What's changed: Deepened ANS-C01 Chapter 2 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
2.1Choosing Direct Connect vs VPN
Connect on-prem to AWS—understand Direct Connect (dedicated), Site-to-Site VPN, and the virtual private gateway (VGW), and how to choose. Learn the trade-offs of stability, cost, and setup speed.
On-prem to AWS connectivity comes in two main forms: Direct Connect (a dedicated line) and Site-to-Site VPN (an encrypted tunnel over the internet). Choose by required stability, bandwidth, and setup speed.
2.1.1Comparing the options
- Direct Connect (DX): a dedicated line for private connectivity. Consistent low latency and high bandwidth, but takes time to provision.
- Site-to-Site VPN: an encrypted tunnel over the internet. Fast to set up and encrypted, but latency varies.
- VGW (virtual private gateway): the VPC-side gateway that terminates VPN/DX (for a single VPC).
- Combine: use DX as primary and VPN as backup to stay connected even if the dedicated line fails.
Common on ANS-C01: need consistent low latency/high bandwidth = Direct Connect, connect fast and encrypted = Site-to-Site VPN, and guard against DX failure = VPN backup. Note DX alone is not encrypted (use VPN over DX or MACsec if needed).
Direct Connect requires a physical circuit and can take weeks to provision. A common pattern is to start with VPN and migrate to DX later.
ANS-C01 hybrid connectivity probes "choosing the optimal combination from requirements (bandwidth, latency, encryption, resiliency, cost, time-to-stand-up)." Direct Connect (DX) physically connects at a DX location via a partner/dedicated line, choosing Dedicated (1/10/100 Gbps) or Hosted (partner-provided, variable bandwidth). It is consistent low-latency, high-bandwidth, and private, but DX alone is not encrypted, so if required, run a Site-to-Site VPN over DX (IPsec) or use MACsec (L2 encryption). Site-to-Site VPN is an IPsec tunnel over the internet (two redundant tunnels) that quickly provides encrypted connectivity, recommends dynamic routing via BGP, and can stabilize paths with Accelerated VPN (via Global Accelerator). For resiliency, the classic is a VPN backup for DX failure (DX preferred, VPN failover), controlling paths via BGP attributes (AS path prepend, local preference, MED). For large, stable bandwidth use DX primary; for cost/speed or backup use VPN. Terminate on the VPC side with a VGW for a single VPC or a Transit Gateway to bundle many VPCs (below). The key is to nail "stable/high-bandwidth/private = DX," "fast/encrypted = VPN," "DX alone is unencrypted (pair VPN/MACsec)," and "DX primary + VPN backup for resiliency."
| Aspect | Direct Connect | Site-to-Site VPN |
|---|---|---|
| Path | Dedicated line (private) | Internet (IPsec) |
| Latency/bandwidth | Consistent, low-latency, high | Variable, line-dependent |
| Encryption | Not encrypted alone (add VPN/MACsec) | Encrypted via IPsec |
| Setup | Physical circuit; weeks | Immediate; hours |
Scenario: A core data integration requires high bandwidth, low latency, and private; it must not drop on a line failure; and data must be encrypted on the wire. → Use Direct Connect as the primary to meet bandwidth/latency, and run a Site-to-Site VPN (IPsec) over DX for encryption (or MACsec). Also provision a VPN backup path, with BGP preferring DX and failing over to VPN. During provisioning, connect via VPN first, then switch the primary to DX once it’s live.
FAQ: Is Direct Connect encrypted? No. DX is a private dedicated line, but it does not encrypt data itself. If encryption is required, run a Site-to-Site VPN (IPsec) over DX, or use MACsec (L2 encryption) on supported circuits. "Private ≠ encrypted" is a frequent trap.
Exam trap: Believing "Direct Connect is private so it’s automatically encrypted" is wrong—DX alone is unencrypted; encryption needs VPN over DX or MACsec. Also, a single DX connection is a SPOF, insufficient for "high availability"—add a second at a different location or a VPN backup. Factor in the weeks to provision a circuit; for urgency, start with VPN.
2.1.2Section summary
- Stable/high-bandwidth = DX / fast & encrypted = VPN
- Resiliency = DX primary + VPN backup
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. A core system needs consistent low latency and high-bandwidth private connectivity between on-prem and AWS. Best choice?
Q2. You must stand up an encrypted on-prem–AWS link within days and cannot wait for a physical circuit. What?
Q3. You want on-prem–AWS connectivity to survive a Direct Connect failure. A cost-effective backup?