I'm trying to create a 'service vpc' in aws. That vpc will have ipsec VPN to our office ASA firewall, and will also have connections to other 10 vpc's.

'Vpc peering' is not supporting edge-to-edge routing over transitive vpc (aws docs), so the only option is using an ipsec VPN to all 10 vpc's (link below). But according to aws docs - aws vpc cannot initiate an ipsec tunnel, but only accept one.

How do I provide my 10 vpc's access to my office via transitive vpc ?

Documentation reference

  • Tell us more about your use case, and more clearly, right now it's confusing. Right now I think you have 10 VPCs in AWS and you want to provide access to each of them from your office? Or do you have 10 offices and want to provide access to one AWS VPC? – Tim Sep 26 '16 at 21:40
  • @Tim, thanks for your commnet: I have 10 VPC's and 1 office. i want to have only 1 ipsec tunnel from the office (physical ASA firewall) to a 1 transitive VPC (consider it like an aggregation point), that VPC should forward traffic to my 10 other VPC's by any way ( VPC peering OR ipsec VPN's ). hope thats clear . – chenchuk Sep 27 '16 at 5:24
  • I understand now. I know VPCs aren't transitive by default, but what if you target a NAT instance in one VPC that passes traffic to the others explicitly? I've never tried this so it may be impractical / impossible. Worth a shot though. – Tim Sep 27 '16 at 6:04
  • @Tim: Using NAT instance is an option but i think it should be more generic way to provide that functionality out-of-the-box. Sounds like a very common use-case, im pretty surprised that it seems to be unsupported – chenchuk Sep 27 '16 at 6:41

The answer is to use a Transit VPC, a relatively new feature of AWS. That blog posts contains links to all kinds of resources that will help.

Update - there's a new "AWS Answers" on VPN to multiple VPCs.

  • thanks !, i will check that option - seems promising ... – chenchuk Sep 27 '16 at 10:15
  • @chenchuk, answer updated with a new link I found today. – Tim Sep 29 '16 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.