Site-to-Site VPN gateway with transit gateway

0

We have a Site-to-Site VPN (VPN Gateway) setup in a MAIN account in AWS. All connectivity in the VPC for that MAIN account and on-prem work fine. (both ways) The MAIN account using a shared TGW to the SECONDARY account. Connectivity between the MAIN and SECONDARY is fine (both ways) For the SECONDARY account to traverse through TGW to the MAIN account and then the VPN (On-prem), what routes would be needed? I have tried many routes for the TGW and the Route tables themselves, none work.

Will this even work? Or does the Site-to-Site VPN need to be associated to the TGW and not the MAIN VPC?

1 Answer
1
Accepted Answer

Transitive routing is not supported with VPC's

As you rightly speculated. The S2S VPN Has to terminate on the Transit gateway.

You cant have a S2S VPN terminate in the VPC Directly and they route from Secondary account via transit gateway to main account and then via the Local Virtual Private Gateway in the Main VPC.

https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-transit-gateway-vpn.html

profile picture
EXPERT
answered a year ago
profile picture
EXPERT
reviewed a year ago
profile pictureAWS
EXPERT
reviewed a year ago
  • Figured. Thank you

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions