Exam objective 1.3 tests how to design hybrid network architectures that connect a company’s own data centre to the AWS cloud. This chapter explains the three main ways to make that connection—VPN, Direct Connect, and Direct Connect Gateway—so you can pick the right tool for each job and pass the ANS-C01 exam.
Jump to a section
A simple way to picture Hybrid Connectivity: VPN, Direct Connect, and DX Gateway
A building manager is the person responsible for connecting a company’s head office to its brand-new warehouse across town. The manager needs to move files, inventory lists, and live security camera feeds between the two buildings securely, reliably, and at high speed. They have three options: a shared messenger bike, a dedicated courier van, or a permanent conveyor belt.
The shared messenger bike is like a VPN. It uses public roads (the internet) but the courier wears a lockbox with a unique key (encryption). Anyone on the street can see the bike, but they can’t open the box. It’s cheap and quick to set up, but traffic jams and weather (network congestion and latency) slow it down. It’s fine for sending occasional documents, not for a constant stream of heavy deliveries.
The dedicated courier van is like AWS Direct Connect. The manager hires a specific van that drives along its own reserved lane on the highway (a private, physical connection). This avoids traffic and the van is faster and more consistent than the bike. It costs more because the manager must book the van and the lane in advance, often requiring several weeks to arrange.
The permanent conveyor belt is like a Direct Connect Gateway. It’s a fixed, high-capacity link between the two buildings that never shares space with anyone else. The manager can connect multiple departments (virtual private clouds) at the head office to multiple zones of the warehouse (on-premises networks) using one single, always-on belt. This is the fastest and most reliable method, but it’s expensive and takes months to install. The manager’s job is to choose the right mix—bikes for low-priority backups, vans for daily operations, and the conveyor belt for critical live systems.
Hybrid connectivity means linking your own physical data centre (the one you own or rent in a building full of servers) to the AWS cloud (Amazon’s giant network of computers and services). It’s called ‘hybrid’ because you operate part of your IT in your own facility and part in the cloud, and they need to talk to each other.
Before hybrid connectivity, companies had two separate worlds. Your on-premises (on-prem) network, which is all the computers, switches, and cables in your building, was completely isolated from AWS. To share data, you might have emailed files or used a slow, public internet connection. This was insecure, slow, and unreliable for critical applications. Hybrid connectivity fixes this by creating a dedicated, secure pathway between the two.
There are three core services: AWS VPN, AWS Direct Connect, and the Direct Connect Gateway. Let’s define each one from the ground up.
AWS VPN (Virtual Private Network) A VPN is a secure tunnel over the public internet. Think of it as a secret passage through a busy city. You encrypt your data—meaning you scramble it so that only the intended destination can read it—before it travels across the internet. AWS offers two types
Site-to-Site VPN: Connects your entire office network to your Amazon Virtual Private Cloud (VPC), which is your private section of the AWS cloud. You set up a VPN connection on your side using a device called a customer gateway (a physical router or software appliance), and AWS provides a virtual private gateway (VGW) on its side.
Client VPN: Connects individual users (like a remote worker’s laptop) to the AWS network. Each user runs a small software client on their computer.
VPN is quick to set up (often an hour) and cheap because it uses your existing internet connection. But it’s limited by the speed and reliability of your internet service provider. If your internet goes down, so does your VPN. Latency (delay) can also be unpredictable.
AWS Direct Connect (DX) Direct Connect is a physical, private cable that runs from your data centre directly into an AWS Direct Connect location (a special data centre where AWS has equipment). You don’t share this cable with anyone else—it’s dedicated to your traffic. It’s like having your own private highway instead of sharing the public road.
To set up Direct Connect, you work with an AWS Direct Connect Partner or a telecoms company. They run a physical fibre-optic line from your building to the nearest Direct Connect location. Then you create a virtual interface (VIF) that links this cable to your VPC. Direct Connect gives you consistent, high-speed performance (e.g., 1 Gbps or 10 Gbps) and lower latency than internet-based VPN. However, it takes weeks to months to provision, and you pay for the port (the physical connection point) regardless of how much you use it.
Direct Connect Gateway (DX Gateway) A Direct Connect Gateway is a networking hub that lets you connect multiple AWS accounts and multiple VPCs across different AWS regions (geographic areas like US East or EU West) using a single Direct Connect connection.
