{"id":7580,"date":"2020-04-21T09:06:51","date_gmt":"2020-04-21T09:06:51","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/aws-transit-gateway-made-easier-with-inter-region-peering\/"},"modified":"2026-11-03T19:28:45","modified_gmt":"2026-11-03T19:28:45","slug":"aws-transit-gateway-made-easier-with-inter-region-peering","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/es\/blogs\/aws-transit-gateway-made-easier-with-inter-region-peering\/","title":{"rendered":"AWS Transit Gateway made easier with inter-region peering"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>With Amazon\u00ae Web Services (AWS), you have many paths to success and an&nbsp;abundance of tools at your disposal for meeting your individual goals based on your&nbsp;circumstances. Furthermore, AWS consistently adds new features and services to&nbsp;make our lives that little bit easier.<\/p>\n<p>One of the fundamentals when setting up your AWS environment is the Virtual&nbsp;Private Cloud (VPC), which is essential to create boundaries between the private&nbsp;and public Internet. Features core to the VPC setup include Network Access&nbsp;Control Lists (NACLs), subnets, and security groups.<\/p>\n<p><strong>Problem<\/strong><\/p>\n<p>Over the years, organizations have become more cloud-agnostic and are deploying&nbsp;many VPCs for various reasons. Whether it is to create a separation between&nbsp;development, test, and production or to meet geographical challenges&#8212;managing multiple VPCs has opened up discussions about using the appropriate<br \/>\ntoolsets.<\/p>\n<p>You can create site-to-site virtual private networks (VPNs) between VPCs. However, this increases management overhead, not to mention the costs involved&nbsp;when you consider the high availability of the VPN appliances.<\/p>\n<p>Amazon introduced AWS VPC peering, which makes this much easier. However, it did&nbsp;come with its limitations. One of the main ones is that connectivity is not&nbsp;transitive between VPCs.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture1_4.png\" alt=\"VPC Pic 1\" \/><\/p>\n<p>\nFor example, in the preceding diagram, VPC A can talk to both B and C, but B&nbsp;and C cannot talk to each other. If B and C need to communicate to each other,&nbsp;you need to set up a peering between B and C. What is more, for each peering,&nbsp;you also need to configure the routing tables.<\/p>\n<p>Eventually, you need to manage the connectivity between each VPC without having&nbsp;a central mechanism to route between VPCs. You can easily end up with a web&nbsp;similar to the one shown in the following image<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture2_2.png\" alt=\"VPC Pic 2\" \/><\/p>\n<p><strong>Solution<\/strong><\/p>\n<p>Enter AWS Transit Gateway (TGW). TGW lets you do the following:<\/p>\n<ul>\n<li>Solve the management overhead costs that you incur with VPC peering.<\/li>\n<li>Have a central location to manage your connection between VPCs.<\/li>\n<li>Manage VPCs that are in a different account than yours.<\/li>\n<li>Create a hub and spoke network, as shown in the following diagram:<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture3_1.png\" alt=\"VPC Pic 3\" \/><\/p>\n<p>\nInitially, TGW didn&#8217;t support inter-region peering, which was a major concern,&nbsp;but Amazon resolved this problem and added it to the feature list. Now, you&nbsp;can easily configure connectivity between regions.<\/p>\n<p><strong>Deployment plan<\/strong><br \/>\nAs part of the prerequisites, you set up a VPC in each of your regions&nbsp;with an EC2 instance. Ensure that you enable Internet Control Message Protocol&nbsp;(ICMP) in each security group.<\/p>\n<p>The goal is that you should be able to ping the instances from:<\/p>\n<p><em>\u2022&nbsp;&nbsp; &nbsp;VPC A &#8211;&gt; VPC B<br \/>\n\u2022&nbsp;&nbsp; &nbsp;VPC C &#8211;&gt; VPC D<\/em><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture4.png\" alt=\"VPC Pic 4\" \/><\/p>\n<p><strong>Deployment&nbsp;<\/strong><\/p>\n<p>For this setup, use a single AWS account, but you can create TGW between different AWS accounts. You can deploy TGW by using the AWS console, CLI, API, or Cloudformation. For this demo, use the console.