AWS prescriptive-guidance documentation change
Summary
Replaced 'AWS Direct Connect' with 'Direct Connect' throughout the document and updated references to documentation accordingly.
Security assessment
The changes are terminological updates replacing 'AWS Direct Connect' with 'Direct Connect' without altering security configurations, protocols, or best practices. No evidence of vulnerability fixes, security incidents, or new security features. The routing policies and prefix advertisement rules referenced remain unchanged.
Diff
diff --git a/prescriptive-guidance/latest/salesforce-hyperforce-connectivity-dx-megaport/vpn-workforce.md b/prescriptive-guidance/latest/salesforce-hyperforce-connectivity-dx-megaport/vpn-workforce.md index bcb8f601f..a4ae8f234 100644 --- a//prescriptive-guidance/latest/salesforce-hyperforce-connectivity-dx-megaport/vpn-workforce.md +++ b//prescriptive-guidance/latest/salesforce-hyperforce-connectivity-dx-megaport/vpn-workforce.md @@ -5 +5 @@ -RequirementsConfiguring Megaport MVE with VXCConfiguring VNF applicancesConfiguring route filtersConfiguring AWS Direct ConnectConfiguring Megaport MVE with SECConfiguring Salesforce Hyperforce +RequirementsConfiguring Megaport MVE with VXCConfiguring VNF applicancesConfiguring route filtersConfiguring Direct ConnectConfiguring Megaport MVE with SECConfiguring Salesforce Hyperforce @@ -9 +9 @@ RequirementsConfiguring Megaport MVE with VXCConfiguring VNF applicancesConfigur -This use case covers a scenario where you use a virtual VPN concentrator at a Megaport location as an on-ramp to AWS Direct Connect. In this scenario, you have remote branch offices or workers with site-to-site VPNs that connect to the VPN concentrator. +This use case covers a scenario where you use a virtual VPN concentrator at a Megaport location as an on-ramp to Direct Connect. In this scenario, you have remote branch offices or workers with site-to-site VPNs that connect to the VPN concentrator. @@ -11 +11 @@ This use case covers a scenario where you use a virtual VPN concentrator at a Me -Using Megaport MVE with a third-party virtual firewall and AWS Direct Connect gives your remote workers private connectivity to Salesforce Hyperforce. The remote workers connect to the VPN concentrator from an internet-connected router at a branch office or from a VPN client that is running on their device. The remote workers then on-ramp to AWS Direct Connect by using a Megaport location. +Using Megaport MVE with a third-party virtual firewall and Direct Connect gives your remote workers private connectivity to Salesforce Hyperforce. The remote workers connect to the VPN concentrator from an internet-connected router at a branch office or from a VPN client that is running on their device. The remote workers then on-ramp to Direct Connect by using a Megaport location. @@ -13 +13 @@ Using Megaport MVE with a third-party virtual firewall and AWS Direct Connect gi - + @@ -21 +21 @@ Using Megaport MVE with a third-party virtual firewall and AWS Direct Connect gi - * You own an AWS account to manage the AWS Direct Connect hosted connection with Megaport. + * You own an AWS account to manage the Direct Connect hosted connection with Megaport. @@ -28 +28 @@ Using Megaport MVE with a third-party virtual firewall and AWS Direct Connect gi -The Megaport MVE that's configured with a VXC provides the private Layer 2 network segment to AWS. The MVE is a virtual solution and doesn't require a Port. However, you must specify the third-party virtual network appliance to be deployed. The VXC deployment process and functionality are the same, whether you use a Port, MVE, or MCR. AWS Direct Connect should be provisioned as a hosted connection and attached to a public VIF. +The Megaport MVE that's configured with a VXC provides the private Layer 2 network segment to AWS. The MVE is a virtual solution and doesn't require a Port. However, you must specify the third-party virtual network appliance to be deployed. The VXC deployment process and functionality are the same, whether you use a Port, MVE, or MCR. Direct Connect should be provisioned as a hosted connection and attached to a public VIF. @@ -43 +43 @@ MVE supports third-party virtual network function (VNF) appliances from vendors -For example, this use case describes a high-level architecture where Megaport MVE supports VPN/SD-WAN connections from regional branch offices and remote users who have an SSL VPN connection. This MVE peers with AWS and routes these connections privately to Hyperforce through AWS Direct Connect. +For example, this use case describes a high-level architecture where Megaport MVE supports VPN/SD-WAN connections from regional branch offices and remote users who have an SSL VPN connection. This MVE peers with AWS and routes these connections privately to Hyperforce through Direct Connect. @@ -64 +64 @@ When the VNF has established BGP peering with the AWS public VIF, the route tabl - * The prefixes advertised by AWS Direct Connect must not be advertised beyond the network boundaries of your connection. For example, these prefixes must not be included in any public internet routing table. For more information, see [Public virtual interface routing policies](https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html#routing-policies) in the AWS Direct Connect documentation. + * The prefixes advertised by Direct Connect must not be advertised beyond the network boundaries of your connection. For example, these prefixes must not be included in any public internet routing table. For more information, see [Public virtual interface routing policies](https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html#routing-policies) in the Direct Connect documentation. @@ -69 +69 @@ When the VNF has established BGP peering with the AWS public VIF, the route tabl -## Configuring AWS Direct Connect +## Configuring Direct Connect @@ -73 +73 @@ When the VNF has established BGP peering with the AWS public VIF, the route tabl -In your AWS account, accept the VXC created previously as a hosted connection. For instructions, see the [AWS Direct Connect documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/hosted_connection.html#accept-hosted-connection). +In your AWS account, accept the VXC created previously as a hosted connection. For instructions, see the [Direct Connect documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/hosted_connection.html#accept-hosted-connection). @@ -81 +81 @@ In your account, provision a public VIF under the connection you accepted from M - * Public IPv4 addresses for peering (typically `/31` CIDR). You can own these or request them from Support. For more information, see _Peer IP addresses_ in the section [Prerequisites for virtual interfaces](https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html#vif-prerequisites) in the AWS Direct Connect documentation. + * Public IPv4 addresses for peering (typically `/31` CIDR). You can own these or request them from Support. For more information, see _Peer IP addresses_ in the section [Prerequisites for virtual interfaces](https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html#vif-prerequisites) in the Direct Connect documentation. @@ -86 +86 @@ In your account, provision a public VIF under the connection you accepted from M -To create a public VIF, follow the steps in the [AWS Direct Connect documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-vif.html#create-public-vif). +To create a public VIF, follow the steps in the [Direct Connect documentation](https://docs.aws.amazon.com/directconnect/latest/UserGuide/create-vif.html#create-public-vif). @@ -92 +92 @@ After you create the public VIF, you need to make sure that the BGP authenticati -Using a public VIF to connect to AWS from your on-premises environment changes the way traffic is routed to your on-premises location from AWS. We recommend that you use a prefix filter (route map) to make sure that the accepted Amazon prefixes are limited to the Hyperforce infrastructure and any other necessary AWS resources. For more information, see [Public virtual interface prefix advertisement rules](https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html#advertise-prefixes) in the AWS Direct Connect documentation and [Hyperforce External IPs](https://compliance.salesforce.com/en/documents/a006e0000121zduAAA) in the Salesforce documentation. +Using a public VIF to connect to AWS from your on-premises environment changes the way traffic is routed to your on-premises location from AWS. We recommend that you use a prefix filter (route map) to make sure that the accepted Amazon prefixes are limited to the Hyperforce infrastructure and any other necessary AWS resources. For more information, see [Public virtual interface prefix advertisement rules](https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.html#advertise-prefixes) in the Direct Connect documentation and [Hyperforce External IPs](https://compliance.salesforce.com/en/documents/a006e0000121zduAAA) in the Salesforce documentation. @@ -96 +96 @@ Using a public VIF to connect to AWS from your on-premises environment changes t -In some cases, Hyperforce login requests are redirected to Salesforce-managed data centers. To keep this traffic on a private network, you can add a Megaport VXC to Salesforce by using SEC. You can configure your VNF security policies with rules by using the Salesforce login FQDN. This is similar to the AWS Direct Connect architecture described earlier in this guide. +In some cases, Hyperforce login requests are redirected to Salesforce-managed data centers. To keep this traffic on a private network, you can add a Megaport VXC to Salesforce by using SEC. You can configure your VNF security policies with rules by using the Salesforce login FQDN. This is similar to the Direct Connect architecture described earlier in this guide.