Stateful inspection
Appliance mode
Enable it on the inspection VPC attachment so both directions of a flow pass through the appliance in the same AZ. This prevents asymmetric paths through stateful firewalls.
AWS Transit Gateway · Regional routing hub
Route your VPCs and on-premises networks through a single hub
AWS Transit Gateway is a managed router that connects VPCs, Site-to-Site VPN, Direct Connect gateways, and SD-WAN appliances in a Region at a single point. Transit Gateway route tables decide which attachments can talk to each other.
TGW route table · prod4 routes
assoc: vpc-prod-aassoc: vpc-prod-b10.20.0.0/16vpc · sharedpropagated
172.16.0.0/12dxgw · on-prempropagated
192.168.0.0/16vpn · branchpropagated
0.0.0.0/0vpc · inspectionstatic
The prod VPCs look up destinations in this table. Shared services, on-premises, and branch routes arrive by propagation, and the default route is pinned to the inspection VPC.
100 Gbps
Max bandwidth per VPC attachment, per AZ, per direction
8500
MTU between VPC · DX · Connect · peering (bytes)
7.5M
Max PPS per VPC attachment, per AZ
20 Gbps
Max bandwidth per Connect attachment (4 GRE peers)
Why Transit Gateway
The more VPCs you add, the harder a peering mesh is to manage
VPC peering does not support transitive routing, so the number of connections grows quickly as VPCs are added. Transit Gateway brings every connection into a hub and manages routing policy in one place.
Hub
Hub and spoke
Attach each VPC, VPN, Direct Connect, and SD-WAN connection once, and they communicate with each other through the hub.
Segment
Segmentation with route tables
Split routing domains such as production, development, and shared services, and propagate only the routes you need to limit what can communicate.
Share
Multi-account sharing
Share the Transit Gateway with other accounts through AWS RAM. Each account attaches its own VPCs, while the network team manages routing.
Association & propagation
One association, many propagations
Each attachment is associated with one route table and looks up destinations there. At the same time, it can propagate its routes to multiple route tables. The combination of these two settings is your network segmentation policy.
Attachment
rtb-prod
rtb-dev
rtb-shared
VPC prod10.10.0.0/16
A
–
P
VPC dev10.30.0.0/16
–
A
P
VPC shared10.20.0.0/16
P
P
A
DX gateway172.16.0.0/12
P
P
AP
Association
Determines which route table is used to look up packets arriving from an attachment. An attachment can be associated with only one route table.
Propagation
Automatically installs an attachment's routes in a route table. VPCs propagate their CIDRs; VPN, DX gateway, and Connect propagate routes learned over BGP. Peering uses static routes.
Result: The prod and dev tables have no routes to each other, so the two VPCs cannot communicate. Both VPCs can reach the shared services VPC and on-premises.
Features
Key features
Native firewall
Network Firewall attachment
Attach AWS Network Firewall directly as a Transit Gateway attachment, with no separate VPC and subnets to host firewall endpoints.
Multi-region
Inter-Region peering
Peer with Transit Gateways in other Regions or accounts. Inter-Region traffic travels over the AWS backbone encrypted with AES-256.
SD-WAN
Transit Gateway Connect
Connect SD-WAN appliances with GRE tunnels and BGP, using a VPC or Direct Connect as the transport. Up to 5 Gbps per GRE peer.
Many sites
VPN Concentrator
Terminates Site-to-Site VPN from up to 100 branch sites on a single attachment. Up to 100 Mbps per site and 5 Gbps in total; BGP routing only.
One to many
Multicast
Routes multicast between VPCs using IGMPv2 or static group membership. Subnets are grouped per multicast domain, and multicast is enabled on a new Transit Gateway.
Attachment types
Performance and route exchange by attachment type
Bandwidth figures are the published default limits. For VPC, DX gateway, and peering attachments, you can request an increase through your SA or TAM. Site-to-Site VPN can also connect as Accelerated VPN or through a VPN Concentrator.
| Attachment type | Max bandwidth | MTU | Route exchange |
|---|---|---|---|
| VPC | 100 Gbps · per AZ, per direction | 8500 bytes | VPC CIDR propagation. Specify one subnet per AZ. |
| Direct Connect gateway | 100 Gbps · per AZ, per direction | 8500 bytes | BGP over a transit VIF |
| Site-to-Site VPN | 1.25 Gbps per tunnel, 5 Gbps for Large bandwidth tunnels (not with Accelerated VPN), 100 Mbps per site with VPN Concentrator | IPsec tunnel MTU 1446 bytes | BGP or static. With BGP, ECMP combines multiple tunnels. Accelerated VPN enters at the AWS edge through Global Accelerator. |
| Connect | 5 Gbps per GRE peer, 20 Gbps per attachment with 4 peers | 8500 bytes | BGP over GRE tunnels |
| Peering | 100 Gbps · per AZ, per direction | 8500 bytes | Static routes. Works both within a Region and across Regions. |
Reference architecture
Regional hub with centralized inspection
A Transit Gateway in the Seoul Region connects the workload VPCs, a shared services VPC, and an inspection VPC. On-premises connects through a Direct Connect gateway and VPN, and other Regions through peering.
On narrow screens, swipe the diagram sideways.
Getting started
Steps to set up Transit Gateway
- STEP 1
Create the Transit Gateway
Choose the ASN and decide whether to use default route table association and propagation.
- STEP 2
Create attachments
Attach VPCs by specifying one subnet per AZ. Attach VPN and DX gateways as well.
- STEP 3
Design route tables
Create a table per domain and configure association and propagation for each attachment.
- STEP 4
Add VPC routes
Add routes targeting the Transit Gateway to each VPC subnet route table.
- STEP 5
Verify flows
Use Transit Gateway Flow Logs to confirm traffic follows the intended path.
Pricing
Cost components
Transit Gateway pricing is based on the number of attachments and their hours, plus the amount of data sent to the Transit Gateway. VPN, Direct Connect, and inter-Region transfer are charged separately.
| Component | Billing basis | Notes |
|---|---|---|
| Attachment hours | Hours each attachment is connected. Partial hours are billed as full hours. | Billed to the VPC owner for VPC, the DX gateway owner for DX, the firewall owner for Network Firewall, and the Transit Gateway owner for VPN, Connect, and peering. |
| Data processing | GB sent to the Transit Gateway from VPC, Direct Connect, VPN, and Network Firewall | By default, billed to the sender (source attachment) owner; a Flexible Cost Allocation policy can allocate it to the destination or a central account instead. Data arriving from a peering attachment has no processing charge, and Connect and Private IP VPN attachments have no processing charge beyond that of the underlying VPC or DX attachment. |
| Multicast data processing | GB received by multicast receiver instances | Calculated per receiver. |
| Inter-Region data transfer | Outbound GB sent to another Region over peering | Billed to the sender at EC2 data transfer rates; inbound is free. |
| Site-to-Site VPN | VPN connection hours, VPN Concentrator hours | Billed separately at Site-to-Site VPN rates. Accelerated VPN adds hourly charges for two Global Accelerators per connection plus Data Transfer Premium. |
| Direct Connect | Port hours and Direct Connect outbound data transfer | Billed separately at Direct Connect rates. |
Rates vary by Region and usage. See the AWS Transit Gateway pricing page for current rates.
Next step
Design routing domains that fit your organization
Bring your VPC list, account structure, on-premises connectivity, and inspection requirements, and we'll review the route tables and attachment design together.