Without a DX Gateway, if you had a Direct Connect line to a VPC in one region and wanted to reach a VPC in another region, you’d need a second Direct Connect line. The DX Gateway allows you to attach up to 10 VPCs (or more with special approval) in different regions, so one physical cable serves many virtual networks. It acts as a central exchange, simplifying your network design and saving costs.
How They Fit Together You can use VPN as a backup for Direct Connect (called a ‘failover’ or ‘secondary’ connection) to provide redundancy—if the private cable fails, traffic automatically switches to the VPN. This is a common exam pattern. You can also combine VPN with Direct Connect to encrypt data that goes over the private line (optional, for extra security).
In summary: VPN is fast to set up, cheap, and uses the internet; Direct Connect is faster, more reliable, private, and takes time; DX Gateway extends Direct Connect to work across multiple regions and VPCs.
Assess Requirements
Identify the business needs: bandwidth, latency tolerance, budget, security level, and number of VPCs or regions involved. This determines whether you choose VPN, Direct Connect, or both.
Provision the Physical or Software Link
For VPN: configure a customer gateway device on your side and create a Site-to-Site VPN connection in AWS (takes minutes). For Direct Connect: contact a telecoms provider to install a physical fibre cable to a Direct Connect location (takes weeks).
Create a Virtual Interface (VIF)
For Direct Connect: create a private VIF to connect the physical cable to a Virtual Private Gateway or Direct Connect Gateway. This defines which VPC the traffic can reach. For VPN: no VIF needed—the tunnel itself is the interface.
Configure Routing with BGP
Set up BGP peering between your on-prem router and AWS. This lets both sides automatically learn about each other's network routes. Misconfigured BGP is a common cause of connectivity failure.
Verify Connectivity and Tune Performance
Test that traffic flows correctly (e.g., ping an EC2 instance from your data centre). Monitor latency and throughput using Amazon CloudWatch. Adjust BGP timers if the connection is flapping (going on and off repeatedly).
Set Up Redundancy and Failover
Add a backup VPN connection if using Direct Connect. Configure BGP route preferences (e.g., AS_PATH prepending) to ensure primary traffic goes over Direct Connect and only switches to VPN if the primary fails.
Scale with Direct Connect Gateway
If later you add more VPCs in different regions, attach them to the Direct Connect Gateway instead of creating new Direct Connect cables. This centralises management and reduces cost.
An IT professional, let’s call her Priya, works for a financial services company called FinanceCo. FinanceCo has its main data centre in London and uses AWS for disaster recovery—essentially a backup site if the London data centre goes down. Priya’s job is to build a hybrid connection so that the London servers can synchronise their database with AWS every few minutes.
Step 1: Priya assesses requirements. The database synchronisation needs low latency (under 10 milliseconds) and high bandwidth (5 Gbps) because they replicate terabytes of data daily. Internet VPN won’t guarantee that speed. She chooses AWS Direct Connect. She contracts with a telecoms provider to install a 10 Gbps fibre link from FinanceCo’s London data centre to the nearest AWS Direct Connect location in London. This takes six weeks.
Step 2: She provisions two virtual interfaces (VIFs)—one to connect to the primary VPC (where the database lives) and one for a backup VPC in a different AWS Availability Zone (a separate data centre within the same region). She uses a Direct Connect Gateway so she can later add VPCs in the Ireland region if needed.
Step 3: For extra resilience, she sets up a Site-to-Site VPN as a backup connection. If the Direct Connect line fails, traffic automatically fails over to the VPN using BGP routing (Border Gateway Protocol, a system that decides the best path for data). The VPN uses the company’s existing internet link, so it’s slower but keeps the database synchronisation running.
Step 4: Priya monitors the connection using Amazon CloudWatch (a monitoring service) and sets an alarm if latency exceeds 20 milliseconds. She also tests failover monthly by intentionally disabling the Direct Connect cable and verifying the VPN takes over in less than 30 seconds.
Step 5: Six months later, FinanceCo acquires a smaller company with its own data centre in Manchester. Priya extends the Direct Connect Gateway to include that new facility. She creates a new VPC in the Ireland region for the merged company’s applications. The same DX Gateway handles all traffic—London, Manchester, and AWS—without needing a second physical cable.
