As customers put more workloads into AWS, the number of VPCs a customer needs to manage also grows. VPCs can exist across geographically disparate AWS Regions, or run in separate AWS accounts connecting to a common VPC that serves as a global network transit center. This session shows you how to implement a networking construct that AWS calls a transit VPC using the Cisco Cloud Services Router. This network topology simplifies network management and minimizes the number of connections that you need to set up and manage. Even better, it is implemented virtually and doesn't require physical network gear or a physical presence in a colocation transit hub. Come hear why customers are procuring this service through AWS Marketplace and how customers are using the transit VPC for private networking, shared connectivity, and cross-account AWS usage.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
How Do I Build a Global Transit
Network on AWS?
M S C 3 0 2
N o v e m b e r 2 9 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Marketplace
F i nd , buy, d epl oy, and manage software i n the cl oud
• Deploy software on demand
• Curated software from trusted vendors
• 1280+ ISVs
• 4200+ product listings
• Simplified procurement and deployment
• Billed through AWS account
• Deployed in 15 regions around the world
• 160,000 active customers

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Marketplace capabilities
S o f t w a r e d i s c o v e r y p r o c u r e m e n t a n d d e p l o y m e n t s i m p l i f i e d
Pay options such as
pay-as-you-go pricing
• Pay only for what you use
• Integrate software costs
into AWS bill
• Pay by user, host, or data
• Upgrade to longer terms for
subscription discounts
• SAAS multi-year contracts
Be flexible
• Easily scale up or down
on-demand
• Test and learn without material
commitments
• Use only what you need without
wasting unused licenses
• Resources tagged and visible in
Spend Management tools
Get the software
you need in minutes
• Test in minutes
• Innovate faster
• Ready-to-run on AWS
• Simplify migration to the cloud
• Leverage BYOL investments
• Convert from Test to Buy

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Marketplace flexible pricing options
Hourly
Consumption-based
software with no
long-term
commitments.
Ideal for Dev/Test or
spikey workloads.
Monthly
Monthly terms
available, with the
option to upgrade to
annual or multi-year
contracts for SaaS
and API products.
Ideal for temporary
projects and baseline
workloads.
Free Trial
Get started quickly
with no
commitment.
Good for initial
evaluation.
Private Offers
Negotiated pricing
between customer &
ISV and fulfilled on
AWS Marketplace.
Intended for high value
transactions
BYOL
Leverage existing
investments through
bring-your-own-
license to simplify
cloud deployment.
Important for
customers migrating
to AWS.
Annual/
Multi-Year
Long term contracts
include one, two, and
three year options.
Ideal for long-term
workloads.

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Popular categories and leading brands
most often deployed in projects
Security BIStorage MediaDatabaseNetworking DevOps
Operating
Systems

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multiple deployment options
• Launch AMI-based software quickly
using 1-Click
• Manually launch AMI-based software
from Amazon EC2 console
• Deploy more complex topologies
with support for clusters and AWS
resources using AWS
CloudFormation
• Customers can also copy
Marketplace products to Service
Catalog for easier management and
access control
Deploying software from AWS Marketplace
NEW!

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Search: Cisco CSR 1000v Transit…

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Subscribe and deploy

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Core networking offerings
Amazon VPC AWS Direct
Connect
Amazon Route 53Elastic Load
Balancing
AWS offers a wide variety of networking services, with four at the
center:

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon VPC
• Choose from multiple connectivity options, including public Internet, Network Address
Translation, encrypted VPN, and more
• Quickly and easily provision and configure using the AWS Management Console
• Leverage multiple layers of security to protect your applications and environment,
including access control lists, dedicated hardware, and more
Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated
section of the AWS cloud where you can launch resources in a virtual network
that you define

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Network transit centers are a common network design for connecting
multiple, geographically dispersed networks
A Transit VPC allows AWS
customers to create virtual
network transit centers without
the traditional costs of
establishing a physical presence in
a co-location transit hub or
deploying physical network gear
What is a Transit VPC?

