The following sections provide high-availability options for redundant VPN connections, redundant AWS Direct Connect connections, and an AWS Direct Connect connection with a backup VPN connection. An organization’s business-availability and application requirements will help determine the most appropriate configuration for each use case. For example, the most highly available option is to implement multiple AWS Direct Connect connections with circuits from different telecommunication providers, with an additional IPsec VPN backup connection.

While every customer network is unique, for illustrative purposes we will use the diagram to the right to represent a configuration of multiple customer data centers. The following configurations assume an internal, back-end network (depicted in the diagram as the Customer WAN/MAN) with internal routing protocols that are already configured to make the appropriate path selection to AWS. It is important to maintain a common database of routes originating from AWS VPC to ensure a common routing topology and to improve route convergence in the event a route to AWS fails. A common approach is to configure iBGP between customer data centers to maintain this database, however any internal routing protocol that can accept or translate BGP metrics from AWS should be sufficient.