Sign in Get started

Networking Tutorial · Cloud Networking · Lesson 25 of 28

Connecting Networks

Connect VPCs to each other and to on-premises networks: peering, transit gateways, VPNs and dedicated links.

Create a free account to save this page, take notes and track your progress. Sign in

Options

Need AWS Azure Google Cloud
Two networks, direct VPC peering VNet peering VPC Network Peering
Many networks, hub-and-spoke Transit Gateway (or Cloud WAN) Virtual WAN, or a hub VNet Network Connectivity Center
Share one network with many projects/accounts VPC sharing (AWS RAM) (subscriptions peer to a hub) Shared VPC
Office or data centre over the internet Site-to-Site VPN VPN Gateway Cloud VPN
Private dedicated link Direct Connect ExpressRoute Cloud Interconnect

Peering is not transitive

If A is peered with B and B with C, A can't reach C through B. With many networks you end up with a mesh of peerings (n × (n − 1) / 2 of them). A transit gateway or hub is a central router every network attaches to once.

Mesh versus hubTry it yourself
for n in [3, 5, 10, 20]:
    mesh = n * (n - 1) // 2
    print(f"{n:2} VPCs: full peering mesh {mesh:3} connections, transit gateway {n:2} attachments")

peerings = {("A", "B"), ("B", "C")}
def can_reach(x, y):
    return (x, y) in peerings or (y, x) in peerings
print("A -> C via peering:", can_reach("A", "C"), "(peering is not transitive)")

Output

 3 VPCs: full peering mesh   3 connections, transit gateway  3 attachments
 5 VPCs: full peering mesh  10 connections, transit gateway  5 attachments
10 VPCs: full peering mesh  45 connections, transit gateway 10 attachments
20 VPCs: full peering mesh 190 connections, transit gateway 20 attachments
A -> C via peering: False (peering is not transitive)

Site-to-site VPNs run encrypted IPsec tunnels over the internet: quick to set up, but with variable latency and a lower MTU because of the encryption overhead. Dedicated links (Direct Connect, ExpressRoute, Interconnect) give predictable bandwidth and latency. Both usually exchange routes with BGP, and both require non-overlapping address ranges.

Test yourself

VPC A is peered with B, and B with C. Can A reach C?

  1. Yes, through B
  2. No, peering is not transitive
  3. Only over IPv6
  4. Only for DNS traffic
Show answer

Answer: No, peering is not transitive

Peering connects exactly two networks. Use a direct peering between A and C, or a transit gateway.

Was this page helpful?