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Transit VPC features
Completely virtual AWS network connectivity Remote network connectivity
Inter-network connectivity Additional networking
features and security controls

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Dedicated VPC: Simplifies routing by not
combining with other shared services
• Virtual network appliances: Provide
dynamic routing and VPN network
tunnels
• Redundancy: Dynamic routing combined
with multi-AZ deployment creates a
robust network infrastructure
• VGW: VPC virtual gateways provide
highly available connections to transit
VPC virtual network appliances
Transit VPC design

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Familiar platform that
provides transit VPC
and transport
connectivity between
AWS and
on-premises data
centers
Zone-based firewall
and MPLS support to
provide secure
segmentation in a
multi-tenant
environment
Cost efficiencies gained
by deploying virtual
infrastructure for agile
workloads at scale
Benefits of using Cisco CSR1000v On AWS

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infor

16. Copyright © 2013. Infor. All Rights Reserved. www.infor.com 16
AWS Transit VPC Architecture
Steve Savage

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Original IT AWS environment
H o m i n g I T
s e r v i c e s ,
i n t e r n a l
a p p l i c a t i o n s ,
s o m e p u b l i c
p r e s e n c e .
Core VPC
10.96.0.0/16
10.96.128.0/17
US-EAST-1AUS-EAST-1B
AvailabilityZones
Internet
Application
Firewall
Route Table
Private RFC > CSR
0.0.0.0 > FW
ADFS
ELB
CSR
DMVPN
10.96.0.0/17
WANTraffic
CSR
DMVPN
Incom
ing public traffic
AD/Infra
ADFS
DMVPN WAN
Branch Offices
AD/InfraELB
Prod PreProd
Prod Preprod

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scope and challenges
As Infor continues to migrate workloads to AWS, we need to address some needs from the business—specifically,
regarding security, landscape change, and scalability. We are beginning to see use cases that challenge the existing IT
AWS presence, and we need to meet these demands, while allowing flexibility to address future growth.
Specific challenges—internal
• Internal-only deployments that need reachability to corporate—for example, product testing and development.
Currently, these are planned/handled by either a dedicated CSR environment or an isolated VPC connected to
corporate via VPN tunnel to our data centers. CSRs have EC2 and licensing costs associated and both CSR and VPN
have an administrative overhead in hardware/maintenance support. VPN backhaul is also effective only for
solutions that reside in the hardware VPN termination site.
• Locking down these multiple environments in an IT-managed area is very cumbersome to support and doesn’t
easily allow us to allocate cost per department. Also, having IT “host” these environments would take away a lot of
the flexibility of AWS for the respective teams.
• The nature of the backhaul VPN is also changing. As more systems are built in AWS, the requirement to VPN to
corporate for connectivity changes to become connectivity to IT AWS itself. For example, we have cross account US
East-based services that don’t have direct connectivity. This is routed via an on-premises VPN tunnel, which is
suboptimal.
• Acquisition AWS environments that need access to Infor for certain services—for example, ldaps—require a VPN
tunnel also, or the traffic needs to traverse the on-premises network. Once again, if the destination is AWS; we are
backhauling over the WAN where we don’t need to.
• We want to leverage staging for new AWS environments and control traffic to/from corporate.

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Challenges—external
The IT AWS Core is currently a DC extension into AWS. We can also provide front-end traffic for
public access via stateful firewalls. However, we want to leverage ELBs for redundancy. While we
could leverage auto-scaling groups for inline firewalls with ELB, it is really designed for a different
use case than ours and would be difficult to scale for multiple workloads.
Core VPC
10.96.0.0/16
10.96.128.0/17
US-EAST-1AUS-EAST-1B
AvailabilityZones
Internet
Application
Firewall
RouteTable
Private RFC >CSR
0.0.0.0 > FW
ADFS
ELB
CSR
DMVPN
10.96.0.0/17
WANTraffic
CSR
DMVPN
AD/Infra
ADFS
DMVPN WAN
Branch Offices
AD/InfraELB
Prod PreProd
Prod Preprod
ASG Application
Firewalls
ALB
Public Servers
answering https
ELB

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
 AWS Transit VPC solution using Dual CSR1000-V
across 2 x AZ
 Multi-region, multi-account support
 Uses BYOL licensing support model
 Reduction in cost/licensing of other CSRs—ease of
maintenance and spend
 Solution is an AWS-driven initiative developed with
Cisco
 WAN-agnostic—we can use Cisco CSR1000-V DMVPN
for WAN or AWS Direct Connect
 Ability to use zone-based firewall on transit routers
to control traffic inbound from spokes—for example,
staging, acquisitions
 Use of redundant links and BGP for path control
across all spokes
 Automation brings new spoke VPCs up and into the
routing table in minutes
AWS Transit VPC

