Dedicated Connections
Dedicated Connections
Direct Connect is a private physical link between your network and AWS, provisioned at a DX location through AWS or a partner. A dedicated connection gives you cross-connections to your own router (1/10/100 Gbps ports); a hosted connection is delivered by a partner at smaller speeds. Either way you receive a Letter of Authorization and Cross Connect Form before the physical build.
On top of one port sit virtual interfaces: a private VIF reaches VPCs (via a virtual private gateway or Direct Connect Gateway for other regions), a public VIF reaches AWS public endpoints, and a transit VIF attaches to Transit Gateway. Each VIF runs BGP with your ASN over link-local 169.254.x.x addresses, authenticated with an MD5 key AWS issues at creation.
Provisioning and Routing
Provisioning and Routing
Sequence: request the connection → complete LOA-CFA → cable and bring the port up → create VIFs → configure BGP → attach to gateway/transit → advertise prefixes.
Your on-prem router must originate the prefixes it will advertise (via BGP or static routes on the VIF), and AWS advertises the VPC or public ranges back. Use a Direct Connect Gateway to reach VPCs in multiple regions from one port instead of attaching one VGW per region. Each VIF carries its own BGP session, so separate test and production prefixes with distinct VIFs.
Verify with aws directconnect describe-connections and CloudWatch: port state and BGP state are different alarms — the port can be UP while the session is DOWN, which is exactly when users report "the link is fine."
Pitfalls and Interview Focus
Pitfalls and Interview Focus
Direct Connect does not encrypt traffic by default — a private VIF crosses the provider in plaintext-ish form relative to your control; pair it with MACsec on supported ports or an IPsec VPN (commonly run over the same DX for consistent routing with encryption).
Other realities: ports bill monthly whether idle or not, plus per-GB egress; provisioning a new port often takes weeks, so order capacity ahead of demand; a single connection is a single point of failure — deploy dual connections or a LAG plus a VPN backup; and MTU/jumbo-frame mismatches silently fragment traffic.
Interview: draw the path (router → DX port → VIF → BGP → VGW/DXGW → VPC), then discuss redundancy, encryption, and failover detection.
Quiz
1. What does a private virtual interface reach?
2. How is a Direct Connect BGP session secured?
3. Which is NOT true of Direct Connect by default?
Flashcards
Question
Dedicated vs hosted DX
Click to reveal answer
Answer
Dedicated: your own 1/10/100G port at a DX location. Hosted: partner-delivered at smaller speeds.
Question
VIF types
Click to reveal answer
Answer
Private → VPCs, public → AWS public endpoints, transit → Transit Gateway.
Question
DX Gateway
Click to reveal answer
Answer
Lets one DX port reach VPCs in multiple regions via attached VGWs.
Question
Encryption reality
Click to reveal answer
Answer
DX is unencrypted by default — MACsec or VPN provides confidentiality.
Question
Port vs BGP alarm
Click to reveal answer
Answer
Port UP ≠ BGP UP; monitor both or you will misdiagnose outages.
Revision Notes
Key Takeaways
- 1. DX = physical port + VIFs + BGP, with redundancy and encryption as separate decisions
- 2. Lead time and monthly port cost mean capacity planning starts early
- 3. VPN over DX is the standard pattern for encrypted hybrid traffic
Interview Tips
- • Draw the full path including VIF type and BGP before discussing failover
- • Always mention encryption explicitly — the classic DX interview follow-up
Cheat Sheet
DX: port + VIFs (private/public/transit) + BGP over 169.254/MD5. DX Gateway → multi-region. No default encryption → MACsec/VPN. Provisioning takes weeks; ports bill idle; alarm port AND BGP.
Continue Learning
Before You Start
- No prerequisites listed.