What Priya actually does daily
Opens the AWS Management Console (a web page) to check the status of Direct Connect virtual interfaces.
Reviews BGP route tables to ensure traffic is going via the private line, not the backup VPN.
Communicates with the telecoms provider to schedule upgrades or troubleshoot physical link issues.
Tests disaster recovery scenarios by failing over on purpose.
The key actions she performs include configuring VPN tunnels, attaching VPCs to the DX Gateway, and managing route advertisements so that machines on-prem know how to reach each AWS VPC.
The ANS-C01 exam tests your ability to design hybrid connectivity solutions that meet specific requirements for security, cost, reliability, and performance. The questions are scenario-based, meaning you’re given a story about a company’s needs, and you must choose the correct combination of services.
What the exam loves to test
Site-to-Site VPN vs Direct Connect: Which do you use when the requirement says ‘lowest cost’ or ‘quickest to provision’? Answer: VPN. Which do you use when it says ‘consistent low latency’ or ‘high bandwidth’? Answer: Direct Connect.
Direct Connect Gateway vs using multiple Direct Connect connections: The exam will present a scenario with multiple VPCs in different regions. The correct answer is almost always ‘use a Direct Connect Gateway’ because it reduces complexity and cost.
BGP and routing: You must know that Direct Connect uses BGP to exchange routes between your on-prem network and AWS. The exam will ask you to configure BGP timers (like keepalive and hold timer) or recognise which AS numbers are used.
VPN as a backup for Direct Connect: This is a classic design pattern. The exam will describe a company that needs high availability for its hybrid connection. The correct answer is ‘use Direct Connect as primary and AWS Site-to-Site VPN as a backup’.
Virtual Private Gateway (VGW) vs Transit Gateway (TGW): A VGW attaches to a single VPC; a Transit Gateway can connect many VPCs and your on-prem networks together. The exam will ask you which to use for multi-VPC on-prem connectivity. Transit Gateway is usually the better answer.
Common traps
The exam might say ‘low latency and cost-effective’ but the word ‘cost-effective’ can mean ‘cheapest’ or ‘good value for performance’. Read carefully: if latency is critical, Direct Connect is correct even though it costs more.
A question might describe ‘a company that needs to connect 50 branch offices to AWS’. The trap answer is ‘50 Direct Connect connections’. The correct answer is ‘Transit Gateway with AWS Site-to-Site VPN connections from each branch’.
The exam may give two viable options and one clearly wrong option. The wrong option often involves using a public internet connection without encryption. Always prefer encrypted options (VPN) when security is mentioned.
Specific concepts to memorise
The difference between a private VIF (connects to your VPC) and a public VIF (connects to AWS public services like S3, but is outdated—now use transit VIFs).
Direct Connect speed limits: 1 Gbps, 10 Gbps, and 100 Gbps.
VPN connection limitations: 1.25 Gbps per tunnel (though you can use multiple tunnels).
BGP attributes: AS_PATH, LOCAL_PREF, and MED.
The requirement for MACsec (a security standard) encryption on Direct Connect if you need encrypted private connection.
The exam will also test your knowledge of how to order services. For example, you must first set up a Direct Connect location, then create a virtual interface, then attach it to a Direct Connect Gateway, then attach the gateway to a VPC. The order matters in multiple-choice questions.
Finally, expect questions about redundant connections. If the scenario says ‘the connection must survive a single failure’, the correct design is two Direct Connect connections or one Direct Connect plus one VPN. Never rely on a single link.
AWS Site-to-Site VPN creates a secure encrypted tunnel over the public internet and is the quickest and cheapest hybrid connectivity option to set up.
AWS Direct Connect provides a dedicated private physical cable from your data centre to AWS, offering consistent low latency and high bandwidth, but takes weeks to provision.
A Direct Connect Gateway lets you use one Direct Connect connection to reach multiple VPCs across different AWS regions, eliminating the need for separate cables.
When exam scenarios mention 'highest availability', design a hybrid connection with Direct Connect as the primary link and a Site-to-Site VPN as an automatic failover backup.
Transit Gateway is the modern hub for connecting many VPCs and on-prem networks together; it replaces the older Virtual Private Gateway for multi-VPC designs.
