Adding VMware Transit Connect to Egress VPC (Part 3)
Gilles Chekroun
UPDATE 6 NOV 2020: Github terraform code here
Finally, here is Part 3 of this blog "series" around Egress VPC.
Part 1 is here and Part 2 is here
After setting up the Egress VPC in part 1 and adding a VPN connected SDDC in part 2 I want to connect the SDDC and the Apps VPCs via a VMware Transit Connect a.k.a. VMware managed Transit gateway.
Lab Setup
Creating an SDDC Group
- Create an SDDC group and Attach the SDDC. This step will create the vTGW.
- Under "VPC Connectivity" tab, configure the Customer AWS account number so the vTGW resource can be shared.
- On Customer AWS console, go to RAM (Resource Access Manager) and look for "Resources shared with me"
- Accept the vTGW resource
Connecting Apps VPCs
Checking the vTGW routes learned in the SDDC
Adding CGW Firewall rules for vTGW
The CGW FW rules will allow traffic to and from the vTGW attached VPCs. We have now a new System Group that includes the VPC prefixes. These rules need to be "Applied to" the Direct Connect interface. It's a bit confusing for now but this is where the SDDC attachment as "VPC" lives. We are looking to rename it to "DX/vTGW" or something similar.
Update the Apps VPCs route table
From the Apps VPC point of view we have now 2 TGWs attachments (and by the way the AWS limit is 5). We need to select the proper way out of these VPCs to "TGW-Internet" or vTGW
Tests
Voila. At this stage all is ready.
- SSH to the Ubuntu VM
- Ping EC2 in Apps VPC 100
- Ping EC2 in Apps VPC 200
- Traceroute to the EC2s and verify that no NAT gateways are in the path.
Very Useful Content , What tool you use to create Diagrams ?
ReplyDeleteI simply use PowerPoint
Delete