AWS outposts documentation change
Summary
Updated LAG configuration details from 2 to 4 connections, added console navigation instructions for viewing LAG/VLAN/BGP details, clarified BGP peering setup, and improved terminology consistency.
Security assessment
Changes focus on clarifying network configuration requirements (e.g., increasing LAG count from 2 to 4) and documenting console-based monitoring features. No mention of vulnerabilities, patches, or security controls. Updates are operational/configuration clarifications rather than security-related content.
Diff
diff --git a/outposts/latest/network-userguide/outposts-rack2ndgen-local-rack.md b/outposts/latest/network-userguide/outposts-rack2ndgen-local-rack.md index 1b24ada83..677e093b7 100644 --- a//outposts/latest/network-userguide/outposts-rack2ndgen-local-rack.md +++ b//outposts/latest/network-userguide/outposts-rack2ndgen-local-rack.md @@ -13 +13 @@ You need the following components to connect your Outposts network racks to your - * Link Aggregation Control Protocol (LACP) to establish two link aggregation group (LAG) connections to your Outpost network devices and to your local network devices. + * Link Aggregation Control Protocol (LACP) to establish link aggregation group (LAG) connections between your Outpost network devices and your local network devices. @@ -47 +47 @@ You need the following components to connect your Outposts network racks to your -AWS Outposts uses the Link Aggregation Control Protocol (LACP) to establish two link aggregation group (LAG) connections, one from each Outpost network device within the Outposts Network rack to each customer upstream network device. The links from each Outpost network device are aggregated into an Ethernet LAG to represent a single network connection. These LAGs use LACP with standard fast timers. You can't configure LAGs to use slow timers. +AWS Outposts uses the Link Aggregation Control Protocol (LACP) to establish four link aggregation group (LAG) connections, one from each Outpost network device within the Outposts Network rack to each customer upstream network device. The links from each Outpost network device are aggregated into an Ethernet LAG to represent a single network connection. These LAGs use LACP with standard fast timers. You can't configure LAGs to use slow timers. @@ -53 +53 @@ From a logical perspective, ignore the Outpost patch panels as the demarcation p -For deployments that have multiple racks, an Outpost must have four LAGs between the aggregation layer of the Outpost network devices and your local network devices. +You can review your LAG details on the AWS Outposts console: Choose **Networking** and then **Link aggregation groups (LAGs)** from the left pane. @@ -72 +72 @@ Each Outpost has the following VLANs to communicate with your local network devi -You can configure the service link VLAN and local gateway VLAN only between the Outpost and your customer local network devices. +You can configure the service link VLAN and local gateway VLAN only between the Outpost and your customer local network devices. You can review your service link and LGW VLAN information on the AWS Outposts console: choose **Networking** and then **Link aggregation groups (LAGs)** from the navigation pane. Select the link aggregation group. Choose the **LGW virtual interfaces (VIFs)** and **Service link virtual interfaces (VIFs)** tabs to see the **VLAN** value. @@ -101,0 +102,2 @@ For the network layer connectivity, you must establish two paths: +You can review your service link and LGW IP connectivity information on the AWS Outposts console: Choose **Networking** and then **Link aggregation groups (LAGs)** from the left pane. Select the link aggregation group. Choose the **LGW virtual interfaces (VIFs)** and **Service link virtual interfaces (VIFs)** tabs to see the IP values. + @@ -104 +106,3 @@ For the network layer connectivity, you must establish two paths: -The Outpost establishes an external BGP peering session between each Outpost network device and the customer local network device for service link connectivity over the service link VLAN. The BGP peering session is established between the /31 IP addresses provided for the point-to-point VLAN. Each BGP peering session uses a private Autonomous System Number (ASN) on the Outpost network device and an ASN that you choose for your customer local network devices. AWS provides the attributes as part of the installation process. +The Outpost establishes an external BGP peering session between each Outpost network device and the customer local network device for service link connectivity over the service link VLAN. The BGP peering session is established between the /31 IP addresses provided for the point-to-point VLAN. Each BGP peering session uses a private Autonomous System Number (ASN) on the Outpost network device and an ASN that you choose for your customer local network devices. As part of the installation process, AWS configures the attributes that you provided. + +You can review your BGP information on the AWS Outposts console: