# TGW hub: one transit, two VPN tunnels, route tables are policy Source: https://ai.techclick.in/blog_aws_tgw_vpn_hub Markdown: https://ai.techclick.in/blog_aws_tgw_vpn_hub.md Publisher: Techclick Infosec Pvt Ltd TGW hubs many VPCs plus Site-to-Site VPN. Two tunnels. Do not peer-mesh 20 VPCs. TGW route tables are policy. ## The ticket Third app VPC is coming. Someone already requested peering to hub, to app, and to tomorrow’s VPC. Phase-1 to 203.0.113.60 is “up” on one tunnel. Priya on 10.20.30.80 still cannot reach 10.51.0.0/16 . The missing object is a TGW route, not another peer. Quick interview answer Transit Gateway is a regional hub: VPC attachments, Site-to-Site VPN attachments, Direct Connect, peering. You do not mesh twenty VPCs with peering. TGW route tables (association + propagation, or static) decide which attachments can talk — that is the isolation policy. AWS Site-to-Site VPN creates two tunnels for the connection; design for both, not one green peer. A virtual private gateway (VGW) attaches VPN to one VPC (this lab’s dummy VGW public 203.0.113.60 ). Prefer VPN on the TGW when many VPCs must reach on-prem FortiGate 203.0.113.10 / 10.20.30.0/24 . Hero · hub not mesh Peering mesh is a ticket factory. TGW route tables are the policy. Lab data · dummy only Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10 . Dummy account ID. Not yours. ## Mental model Object Job This lab tgw-lab Hub for many VPCs + VPN Attachments: hub 10.50.0.0/16, app 10.51.0.0/16, VPN TGW route table Who can reach whom Shared-services RT vs isolated-app RT Site-to-Site VPN Two tunnels to the customer gateway CGW = FortiGate 203.0.113.10 VGW 203.0.113.60 VPN onto a single VPC Fine for one VPC; do not scale it as a mesh Hub with two tunnels FortiGate 203.0.113.10 tun-1 tun-2 - tgw-lab hub 10.50.0.0/16 app 10.51.0.0/16 One tunnel down is a maintenance event, not an outage — if you built both. https://111122223333.signin.aws.amazon.com/console Training mock · not live AWS console VPC IAM S3 CloudTrail VPC → Transit gateways / Site-to-Site VPN ### tgw-lab + vpn-onprem TGW tgw-lab VPC attachments hub 10.50.0.0/16 · app 10.51.0.0/16 Customer gateway 203.0.113.10 (FortiGate) · static / BGP as designed VPN Two tunnels · attached to tgw-lab (not a 20-VPC peer mesh) TGW RT Association + routes · 10.20.30.0/24 via VPN · isolation if required Cancel Save TGW route tables are the policy. Training mock. ## How to choose Need Use Do not 2–3 VPCs, never more, no on-prem Peering can still be honest Promise it stays at three Many VPCs + on-prem TGW hub + VPN attachment Peer-mesh 20 VPCs One VPC only + on-prem VGW 203.0.113.60 is valid Pretend VGW is a multi-VPC hub Isolate prod from sandbox Separate TGW route tables One RT with every attachment propagated ## Runbook #### Side A — attachments Create tgw-lab . Attach hub and app VPCs (subnets in each AZ you actually use). Associate each attachment to the intended TGW RT. - #### Side B — VPN Customer gateway 203.0.113.10 . VPN on the TGW. Configure both tunnels on the FortiGate. On-prem LAN 10.20.30.0/24 must be in the TGW RT; AWS prefixes must be on the FortiGate. - #### Side C — prove Both tunnels up. Ping from 10.20.30.80 to an app IP. describe-transit-gateway-route-tables shows the prefix. One tunnel down — traffic still flows. aws cli · TGW + VPN aws ec2 describe-transit-gateways --filters Name=tag:Name,Values=tgw-lab aws ec2 describe-transit-gateway-attachments --filters Name=transit-gateway-id,Values=tgw-labxxxxxxxxx # vpc-hub, vpc-app, vpn-onprem aws ec2 describe-vpn-connections --query 'VpnConnections[].{State:State,Tunnels:VgwTelemetry}' # two tunnels · both UP aws ec2 search-transit-gateway-routes --transit-gateway-route-table-id tgw-rtb-lab \ --filters Name=route-search.exact-match,Values=10.20.30.0/24 # Type: static/propagated Attachment: vpn-onprem ## Four failures ### 1 · One tunnel “is fine” AWS gives you two. Patch day on the FortiGate will prove why. ### 2 · Attachments exist, TGW RT does not have the prefix Blackhole. Association ≠ a route. Search the TGW RT. ### 3 · VPC route table still has no 10.20.30.0/24 → tgw-lab TGW can be perfect. The VPC RT never sent the packet to the attachment. ### 4 · Peer-mesh plus TGW Two control planes, asymmetric paths, duplicate CIDRs. Pick the hub. ## How to prove it Close only when 1) Both VPN tunnels are up. 2) TGW RT has 10.20.30.0/24 and the VPC CIDRs. 3) Each VPC RT points those prefixes at tgw-lab. 4) You did not add another peering “just in case.” ## Traps Symptom Look at IKE up, no ICMP Phase-2 / TGW RT / VPC RT / SG / NACL Works to hub, not to app Separate TGW RT isolation — often intentional Only tunnel-1 up FortiGate second peer, PSK, or replay window — not “AWS is down” ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Why TGW instead of peering 20 VPCs? Peering cannot work at all A hub + TGW route tables beat a mesh of point-to-point peers TGW replaces IAM TGW encrypts S3 Correct: b . Hub, not mesh. Q2 AWS Site-to-Site VPN is designed with… Exactly one tunnel Two tunnels No customer gateway S3 ACLs Correct: b . Two tunnels. Q3 What is the isolation policy on a TGW? The TGW route tables (association / routes) The S3 bucket ACL Root MFA only GuardDuty Correct: a . RT is policy. Q4 VGW 203.0.113.60 is the right story when… You have one VPC and a VPN You are meshing 20 VPCs You need org SCPs You need KMS Correct: a . VGW is per VPC. Q5 On-prem LAN in this lab? 10.20.30.0/24 behind FortiGate 203.0.113.10 10.51.0.0/16 on-prem The TGW ASN only 111122223333/32 Correct: a . Dummy lab. Q6 VPN up, ping dead, TGW RT missing 10.51.0.0/16. Fix? Add the route / propagation on the TGW RT — not another peer Disable both tunnels Make S3 public Delete AppEC2Role Correct: a . RT hole. Check answers Reset AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview ## Sources - Amazon VPC Transit Gateway — What is a transit gateway . - AWS Site-to-Site VPN — What is AWS Site-to-Site VPN . Related: AWS session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt