Global Transit Network architecture is critical to the success of your AWS cloud deployment. Implemented correctly, a Global Transit Hub enables traffic to securely flow from on-prem to VPCs, or from VPC to VPC, in a way that minimizes complexity and cost and maximizes agility and availability. Implemented poorly, it becomes a choke point that is time-consuming – and costly – to maintain and troubleshoot.

1. Seven Criteria for Building an
AWS Global Transit Network
AWS Bootcamp Series – December 2017
Frank Cabri, VP Product Marketing
Sherry Wei, Founder & CTO

2. © 2017 AVIATRIX SYSTEMS, INC . | 2© 2017 AVIATRIX SYSTEMS, INC . | 2
• Agenda
- AWS Hybrid Cloud Topologies
- 7 Criteria to Consider When Designing a
Global Transit Network
- Hands on Demonstration
- Live Q&A
• Ask Questions via the Q&A Window
Welcome & Agenda
Sherry Wei
Founder & CTO

3. © 2017 AVIATRIX SYSTEMS, INC . | 3© 2017 AVIATRIX SYSTEMS, INC . | 3
Your Cloud Evolution Drives VPC Topology
BGP
Direct
Connect
BGP BGP VGW
BGP
On Premises
Data Center
BGPBGPBGPBGP
Flat Architecture

4. © 2017 AVIATRIX SYSTEMS, INC . | 4© 2017 AVIATRIX SYSTEMS, INC . | 4
Your Cloud Evolution Drives VPC Topology
BGP
Direct
Connect
BGP BGP VGW
BGP
On Premises
Data Center
BGPBGPBGPBGP
Flat Architecture
…
BGP BGP BGP
BGP
BGP
BGP
On Premises
Data Center
Transit Architecture
Direct
Connect

5. © 2017 AVIATRIX SYSTEMS, INC . | 5© 2017 AVIATRIX SYSTEMS, INC . | 5
Your Cloud Evolution Drives VPC Topology
BGP
Direct
Connect
BGP BGP VGW
BGP
On Premises
Data Center
BGPBGPBGPBGP
Flat Architecture
…
BGP
BGP
BGP
SDN SDN SDN
SDN
On Premises
Data Center
Transit + Services Architecture
Direct
Connect
…
BGP BGP BGP
BGP
BGP
BGP
On Premises
Data Center
Transit Architecture
Direct
Connect

6. © 2017 AVIATRIX SYSTEMS, INC . | 6© 2017 AVIATRIX SYSTEMS, INC . | 6
Global Transit Network – Key Criteria Explained
1. Agility
2. Scalability
3. Security
4. Visibility
5. High Availability
6. Reliability
7. Cost

7. © 2017 AVIATRIX SYSTEMS, INC . | 7© 2017 AVIATRIX SYSTEMS, INC . | 7
Networking has always been measured by speeds and feeds, never
measured by agility, so why now?
- Expectations: Developers spin up EC2s in minutes, no patience for network
connectivity that takes days or weeks. What’s your expectation of time to
provision a new connection?
- VPC Quantity: The number of VPCs is orders of magnitude more than the
number of datacenters.
- The Buzz: CloudFormation and Terraform are the tools of choice.
What to look for?
- Central orchestration capability.
- Does it support Dry Run before committing to a change?
- Is an API readily available for automation? Does a Terraform provider template
exist for integration?
1. Agility

8. © 2017 AVIATRIX SYSTEMS, INC . | 8© 2017 AVIATRIX SYSTEMS, INC . | 8
Why does it matter?
- Large-size enterprises should expect to have thousands of VPCs.
- Mid-size enterprises should expect to have hundreds of VPCs.
- Many teams, business groups, projects and apps => many AWS accounts.
Limitations you should be aware of?
- 100 non-propagated route limits.
- 100 propagated route limits.
- 125 PCX per VPC.
What to look for?
- Your network architecture should sustain long-term growth requirements.
- There should be no single point of performance bottleneck.
2. Scalability

9. © 2017 AVIATRIX SYSTEMS, INC . | 9© 2017 AVIATRIX SYSTEMS, INC . | 9
Why does it matter?
- Internal/external compliance policy (eg: encryption everywhere).
- In AWS, security is a shared responsibility model and so you must do
your part.
What to look for?
- On-prem to VPC
- Does a private link (not encrypted) such as Direct Connect meet your data
privacy requirements?
- VPC to VPC
- Do you allow connectivity between VPCs that belong to different AWS accounts?
- Are you aware that many DevOps tools are not encrypted?
3. Security
CONTINUED …

10. © 2017 AVIATRIX SYSTEMS, INC . | 10© 2017 AVIATRIX SYSTEMS, INC . | 10
What to look for?
- VPC to Internet (Egress)
- Do you allow instances on private subnets in a VPC to access the Internet directly?
- What egress controls and policies do you require?
- Should egress controls be implemented per region or per VPC?
- Are you sure that you are enforcing the policy everywhere you think you are
enforcing (audit)?
- Internet to VPC (Ingress)
- What protection is needed for EC2 instances with a public IP address?
- User to VPC
- Do you allow Developers and/or the Ops team to directly access the VPC and
instances? Do you allow access when they are remote?
- How do you manage this access? Who has access to which account? Is this based on
job profile? How do you do provisioning, de-provisioning and tracking?
3. Security
CONTINUED …

11. © 2017 AVIATRIX SYSTEMS, INC . | 11© 2017 AVIATRIX SYSTEMS, INC . | 11
Why does it matter?
- Visibility is table stakes for any operations team to be successful.
- Cloud environments change very fast and visibility is key to being on top of
the changes and updates.
- At cloud scale with hundreds to thousands of VPCs, the only way to
effectively manage is through alerts, dashboards and
troubleshooting/forensics tools.
What to look for?
- Does the product visualize the entire cloud network connectivity?
- Can the logs be exported to a centralized services like Splunk, Sumo etc.
- What kind of alerts are available when connectivity is down?
- Can the product provide traceroutes and packet capture?
- Are additional insights available for EC2-to-EC2 connectivity problems?
4. Visibility

12. © 2017 AVIATRIX SYSTEMS, INC . | 12© 2017 AVIATRIX SYSTEMS, INC . | 12
5. High Availability
Why does it matter?
- Your production is running in the cloud. The network has to stay up.
Good to know
- AWS VGW support for DX+DX, DX+Internet.
What to look for?
- How is the High Availability orchestrated? Is it productized?
- Does the solution support single AZ fail over (cost optimized)?
- Does the solution support multi AZ fail over (failover time optimized)?

13. © 2017 AVIATRIX SYSTEMS, INC . | 13© 2017 AVIATRIX SYSTEMS, INC . | 13
6. Simplicity
Why does it matter?
- Cloud is new; skill sets are scarce and so the cloud ends up being complex.
- Complexity leads to mistakes, and networking mistakes can bring down the
entire cloud connectivity. (For example: fat fingering a route table update.)
- Cloud providers are changing very fast. Are you on top of all the new
functionalities and updates?
What to look for?
- Automation.
- Orchestration.
- Integration with your Cloud Ops stack of tools.

14. © 2017 AVIATRIX SYSTEMS, INC . | 14© 2017 AVIATRIX SYSTEMS, INC . | 14
Why does it matter?
- A non-optimal architectural choice can lead to exponentially increasing costs.
- Cost is often hidden under many line items under many accounts.
- Cost was one of the drivers why you went to cloud in the first place.
What to look for?
- Deployment costs: Compare the initial and at-scale product costs.
- Operational costs:
- Monitoring and troubleshooting complexity.
- Do you have visibility into every network endpoint for troubleshooting?
- People cost:
- Can a CCNA or CloudOps engineer maintain the network?
- Support costs:
- Does the product come with tools for troubleshooting?
- What kind of support do you get from the vendor when your network has problems?
7. Costs

15. Introducing Aviatrix for
AWS Global Transit Network

16. © 2017 AVIATRIX SYSTEMS, INC . | 16© 2017 AVIATRIX SYSTEMS, INC . | 16
Aviatrix Solution
….
VGW
Shared Service VPC(s)
Transit VPC
Hub
Spoke VPC(s)
Direct Connect / Internet
On Prem 1
Transport
Architecture
Shared Services
Architecture
Controller
(AWS or Aviatrix Peerings)
On Prem 2
GW
GW GW GW GW
GW
GW
(Aviatrix Transit Network)
BGP

17. Q & A

18. © 2017 AVIATRIX SYSTEMS, INC . | 18© 2017 AVIATRIX SYSTEMS, INC . | 18
• You’ll receive email w/ link to replay,
slides, and GTN eval checklist
• Request meeting or further demo:
http://aviatrix.com/contact/
• Download the free trial on AWS
Marketplace (search for Aviatrix)
Next Steps with Aviatrix