fundamental difference in the underlying physical infrastructure (dedicated fibre vs. public internet).
Mistake
To connect multiple VPCs to each other and to an on-premises network, I need a separate VPN or Direct Connect for each pair (a full mesh).
Correct
An AWS Transit Gateway allows you to connect all VPCs and on-premises networks to a single central hub. You only need one VPN or Direct Connect from the on-premises network to the Transit Gateway, and the Transit Gateway handles routing to all VPCs.
This error comes from thinking of networking as point-to-point connections, similar to how you might connect individual computers at home. The concept of a centralised hub-and-spoke model is a new paradigm for beginners.
Mistake
If my Direct Connect line fails, traffic will automatically fail over to my VPN without any configuration.
Correct
Automatic failover requires configuration. You must set up both the Direct Connect and VPN connection to use the same dynamic routing protocol (BGP) over a Transit Gateway. BGP will then detect the failure and update the routing table to send traffic over the VPN. Without this setup, traffic will be dropped.
This misconception arises from a general desire for a 'plug-and-play' experience. Beginners don't realise that even automated failover requires careful planning and configuration of routing protocols.
Mistake
AWS Direct Connect is a software service I can order and set up in a few hours from the AWS console.
Correct
Direct Connect is a physical, dedicated cable that requires weeks to deploy. You must work with a telecom provider to install the physical fibre to a Direct Connect location, and then create virtual interfaces. It is a hardware procurement process, not just a software configuration.
This confusion stems from the fact that almost everything else in AWS (servers, databases, storage) is a software-defined service you can spin up instantly. Beginners naturally assume all AWS services follow that same model.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, this is a common and recommended high-availability architecture. You attach both the Direct Connect Virtual Interface and the VPN connection to the Transit Gateway. BGP routing automatically fails over traffic to the VPN if the Direct Connect link goes down.
A Private VIF connects your on-premises network directly to a VPC, giving it access to private IP addresses inside that VPC. A Public VIF allows you to access all public AWS services (like S3 or DynamoDB) over the Direct Connect line, but it does not connect you to your VPC's private network.
You do not need a VPN for primary traffic, but many architects use a VPN as a lower-cost backup connection for high availability. If your Direct Connect line fails, the VPN can take over to maintain connectivity, albeit with lower performance.
No, you can connect multiple VPCs using VPC Peering (direct connections between VPCs). However, Transit Gateway is superior when you have three or more VPCs or when you need to connect an on-premises network, because it centralises routing and scales more easily than a mesh of peering connections.
Yes, but you need to use a Transit Gateway in the region where the Direct Connect is terminated, and then peer that Transit Gateway with another Transit Gateway in the target region. Direct Connect itself is a regional service, so it initially connects to a VPC in the same region only.
BGP (Border Gateway Protocol) is the routing protocol used on the internet to exchange routing information between different networks. In the context of VPN and Direct Connect, BGP dynamically tells AWS and your on-premise router which IP addresses are reachable on each side. This enables automatic failover because the route can change instantly if a connection goes down.
You've finished Deploying Network Connectivity Services: VPN, Direct Connect, Transit Gateway. Continue through the ANS-C01 study guide to build a complete picture of the exam.
Done with this chapter?