Choose **Networking** and then **Link aggregation groups (LAGs)** from the navigation pane. Select the link aggregation group. Choose the **LGW virtual interfaces (VIFs)** and **Service link virtual interfaces (VIFs)** tabs to see the BGP values. @@ -110,2 +113,0 @@ You provide a /24 CIDR range during the pre-installation process for the _servic -You must provide a service link BGP ASN and an infrastructure subnet CIDR (/24) for the Outpost. For each Outpost network device, provide the BGP peering IP address on the VLAN of the local network device and the BGP ASN of the local network device. - @@ -114 +116 @@ You must provide a service link BGP ASN and an infrastructure subnet CIDR (/24) -The Outpost establishes an external BGP peering from each Outpost network device to a local network device for connectivity to the local gateway. It uses a private Autonomous System Number (ASN) that you assign in order to establish the external BGP sessions. Each Outpost network device has a single external BGP peering to a local network device using its local gateway VLAN. +The Outpost uses a private Autonomous System Number (ASN) that you assign in order to establish the external BGP sessions. Each Outpost network device has a single external BGP peering to a local network device using its local gateway VLAN. @@ -118 +120 @@ The Outpost establishes an external BGP peering session over the local gateway V -Each BGP session uses the private ASN on the Outpost network device side, and an ASN that you choose on the customer local network device side. AWS configures the attributes as part of the pre-installation process. +Each BGP session uses the private ASN on the Outpost network device side, and an ASN that you choose on the customer local network device side. @@ -120 +122 @@ Each BGP session uses the private ASN on the Outpost network device side, and an -We recommend that you configure customer network equipment to receive BGP advertisements from Outposts without changing the BGP attributes, and enable BGP multipath/load balancing to achieve optimal inbound traffic flows. AS-Path prepending is used for local gateway prefixes to shift traffic away from ONDs if maintenance is required. The customer network should prefer routes from Outposts with an AS-Path length of 1 over routes with an AS-Path length of 4. +We recommend that you configure customer network equipment to receive BGP advertisements from Outposts without changing the BGP attributes, and enable BGP multipath/load balancing to achieve optimal inbound traffic flows. AS-Path prepending is used for local gateway prefixes to shift traffic away from network devices if maintenance is required. The customer network should prefer routes from Outposts with an AS-Path length of 1 over routes with an AS-Path length of 4. @@ -122 +124 @@ We recommend that you configure customer network equipment to receive BGP advert -The customer network should advertise equal BGP prefixes with the same attributes to all ONDs. The Outpost network load balances outbound traffic between all uplinks by default. Routing policies are used on the Outpost side to shift traffic away from an OND if maintenance is required. This traffic shift requires equal BGP prefixes from the customer side on all ONDs. If maintenance is required on the customer network, we recommend that you use AS-Path prepending to temporarily shift traffic array from specific uplinks. +The customer network should advertise equal BGP prefixes with the same attributes to all network devices. The Outpost network load balances outbound traffic between all uplinks by default. Routing policies are used on the Outpost side to shift traffic away from a network device if maintenance is required. This traffic shift requires equal BGP prefixes from the customer side on all network devices. If maintenance is required on the customer network, we recommend that you use AS-Path prepending to temporarily shift traffic array from specific uplinks. @@ -126 +128 @@ The customer network should advertise equal BGP prefixes with the same attribute -By default, the local gateway uses the private IP addresses of instances in your VPC to facilitate communication with your on-premise network. However, you can provide a customer-owned IP address pool (CoIP). +By default, the local gateway uses the private IP addresses of instances in your VPC (see [Direct VPC routing](https://docs.aws.amazon.com/outposts/latest/network-userguide/routing.html#direct-vpc-routing)) to facilitate communication with your on-premise network. However, you can provide a customer-owned IP address pool (CoIP). @@ -128 +130 @@ By default, the local gateway uses the private IP addresses of instances in your -If you choose CoIP, AWS creates the pool from information you provide during the installation process. You can create Elastic IP addresses from this pool, and then assign the addresses to resources on your Outpost, such as EC2 instances. +You can create Elastic IP addresses from this pool, and then assign the addresses to resources on your Outpost, such as EC2 instances.