SysPad › Lessons › networking lessons › Transit Gateway

How Transit Gateway works

Regional network transit hub that interconnects VPCs, VPNs and Direct Connect through a single routing point (hub-and-spoke instead of a mesh of peerings). Billed per attachment-hour + per-GB processed.

You have 12 VPCs and a data centre, and they all need to talk. Wire them with peering and you are hand-managing dozens of one-to-one links, each with its own routes. A Transit Gateway turns that tangle into a single hub: every network plugs in once, and one place decides who can reach whom.

What you will learn

The peering mesh problem

VPC peering connects two VPCs directly, and it is not transitive: if A peers with B and B peers with C, A still cannot reach C. So fully connecting n VPCs needs a link for every pair, which is n(n-1)/2 connections. Five VPCs is 10 links; twenty is 190.

A regional hub for everything

A Transit Gateway is a regional router. VPCs, Site-to-Site VPN, and Direct Connect each connect through an attachment. Add a network once and it can reach every other attached network through the hub, so the count grows linearly, not quadratically.

It is regional, but you can peer Transit Gateways across regions over the AWS backbone to build a global network without a public-internet hop.

⚓ Enterprises with dozens of accounts and VPCs, hybrid setups joining on-prem to AWS, and shared-services hubs (logging, DNS, inspection).

Route tables: who talks to whom

Sharing a hub does not mean everything is reachable. Each attachment associates with a TGW route table, and you choose which routes propagate where. That lets you keep, say, production and development isolated while both still reach shared services.

What it costs, and when to skip it

Transit Gateway bills per attachment-hour plus a charge per GB of data processed through it. With many networks that is cheap relative to managing a peering mesh, but for just two VPCs that need to talk, a single VPC peering is simpler and has no per-GB hub fee.

Flashcards

Why can three peered VPCs (A-B, B-C) still not all reach each other?
VPC peering is not transitive. A reaches B and B reaches C, but A to C needs its own peering. Full connectivity needs a link per pair.
How does TGW change the connection count as you add VPCs?
From n(n-1)/2 peering links to n attachments: each network connects once to the hub and reaches the rest through it.
What kinds of things attach to a Transit Gateway?
VPCs, Site-to-Site VPN, and Direct Connect gateways, plus peering to TGWs in other regions for a global network.
Two environments share one TGW but must not reach each other. How?
Use separate TGW route tables and control route propagation, so each environment routes only where you allow.
How is Transit Gateway priced?
Per attachment-hour plus per GB processed through the hub. For just two VPCs, free VPC peering is usually the better call.

Sources

Open the SysPad canvas · Official Transit Gateway documentation

Other networking lessons