AWS directconnect documentation change
Summary
Updated terminology from 'transit gateway' to 'Transit Gateway' for consistency. Clarified BGP ASN behavior when attaching private virtual interfaces to virtual private gateways vs Direct Connect gateways. Added specific MTU size (8500 bytes) for jumbo frames on Transit Gateways.
Security assessment
Changes are documentation refinements without security implications. The ASN clarification improves configuration accuracy but doesn't address vulnerabilities. The jumbo frame specification is a technical detail update. No security vulnerabilities or weaknesses are mentioned or addressed.
Diff
diff --git a/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.md b/directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.md index 17ccd69e2..ac4465fb3 100644 --- a//directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.md +++ b//directconnect/latest/UserGuide/WorkingWithVirtualInterfaces.md @@ -66 +66 @@ Private virtual interface attached to a Direct Connect gateway with a virtual ga -Private virtual interface attached to a Direct Connect gateway _not_ associated with a virtual gateway or transit gateway | Supported +Private virtual interface attached to a Direct Connect gateway _not_ associated with a virtual gateway or Transit Gateway | Supported @@ -70 +70 @@ Public virtual interface | Not supported -Traffic routing behavior for traffic from AWS Regions (virtual or transit gateways) to on-premises locations over a SiteLink enabled virtual interface varies slightly from the default Direct Connect virtual interface behavior with an AWS path prepend. When SiteLink is enabled, virtual interfaces from an AWS Region prefer a BGP path with a lower AS path length from a Direct Connect location, regardless of the associated Region. For example , an associated Region is advertised for each Direct Connect location. If SiteLink is disabled, by default traffic coming from a virtual or transit gateway prefers a Direct Connect location that is associated with that AWS Region, even if the router from Direct Connect locations associated with different Regions advertises a path with a shorter AS path length. The virtual or transit gateway still prefers the path from Direct Connect locations local to the associated AWS Region. +Traffic routing behavior for traffic from AWS Regions (virtual or Transit Gateways) to on-premises locations over a SiteLink enabled virtual interface varies slightly from the default Direct Connect virtual interface behavior with an AWS path prepend. When SiteLink is enabled, virtual interfaces from an AWS Region prefer a BGP path with a lower AS path length from a Direct Connect location, regardless of the associated Region. For example , an associated Region is advertised for each Direct Connect location. If SiteLink is disabled, by default traffic coming from a virtual or Transit Gateway prefers a Direct Connect location that is associated with that AWS Region, even if the router from Direct Connect locations associated with different Regions advertises a path with a shorter AS path length. The virtual or Transit Gateway still prefers the path from Direct Connect locations local to the associated AWS Region. @@ -92 +92 @@ Resource | Required information -(Private virtual interface only) **Connection** | For connecting to a VPC in the same AWS Region, you need the virtual private gateway for your VPC. The ASN for the Amazon side of the BGP session is inherited from the virtual private gateway. When you create a virtual private gateway, you can specify your own private ASN. Otherwise, Amazon provides a default ASN. For more information, see [Create a Virtual Private Gateway](https://docs.aws.amazon.com/vpc/latest/userguide/SetUpVPNConnections.html#vpn-create-vpg) in the _Amazon VPC User Guide_. For connecting to a VPC through a Direct Connect gateway, you need the Direct Connect gateway. For more information, see [Direct Connect Gateways](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways.html). +(Private virtual interface only) **Connection** | For connecting to a VPC in the same AWS Region, you need the virtual private gateway for your VPC. When you attach a private virtual interface directly to a virtual private gateway (with no Direct Connect gateway), the Amazon side of the BGP session uses the ASN that is configured on the virtual private gateway. When you attach the private virtual interface to a Direct Connect gateway instead, the Amazon side uses the Direct Connect gateway's ASN. When you create a virtual private gateway, you can specify your own private ASN. Otherwise, Amazon provides a default ASN. For more information, see [Create a Virtual Private Gateway](https://docs.aws.amazon.com/vpc/latest/userguide/SetUpVPNConnections.html#vpn-create-vpg) in the _Amazon VPC User Guide_. For connecting to a VPC through a Direct Connect gateway, you need the Direct Connect gateway. For more information, see [Direct Connect Gateways](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways.html). @@ -165 +165 @@ After you enable jumbo frames for your private virtual interface or transit virt -Jumbo frames will apply only to propagated routes via Direct Connect and static routes via transit gateways. Jumbo frames on transit gateways support only 8500 bytes. +Jumbo frames will apply only to propagated routes via Direct Connect and static routes via Transit Gateways. Jumbo frames on Transit Gateways support only 8500 bytes.