<\/p>\n<p>Use the following steps to deploy TGW.<\/p>\n<p><strong>1. Sign in<\/strong><\/p>\n<p>Sign in to your AWS account, go to the VPC console, and select <strong>Transit Gateway<\/strong><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture5.png\" alt=\"VPC Pic 5\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>2. Create the TGW&nbsp;<\/strong><\/p>\n<p>Select <strong>Create Transit Gateway<\/strong>. Enter a name for the TGW. For this test,&nbsp;leave the rest as it is, and click <strong>Create Transit Gateway<\/strong>.<br \/>\n&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture6.png\" alt=\"VPC Pic 6\" \/><\/p>\n<p>&nbsp;It takes a few minutes for the TGW to become available.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture7.png\" alt=\"VPC Pic 7\" \/><\/p>\n<p><strong>3. Configure VPC A&nbsp;<\/strong><\/p>\n<p>Complete the following steps to configure VPC A:<\/p>\n<p>a. Go to <strong>Transit Gateway Attachments<\/strong>&nbsp;on the left side of the window and create a new attachment. Select the TGW ID you just created.<\/p>\n<p>b. Select <strong>attachment type<\/strong>: <em>`VPC`.<\/em><\/p>\n<p>c. Select the VPC ID for which you want to create the attachment. In this case,&nbsp;choose VPC A.<\/p>\n<p>d. Select all the subnets to which you want TGW to route traffic. You must select at least one subnet and can select only one subnet per Availability Zone.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture8.png\" alt=\"VPC Pic 8\" \/><\/p>\n<p><strong>4. Configure VPC B&nbsp;<\/strong><\/p>\n<p>Create a second attachment for VPC B following the preceding VPC A steps for VPC<br \/>\nB. You now have two TGW attachments<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture9.png\" alt=\"VPC Pic 9\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>5. Configure route tables&nbsp;<\/strong><\/p>\n<p>Go to <strong>Transit Gateway Route Tables<\/strong>&nbsp;from the left-hand side to see the default&nbsp;route table. Notice two routes in the <strong>Propagation<\/strong>&nbsp;tab. Propagation occurred&nbsp;automatically based on the TGW you created in the first step.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture10.png\" alt=\"VPC Pic 10\" \/><\/p>\n<p>Let&#8217;s try and ping the instance in VPC B from VPC A. What happens?<\/p>\n<p>Nothing happens because you still need to tell the traffic where to go after it enters the VPC.<\/p>\n<p>For this, you need to add a route in the route table associated with the subnet&nbsp;where the EC2 instance is located. If you also want to ping from VPC B &#8211;&gt; VPC A,&nbsp;you need to set the returning destination route back to VPC A.<\/p>\n<p>The target is the TGW ID.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture11.png\" alt=\"PVC Pic 11\" \/><\/p>\n<p>Now, run the ping test again, and you should get a response. Well done!<\/p>\n<p>\nThis completes the connection highlighted in green in the following diagram:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture12.png\" alt=\"VPC Pic 12\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>6. Configure inter-region TGW<\/strong><\/p>\n<p>Recently, AWS introduced inter-region peering with TGW. To do this, you need&nbsp;to use the <strong>Peering Connection<\/strong>&nbsp;type to create a new TGW attachment to the TGW&nbsp;based in the second region, North Virginia. The following diagram shows the&nbsp;<strong>TGW ID<\/strong>&nbsp;I created for the outside North Virginia region in this demo:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture13.png\" alt=\"VPC Pic 13\" \/><\/p>\n<p>\nGo to the <strong>n.virginia<\/strong>&nbsp;TGW attachment console and notice a peering request in&nbsp;a pending state. Go ahead and accept the request.&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture14.png\" alt=\"VPC Pic 14\" \/><\/p>\n<p><strong>7. Configure VPC C and D attachments&nbsp;<\/strong><\/p>\n<p>You need to create a new TGW attachment for VPC C and VPC D in their respective&nbsp;regions with the attachment type: <strong>VPC<\/strong>.