Privately connecting to partner VPCs as application Consumer or Provider

Requirement:

1. Partner's (consumer) VPC needs access to apps in your VPC

Partner should only be allowed to access specific VPCs

2. You need to access services in a provider's VPC

Applications should only be able to access specific provider VPCs and applications

• Must provision a simple and secure access method without exposing the service to internet

• Provide optionality of enforcing NGFW inspection

• Provide visibility into how traffic is moving with ability to look at flows and take packet captures

Solution:

1. Partner's (consumer) VPC needs access to apps in your VPC:

• Create a dedicated services spoke

• Deploy Aviatrix GWs (scale out) configured with Advance SNAT and DNAT

• VPC Peering between services VPC and partner's consumer VPC

• Optionally add NLBs infront of Aviatrix NAT GWs.

• Only NLB IP is exposed to consumer Partner.

• Aviatrix Gateway does NAT and Aviatrix Transit builds encrypted communication

• Optionally insert NextGen Firewalls for transparent inspection

• Deploy Aviatrix CoPilot for visibility and day2 operations.

2. You need to access services in a provider's VPC

• Very similar to the first requirement but in the opposite direction

• Aviatrix Spoke GWs in the services VPC can also be configured to NAT the traffic

• Configure DNAT rule for the IP provided by partner in Provider-VPC

• Source application will point traffic to the DNAT IP configured on Spoke GWs of Services VPC

• Aviatrix Transit builds encrypted communication

• Optionally insert NextGen Firewalls for transparent inspection

• Deploy Aviatrix CoPilot for visibility and day2 operations.

The following NAT configurations would be applied to the Aviatrix Spoke GWs

• Traffic from apps in spoke-1 will be destined to the LB in dedicated services spoke

• NLB should be configured with IP of the Aviatrix Spoke GWs (not instance-IDs) as target pool members

• NLB will send the traffic to Aviatrix Spoke GWs on the GW IP

• Aviatrix Spoke GWs will DNAT the traffic and send to actual destination in the provider VPC with its address as source

• Return traffic will come to Aviatrix Spoke GWs, to LB and off to original source via Aviatrix Transit