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Transit VPC
Transit VPC
10.98.0.0/16
US-EAST-1A
US-EAST-1B
Internet
GRE Tunnels
between DMVPN
and Transit with
BGP
CSR
DMVPN
WANTraffic
CSR
DMVPN
DMVPN WAN
Branch Offices
CSR
Transit
CSR
Transit
VPN gateway
Krypton
VPN gateway
Infra/AD
VPN gateway
Staging
Core VPC
10.96.0.0/16
Prod/Apps
Public Facing Application VPC
Webservers
Webservers
Application
firewalls
Application
firewall HA
ALB with
WAF
VPN gateway
Transit Spoke
Internet Egress
INFOR AWS TRANSIT VPC – public
VPC
All traffic between spoke
VPCs traverses the transit
area. Public-based ELB web
servers reside in their own
VPC and communicate back
to transit via an application
firewall. Dev, core, and
staging VPCs setup with CSR
transit automation. Public-
facing application VPC using
dual-application firewalls
with IPSec and BGP, with
local preference for path
selection, akin to the
spokes.

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Transit VPC—traffic flow public prod
Transit VPC
10.98.0.0/16
US-EAST-1A
US-EAST-1B
Internet
GRE Tunnels
between DMVPN
and Transit with
BGP
CSR
DMVPN
WANTraffic
CSR
DMVPN
DMVPN WAN
Branch Offices
CSR
Transit
CSR
Transit
VPN gateway
Krypton
VPN gateway
Infra/AD
VPN gateway
Staging
Core VPC
10.96.0.0/16
Prod/Apps
Public Facing Application VPC
Webservers
Webservers
Application
firewalls
Application
firewall HA
ALB with
WAF
VPN gateway
Transit Spoke
Internet Egress
INFOR AWS TRANSIT VPC – Traffic
flow
Web/web proxy frontend,
Perimeter firewalls allowing
access to certain nodes
IT Int Prod servers

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Want to learn more?

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Suggested sessions
NET306 - Planning Advanced AWS Networking Architectures Networking is the foundation supporting many
applications and services on AWS. As such, it is one of the first and most important things to consider when
architecting with AWS. In this session, we discuss planning for your advanced AWS networking architectures.
• Wednesday, Nov 29, 4:45 p.m. – 5:45 p.m. – Venetian, Level 1, Casanova 507
NET305 - Advanced VPC Design and New Capabilities for Amazon VPC Amazon Virtual Private Cloud (Amazon
VPC) enables you to have complete control over your AWS virtual networking environment. Given this
control, have you ever wondered how new Amazon VPC features will affect the way that you design your AWS
networking infrastructure, or even change existing architectures that you use today? In this session, we
explore the new design and capabilities and how you might use them.​
• Thursday, Nov 30, 1:45 p.m. – 2:45 p.m. – Venetian, Level 4, Delfino 4002

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Suggested sessions (continued)
CMP315 - Optimizing Network Performance for Amazon EC2 Instances Many customers are using Amazon EC2
instances to run applications with high performance networking requirements. In this session, we provide an
overview of Amazon EC2 network performance features—such as enhanced networking, ENA, and placement
groups—and discuss how we are innovating on behalf of our customers to improve networking performance
in a scalable and cost-effective manner. We share best practices and performance tips for getting the best
networking performance out of your Amazon EC2 instances.
• Friday, Dec 1, 8:30 a.m. - 9:30 a.m. – Venetian, Level 3, San Polo 3405
NET404 - Networking Many VPCs: Transit and Shared Architectures This session focuses on best practices for
connectivity between many virtual private clouds (VPCs), including the Transit VPC. We review how the
Transit VPC works and use cases for centralization, network security, and connectivity. We include best
practices for multiple accounts, multiple regions, and designing for scale. In addition, we also review some of
the variants and extensions to the Transit VPC, including how to customize your own.
• Friday, Dec 1, 10:00 a.m. - 11:00 a.m. – Venetian, Level 3, San Polo 3405

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Q&A

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!