Direct Connect virtual interfaces (VIFs) come in three types: private (to VPCs), public (to AWS services, now legacy), and transit (to Transit Gateway).
BGP (Border Gateway Protocol) is the routing protocol used by both VPN and Direct Connect to exchange network paths between your data centre and AWS.
These come up on the exam all the time. Here's how to tell them apart.
AWS Site-to-Site VPN
Uses public internet as transport
Set up in minutes to hours
Lower cost, pay for use
AWS Direct Connect
Uses dedicated private fibre cable
Set up in weeks to months
Higher cost, pay for port capacity
Virtual Private Gateway
Attaches to a single VPC only
Used for VPN or Direct Connect
Works within one AWS region
Direct Connect Gateway
Attaches to multiple VPCs across regions
Works only with Direct Connect private VIFs
Acts as a central hub for multi-region connectivity
Site-to-Site VPN
Connects entire site network to AWS
Uses on-prem router as customer gateway
Always-on site-to-site tunnel
Client VPN
Connects individual users to AWS
Each user runs client software
On-demand per-user connection
Direct Connect Private VIF
Connects to Virtual Private Gateway
Used for single VPC access
Older method for Direct Connect
Direct Connect Transit VIF
Connects to Transit Gateway
Enables multi-VPC connectivity
Modern method, recommended by AWS
Mistake
AWS Direct Connect uses the public internet, just with a faster speed.
Correct
Direct Connect is a private, physical cable that never touches the public internet. It runs through dedicated fibre to a specialised AWS Direct Connect location.
Many beginners assume all connections go over the internet because that's how most people connect to websites. The physical, private nature of Direct Connect is counterintuitive.
Mistake
A Direct Connect Gateway and a Virtual Private Gateway are the same thing.
Correct
A Direct Connect Gateway connects multiple VPCs across regions to a single Direct Connect line. A Virtual Private Gateway connects a single VPC to a VPN or Direct Connect.
The names sound similar and both are gateways that connect to AWS, so beginners confuse their roles.
Mistake
You can set up Direct Connect in a few hours, just like a VPN.
Correct
Direct Connect requires physical fibre installation by a telecoms provider, which typically takes weeks to months to arrange.
People hear 'connection' and assume it's a software configuration, not a physical cable that needs to be installed.
Mistake
A Site-to-Site VPN is always slower than Direct Connect.
Correct
A VPN can sometimes match Direct Connect speed if the internet link is fast, but it suffers from variable latency and less reliability. Direct Connect provides consistent, low-latency performance.
Beginners think 'private = always faster', but in real life, a well-provisioned internet link can be fast. The key difference is consistency and reliability.
Mistake
You must use encryption on Direct Connect to make it secure.
Correct
Direct Connect is physically private, so data isn't exposed to the public internet. Encryption (like MACsec) is optional and adds security, but the link itself is already secure from internet snooping.
Many people think private = automatically encrypted. Direct Connect is physically separated but data isn't automatically encrypted in transit; it's just not accessible over the public internet.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, and this is a best practice for high availability. Use Direct Connect as your primary link and VPN as a backup. Routing protocols like BGP automatically switch traffic if the primary fails.
Direct Connect offers speeds up to 100 Gbps with consistent low latency, while VPN typically tops out around 1.25 Gbps per tunnel and latency varies with internet conditions. Direct Connect is much faster and more reliable for heavy workloads.
No, you can attach a Direct Connect private VIF directly to a Virtual Private Gateway for one VPC. The Direct Connect Gateway is needed only when you want to connect multiple VPCs or multiple AWS regions through a single Direct Connect connection.
No, it does not. The cable is physically private, so data isn't exposed to the internet. However, you can optionally add encryption using MACsec for an extra layer of security if required by compliance standards.
No, a VPN connects to a Virtual Private Gateway or Transit Gateway, not directly to a Direct Connect Gateway. The Direct Connect Gateway only works with Direct Connect virtual interfaces.
Choose VPN if you need a hybrid connection quickly (within hours), have a limited budget, or only need moderate bandwidth with occasional use. Direct Connect is better for high-volume, latency-sensitive workloads.
You've finished Hybrid Connectivity: VPN, Direct Connect, and DX Gateway. Continue through the ANS-C01 study guide to build a complete picture of the exam.
Done with this chapter?