AWS Direct Connect and BGP

AWS Direct Connect (DX) provides dedicated private connectivity between on-premises networks and AWS, bypassing the public internet.

Virtual Interfaces (VIFs) #

A VIF is a logical partition of a Direct Connect connection. There are three types:

Private VIF — DXGW vs VGW:

• Connecting to a VGW directly supports a single VPC only.
• Connecting via a DXGW supports multiple VPCs across accounts and Regions — AWS best practice.

Transit VIF constraints:

• Must terminate at a DXGW.
• A single DXGW can associate with either VGWs or TGWs — not both simultaneously.

BGP on Direct Connect #

Direct Connect uses BGP as the routing protocol over all VIF types. Understanding which BGP attributes to configure — and on which side — controls traffic flow.

Influencing AWS → On-Premises Traffic (Outbound from AWS) #

AWS decides which DX connection to use when sending traffic to your on-premises network. The recommended mechanism is BGP community tags that set AWS’s Local Preference on the routes you advertise from on-prem (see Private VIF routing below).

AS_PATH prepending (adding extra AS hops to your on-prem advertisement) also works, but with important limits:

• Has no effect when DX connections terminate in a different AWS Region than the VPC.
• On Public VIFs, private ASNs in the prepended path are replaced by AWS ASN 7224, neutralising the prepend.
• For active/passive failover, BGP community tags are more reliable and AWS-recommended.

Influencing On-Premises → AWS Traffic (Inbound to AWS) #

When your on-prem network has multiple paths to reach AWS (e.g., two DX connections, or DX + VPN), control the preferred outgoing path using Local Preference on your own routers — standard BGP with no AWS-specific constraints.

DX Routing Priority #

When multiple routes to the same destination exist in an AWS route table, AWS evaluates them in this order:

1. Longest Prefix Match — most specific prefix wins (e.g., /24 beats /16)
2. Static over Propagated — manually added static routes take priority over BGP-propagated routes
3. BGP Propagated Route Type — among propagated routes: Direct Connect (BGP) > Site-to-Site VPN (static) > Site-to-Site VPN (BGP)
4. BGP Decision Process — within BGP routes of equal type:
   • Local Preference (higher wins)
   • AS_PATH length (shorter wins)
   • MED / Multi-Exit Discriminator (lower wins)
   • ECMP — if all attributes are equal, AWS load-balances across all available paths

Private VIF Routing Policy #

For Private VIFs, AWS evaluates routes in this order:

1. Longest Prefix Match
2. BGP attributes: Local Preference → AS_PATH length → MED → ECMP

BGP Community Tags — Setting AWS Local Preference #

When advertising your on-premises prefixes over a Private or Transit VIF, attach one of these community tags to tell AWS how much to prefer that path:

These tags are mutually exclusive — apply only one per prefix advertisement.

Example — active/passive failover:

• Primary DX: advertise prefixes tagged 7224:7300
• Backup DX: advertise the same prefixes tagged 7224:7100

AWS always prefers the primary; the backup only carries traffic if the primary BGP session drops.

Public VIF Routing Policy #

Public VIFs follow the same priority order as Private VIFs, plus two sets of community tags controlling advertisement scope.

Inbound Tags — Controlling How Far Your Prefixes Propagate (Customer → AWS) #

Outbound Tags — Identifying the Origin of AWS-Advertised Routes (AWS → Customer) #

AWS attaches these tags to routes it sends to your router. Use them to set local metrics or filter routes on your side:

DX Security Options #

Direct Connect itself is not encrypted. The following options add encryption over a DX connection.

VPN over Direct Connect #

Running IPsec VPN over DX combines DX’s dedicated bandwidth with encrypted tunnels.

Public IP VPN over DX

Use a Public VIF to reach the public IP endpoints of an AWS VPN gateway:

• Public VIF + Virtual Private Gateway (VGW) — VPN terminates at a VGW attached to a single VPC
• Public VIF + Transit Gateway (TGW) — VPN terminates at a TGW, enabling access to multiple VPCs

Private IP VPN over DX

AWS’s Private IP Site-to-Site VPN feature runs IPsec tunnels using private IP addresses (RFC 1918 or RFC 6598) for tunnel endpoints — no public IPs involved:

• Transit VIF + Transit Gateway — the only supported topology
• Offers higher route limits than standard DX: 5,000 outbound / 1,000 inbound routes (vs. 200 / 100 for standard DX)

MACsec (IEEE 802.1AE) #

MACsec provides Layer 2 point-to-point encryption on the physical cross-connect between your edge device and the AWS router at the DX colocation facility.

• Encrypts all traffic on the wire before it enters either network
• Only available on dedicated connections at 10 Gbps, 100 Gbps, or 400 Gbps — not on hosted connections or 1 Gbps connections
• Requires a MACsec-capable router on your end; key exchange uses a pre-shared CKN/CAK pair

Jumbo Frame Support #

Direct Connect supports jumbo frames (MTU up to 9,001 bytes) on Private and Transit VIFs. Public VIFs are limited to 1,500 bytes MTU. Jumbo frames must be enabled on both the VIF and the associated VGW or TGW.