Lessons Learned Deploying AWS Direct Connect + Transit Gateway

Hybrid environments have moved from being the exception to becoming part of the strategy for many companies. Integrating on-premises datacenters with the cloud requires much more than simply provisioning resources in the cloud — it demands a deep understanding of networking, routing, and connectivity.

Working recently on a scenario using AWS Direct Connect integrated with AWS Transit Gateway made it even clearer how networking knowledge makes a real difference in the stability and correct operation of an architecture.

The project seemed straightforward at first: allow communication between on-premises environments and multiple VPCs in AWS through a private connection. However, as the topology evolved, small networking details began to directly impact how the environment functioned.

A few points that proved critical during the configuration:

Proper planning of CIDR blocks to avoid network overlap. Understanding the routing flow between:

  • Subnet Route Tables
  • Transit Gateway Route Tables
  • TGW Propagations and Associations
  • On-premises environment routes

Controlling asymmetric traffic, especially when a firewall exists between environments. Understanding how Direct Connect forwards traffic through the Virtual Interface (VIF) and BGP. The need to align routes between the cloud and the datacenter to avoid scenarios where:

  • the instance can reach the gateway,
  • but cannot reach the on-premises environment.

Understanding the difference between connectivity within the VPC and hybrid connectivity flowing through the Transit Gateway.

One interesting observation is that, in many cases, the problem is not in AWS itself, but in traditional networking concepts:

  • return route,
  • incorrect propagation,
  • stateful firewall,
  • NAT,
  • MTU,
  • traffic asymmetry,
  • missing BGP advertisements.

During testing, for example, it was possible to validate scenarios where:

  • the EC2 instance could reach the Transit Gateway interfaces,
  • the Direct Connect was operational,
  • but traffic was not returning correctly from the on-premises environment due to a missing return route.

This kind of situation reinforces something important: the cloud does not eliminate the need for infrastructure and networking knowledge. In practice, it demands an even deeper understanding of these concepts.

AWS Transit Gateway greatly simplifies building centralized architectures, especially in multi-VPC and hybrid scenarios, but it also adds a new routing layer that needs to be thoroughly understood.

Some key takeaways from this project:

  • Always validate the complete round-trip traffic flow.
  • Clearly map all route tables involved.
  • Document TGW propagations and associations.
  • Use tools such as:
    • traceroute,
    • Reachability Analyzer,
    • VPC Flow Logs,
    • tcpdump,
    • end-to-end connectivity tests.
  • Think through the topology before implementation to avoid unnecessary complexity.

In the end, hybrid projects demonstrate how classic networking knowledge remains extremely relevant even in modern cloud computing environments.

AWS, Direct Connect, and Transit Gateway are powerful tools — but the foundation is still networking.