What's changed: Deepened ANS-C01 Chapter 2 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
2.2Direct Connect Architecture and Resiliency
Go deeper on DX—private/public/transit VIFs, BGP, redundancy via multiple connections/locations, and the DX Gateway. A single connection is a single point of failure.
Direct Connect connects via virtual interfaces (VIFs). There are three VIF types by destination, and for resiliency it is key to make connections redundant.
2.2.1VIF types and redundancy
- Private VIF: reaches resources inside a VPC (private IPs).
- Public VIF: reaches AWS public services (e.g., S3) over DX.
- Transit VIF: connects to a Transit Gateway to reach many VPCs.
- Redundancy: remove single points of failure with multiple connections/locations; add a VPN backup for robustness.
Common on ANS-C01: to a VPC = private VIF, to public services like S3 = public VIF, to many VPCs via TGW = transit VIF, and a single DX is a SPOF → add a second at a different location + VPN backup. The highest resiliency requires DX at multiple locations.
A Direct Connect Gateway lets one DX connection reach multiple regions and multiple VPCs (or Transit Gateways).
ANS-C01 DX design probes "VIF selection, BGP control, resiliency levels, and the DX Gateway role." Virtual interfaces (VIFs) come in three types: private VIF (to VPC private IPs via a VGW or DX Gateway), public VIF (to AWS public services like S3 over DX, public IPs), and transit VIF (to a Transit Gateway via a DX Gateway = many VPCs). A DX Gateway is a global resource that reaches multiple regions and multiple VPCs/TGWs from one DX connection, bundling on-prem with several regions. Routing uses BGP, exchanging on-prem and AWS advertisements, controlling paths with local preference / AS path prepend / MED to prefer DX and keep VPN as backup. Resiliency levels per AWS guidance: (1) highest = multiple DX locations × multiple connections each, (2) high = one connection at each of multiple locations, (3) dev/lowest = multiple connections at a single location, (4) not recommended = a single connection (SPOF). Adding a VPN backup further hardens it. A LAG (link aggregation) bundles multiple connections at the same location for more bandwidth (but same-location does not improve resiliency). The key is to nail "VPC = private VIF / S3 etc. = public VIF / TGW = transit VIF," "highest resiliency = multiple locations," "DX Gateway for multiple regions/VPCs," and "BGP for path control."
| VIF / element | Reaches | Key point |
|---|---|---|
| Private VIF | VPC private IPs | Via VGW or DX Gateway |
| Public VIF | AWS public services like S3 | To public IPs over DX |
| Transit VIF | Transit Gateway (many VPCs) | Via DX Gateway |
| Resiliency | Multiple locations + VPN | Single conn/location is a SPOF |
Scenario: A production hybrid requires the highest resiliency so on-prem–AWS never drops on a DX failure, and must reach VPCs in multiple regions over DX. → Provision connections at two or more DX locations (multiple connections at a single location is insufficient), creating VIFs on each (private to VPCs, transit to many VPCs via TGW). Reach multiple regions/VPCs via a DX Gateway, and add a Site-to-Site VPN backup. Prefer DX with BGP local preference, failing over to VPN on failure.
FAQ: LAG or multiple locations for resiliency? A LAG (link aggregation) bundles multiple connections at the same location to increase bandwidth, but if that whole location fails everything is lost, so it does not improve resiliency. To improve resiliency, distribute connections across separate DX locations (highest = multiple locations × multiple connections each + VPN backup).
Exam trap: Choosing a private VIF to reach AWS public services like S3 over DX is wrong—public services use a public VIF. Also, "add a second connection at the same location for the highest resiliency" is wrong—a location failure needs a different location (same-location multiples are for bandwidth/dev). Connecting DX to a Transit Gateway uses a transit VIF (+ DX Gateway).
2.2.2Section summary
- VIFs = private (VPC) / public (S3 etc.) / transit (TGW)
- Resiliency = multiple DX locations + VPN backup
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Over Direct Connect, you want to reach private-IP resources inside a VPC. Which VIF?
Q2. From one Direct Connect, reach many VPCs behind a Transit Gateway. Which VIF?
Q3. You want the highest level of Direct Connect resiliency. Which design?