3.12. Direct Connect (DX) - Public VIF + VPN (Encryption)

What does using a VPN over Direct Connect provide?

Encrypted and authenticated tunnel with low and consistent latency.

Why use a Public VIF for VPN access to private VPC networks?

Because VPN endpoints (Virtual Private Gateway or Transit Gateway) use public IPs, which require a Public VIF.

What is the key difference between a Public VIF and a Private VIF?

Public VIF gives access to AWS public IP addresses; Private VIF gives access to private IPs in a VPC.

How is a VPN over Public VIF architecturally different from a VPN over the internet?

The VPN configuration is the same; only the transit path (Public VIF vs. internet) changes.

What is the difference between VPN and MACsec in terms of encryption scope?

VPN provides end-to-end encryption between Customer Gateway and AWS Gateway; MACsec encrypts a single hop on Layer 2.

Which is more widely supported: IPsec VPN or MACsec?

IPsec VPN, as it is supported by a wider range of vendors and devices.

Why is MACsec faster than VPN?

MACsec has lower cryptographic overhead and supports higher network speeds.

What is a common pattern for initial connectivity to AWS before Direct Connect is provisioned?

Start with a VPN over the internet, then add Direct Connect later.

How can VPN and Direct Connect be used together for resilience?

Use Direct Connect with an IPsec VPN as primary, and an internet-based IPsec VPN as backup.

Where are AWS VPN endpoints (for Virtual Private Gateway) located?

In the AWS Public Zone, across two Availability Zones, with public IP addresses.

Can a Public VIF be used to connect to AWS VPN endpoints in other regions?

Yes, over the AWS Global Network, enabling global encrypted transit.

Why isn't VPN over Direct Connect a competitor to MACsec?

They serve different purposes—VPN is for end-to-end encryption, MACsec is for local link encryption.

When connecting to public IPs of AWS VPN endpoints, which type of VIF must be used?

Public VIF.

What should guide your choice between Public and Private VIF?

The type of IPs you are trying to access—public IPs require a Public VIF, private IPs require a Private VIF.

What benefit does Direct Connect bring when used with VPN?

Improved latency and consistency compared to VPN over the public internet.

What is VIF + VPN?

What does the public VIF + VPN architecture look like?