AWS Direct Connect Deep Dive — Overview
Direct Connect is the second-largest ANS topic (150 questions). The exam goes far deeper than basic DX setup — testing DX Gateway, hosted vs dedicated connections, LAG (Link Aggregation Groups), resiliency models, MACsec encryption, and failover patterns with VPN backup.
Router/Firewall
BGP peering
AWS cage + customer cage
Cross-connect (fiber)
Private VIF → VPC
Public VIF → AWS services
Transit VIF → TGW
Connect to multiple VPCs
Cross-region access
Works with TGW or VGW
Connection Types
| Type | Speed | Who Owns | Lead Time |
|---|---|---|---|
| Dedicated Connection | 1 Gbps, 10 Gbps, 100 Gbps | You request from AWS, physical port allocated | Weeks to months (physical install) |
| Hosted Connection | 50 Mbps to 10 Gbps | DX Partner provisions on their connection | Days (partner has existing infrastructure) |
Exam note: Hosted connections are single VIF (one VLAN). Dedicated connections support multiple VIFs (up to 50 private/transit + 1 public).
Virtual Interfaces (VIFs)
| VIF Type | Connects To | Use Case |
|---|---|---|
| Private VIF | VGW (single VPC) or DX Gateway (multiple VPCs) | Access private VPC resources (EC2, RDS, etc.) |
| Public VIF | AWS public services (S3, DynamoDB, STS) | Access AWS APIs over DX instead of internet |
| Transit VIF | Transit Gateway (via DX Gateway) | Access multiple VPCs via TGW (scalable) |
DX Gateway
- What: Global resource that connects your DX connection to VPCs in ANY region (not just the DX location’s region)
- Associations: DX Gateway → up to 20 VGWs (private VIF) OR 3 TGWs (transit VIF)
- Cross-region: Single DX in us-east-1 DX location → DX Gateway → VPCs in eu-west-1, ap-southeast-1, etc.
- Cannot: Route traffic between associated VPCs through DX Gateway (not transitive)
- Exam trap: DX Gateway + VGW associations don’t allow VPC-to-VPC routing. For that, use TGW.
LAG (Link Aggregation Group)
- What: Bundle multiple DX connections into single logical connection (LACP 802.3ad)
- Requirements: All connections must be same speed, same DX location, same AWS device
- Max: 4 connections per LAG (e.g., 4 × 10 Gbps = 40 Gbps logical)
- Minimum links: Configure minimum active links (e.g., LAG fails if <2 of 4 links active)
- Use case: Higher aggregate bandwidth + link-level redundancy (if one fiber fails, LAG continues)
- NOT resiliency: All links go to same device/location. If location fails, entire LAG fails. For resiliency, use separate locations.
Resiliency Models (AWS Recommended)
| Model | Architecture | Protects Against |
|---|---|---|
| Maximum Resiliency | 2 DX connections at 2 separate DX locations, each with separate devices | Device failure, connection failure, location failure |
| High Resiliency | 2 DX connections at 1 DX location (separate devices) | Device failure, connection failure (NOT location failure) |
| DX + VPN Backup | Primary: DX connection. Backup: Site-to-Site VPN over internet | DX failure (VPN takes over, lower bandwidth, higher latency) |
Failover Patterns
- DX + VPN backup: BGP configures DX as preferred (shorter AS path or higher local preference). VPN advertises same routes with longer AS path. Failover is automatic via BGP.
- Active/Active DX: Both connections active, traffic load-balanced. If one fails, other carries all traffic.
- BFD (Bidirectional Forwarding Detection): Faster failure detection (sub-second) compared to BGP hold timer (90s default). Enable for faster failover.
- MACsec: Layer 2 encryption on 10 Gbps and 100 Gbps dedicated connections. Encrypts traffic between your router and AWS device at DX location.
Exam Tips
| Exam | Key Points |
|---|---|
| ANS-C01 | “Access VPCs in multiple regions from one DX” → DX Gateway. “Higher bandwidth than single 10G” → LAG (up to 4×10G). “Survive DX location failure” → Maximum Resiliency (2 locations). “Fast provisioning” → Hosted connection (days). “DX + backup” → Site-to-Site VPN with longer BGP AS path. “Encrypt DX traffic” → MACsec (L2) for 10/100G. “Access S3 over DX” → Public VIF. “Connect to TGW via DX” → Transit VIF + DX Gateway. |
AWS Certification Exam Practice Questions
Question 1:
A company has a Direct Connect connection in us-east-1 DX location. They need to access VPCs in us-east-1, eu-west-1, and ap-southeast-1 from their on-premises data center using this single DX connection. Which configuration enables this?