<\/p>\n<p>The following diagrams show the VPC C and D details:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture15.png\" alt=\"VPC Pic 15\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture16.png\" alt=\"VPC Pic 16\" \/><\/p>\n<p>\n<strong>Use the following steps to configure the attachments:&nbsp;<\/strong><\/p>\n<p>a. Create an entry in the Sydney TGW route table to route traffic to the classless inter-domain routing (CIDR) range of VPC D in <strong>n.virginia&nbsp;<\/strong>region.<\/p>\n<p><strong>NOTE<\/strong>: Make sure to select the correct attachment that references the <em>peering&nbsp;<\/em>and not the <em>VPC attachment<\/em>&nbsp;type.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture17.png\" alt=\"VPC Pic 17\" \/><\/p>\n<p><strong>NOTE:<\/strong> Make sure to select the correct attachment that references the <em>peering&nbsp;<\/em>and not the <em>VPC attachment<\/em>&nbsp;type.&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture17_0.png\" alt=\"PVC Image 17\" \/><\/p>\n<p>b. Do the same action in the <strong>n.virginia<\/strong>&nbsp;region to route traffic to VPC C.&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26448-body-Picture18.png\" alt=\"VPC Pic 18\" \/><\/p>\n<p><strong>&nbsp;8. Configure the route table&nbsp;<\/strong><\/p>\n<p>To complete the setup, you need to add a route to the route table associated with the subnet in which the EC2 instance located. If you also want to ping from&nbsp;VPC D &#8211;&gt; VPC C, you need to set the return destination route back to VPC C.&nbsp;<\/p>\n<p>After you do that, if you ping from VPC C to VPC D, you should get a response.&nbsp;If you are not getting a response, ensure that you opened security groups to&nbsp;accept ICMP traffic. If all else fails, take a look at the routes to ensure you&nbsp;configured them correctly.<br \/>\n&nbsp;<\/p>\n<p><strong>Summary<\/strong><\/p>\n<p>TGW supports attachments for your direct-connect and site-to-site VPN. You can&nbsp;now create transitive networks, where previously you needed third-party appliances&nbsp;to manage all this.<\/p>\n<p>TGW is a welcome solution to the AWS networking feature list. Furthermore, the&nbsp;addition of inter-region peering with TGW has made life that little bit simpler&nbsp;when managing multiple VPCs located in various regions around the globe.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>AWS Transit Gateway made easier with inter-region peering<\/p>\n","protected":false},"author":2,"featured_media":7582,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26448","content_type":"blog","created_by":"10130","authored_on":"2024-01-05T10:06:51+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Nilojan Tharmarajah, Lead Cloud Practice Architect, Rackspace Technology","seo_description":"Understand the essentials of setting up an AWS environment, focusing on the Virtual Private Cloud (VPC) and inter-region peering.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26448-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Amazon Web Services (AWS)","product":"","publisheddate":"2020-04-21T09:06:51","rxt_solutions":"Cloud Adoption & Migration, Cloud Management & Operations","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":" AWS Gateway Inter-Region Peering | Rackspace Technology","field_topics":"","field_slug":"aws-transit-gateway-made-easier-with-inter-region-peering","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7580","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/blogs\/7580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/comments?post=7580"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/blogs\/7580\/revisions"}],"predecessor-version":[{"id":9561,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/blogs\/7580\/revisions\/9561"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/media\/7582"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/media?parent=7580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/categories?post=7580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/es\/wp-json\/wp\/v2\/tags?post=7580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}