- Create private VIFs for each VPC directly on the DX connection
- Create a DX Gateway, associate it with VGWs in each region’s VPC, create a private VIF to the DX Gateway
- Create a Transit Gateway in us-east-1 and peer it to the other regions
- Create separate DX connections in each region
Show Answer
Answer: B — DX Gateway is a global resource that allows a single DX connection to reach VPCs in any region. Associate VGWs from VPCs in multiple regions with the DX Gateway. Create one private VIF from your DX connection to the DX Gateway. Traffic routes to the correct region automatically. Private VIFs directly (A) only work for same-region VPCs. Separate DX per region (D) is expensive and unnecessary.
Question 2:
A company requires their Direct Connect to survive a complete DX location failure. Their compliance requires maintaining connectivity even if an entire facility goes offline. Which resiliency architecture meets this requirement?
- Two DX connections in the same DX location on separate AWS devices
- LAG with 4 connections at one DX location
- Two DX connections at two geographically separate DX locations with separate devices
- Single DX connection with Site-to-Site VPN backup
Show Answer
Answer: C — Maximum Resiliency requires connections at 2 separate physical locations. If one entire location fails (fire, power outage, fiber cut), the other location maintains connectivity. Same-location redundancy (A, B) doesn’t survive location failure. VPN backup (D) provides connectivity but at much lower bandwidth and higher latency — may not meet SLA requirements.
Question 3:
A company needs to access both private VPC resources AND public AWS services (S3 API) over their Direct Connect connection. How should this be configured?
- Single private VIF — all AWS traffic routes over it
- Create both a private VIF (for VPC resources) and a public VIF (for AWS public services) on the same DX connection
- Use a transit VIF which provides access to both private and public services
- Route all traffic through a NAT Gateway in the VPC
Show Answer
Answer: B — Private VIF routes to VPC private IP space. Public VIF routes to AWS public IP ranges (S3, DynamoDB, STS, etc.) over DX instead of internet. Both can coexist on the same DX connection as separate VLANs. A dedicated connection supports up to 50 private/transit VIFs + 1 public VIF. Transit VIF (C) connects to TGW for VPC access but doesn’t provide public service access.
Question 4:
A company has a 10 Gbps Direct Connect but needs 30 Gbps aggregate bandwidth for a data migration. They want a single logical connection for simplified management. All connections must be at the same DX location. Which solution provides this?
- Upgrade to a 100 Gbps dedicated connection
- Create a LAG with 3 × 10 Gbps connections (must be same speed, same location, same AWS device)
- Create 3 separate DX connections and use ECMP
- Use multiple VIFs on a single 10 Gbps connection
Show Answer
Answer: B — LAG bundles multiple physical connections into one logical connection (LACP). Requirements: same speed, same location, same AWS device. 3 × 10 Gbps = 30 Gbps aggregate. Managed as single connection (one set of VIFs). 100 Gbps (A) works but is more expensive. Multiple VIFs on one connection (D) don’t increase bandwidth beyond 10 Gbps. Note: LAG max is 4 connections.
Question 5:
A company uses DX as primary connectivity. They need a backup that automatically activates if DX fails, accepting lower performance during failover. The backup must require no manual intervention. Which design provides this?
- Second DX at another location (active/passive)
- Site-to-Site VPN as backup — configure BGP to prefer DX (shorter AS path) and VPN as fallback (longer AS path). BGP automatically fails over.
- AWS Cloud WAN with automatic failover
- Internet-based IPSec tunnel manually activated during outage
Show Answer
Answer: B — DX + VPN backup with BGP: DX advertises routes with shorter AS path (preferred). VPN advertises same routes with longer AS path. When DX fails, BGP removes DX routes → VPN routes become active automatically. No manual intervention. Enable BFD on DX for faster detection (sub-second vs 90s BGP hold timer). VPN bandwidth is lower but maintains connectivity. Second DX (A) works but costs significantly more than VPN.
Related Posts
- Hybrid Cloud Networking Architecture
- VPC Connectivity Decision Guide
- Network Performance (ENA, Jumbo Frames)
- Global Traffic Management
References
- AWS Direct Connect User Guide
- DX Resiliency Recommendations — AWS Blog
- Direct Connect Gateway — AWS Docs
Frequently Asked Questions
DX Gateway vs Transit Gateway — when to use which with DX?
DX Gateway + Private VIFs: Connect DX to multiple VPCs (up to 20 VGWs) across regions. Simple, no transitive routing. DX Gateway + Transit VIF + TGW: Connect DX to TGW, which connects to VPCs. Provides transitive routing (VPC-to-VPC through TGW), centralized management, and scales to thousands of VPCs. Use TGW when you need inter-VPC routing or 20+ VPCs.
What is the difference between dedicated and hosted connections?
Dedicated: You request a physical port directly from AWS (1/10/100 Gbps). You own the connection. Supports multiple VIFs (up to 50). Takes weeks-months to provision. Hosted: A DX Partner provisions a connection on their existing infrastructure and gives you access. Single VIF only. 50 Mbps to 10 Gbps. Provisions in days. Choose hosted for: faster setup, sub-1Gbps needs, or when you don’t have presence at a DX location.