BGP over IPSec to Amazon AWS

[PhilipDAth]

I just did an experiment with using BGP over IPSec to Amazon AWS with MX 19.2.3.

https://documentation.meraki.com/MX/Site-to-site_VPN/BGP_routing_over_IPsec_VPN

And it now works (never used to)!  I have stood up two tunnels to an Amazon AWS VPN gateway.  Fully HA.

For clients using dual VMXs - I think this will be my new preferred way of making them HA inside of Amazon AWS as well.

[JamesT91]

---

@PhilipDAth wrote:

For clients using dual VMXs - I think this will be my new preferred way of making them HA inside of Amazon AWS as well.

---

Out of curiosity - why would you prefer this over dual vMX's?

[PhilipDAth]

If the client has lots of sites, I would use dual VMXs, but then use BGP over IPSEC from each VMX to an Amazon AWS VPN or Transit gateway.

Currently, I rely on using Lambda scripts performing automations to detect scripts and update configs to handle the failover.

This is so much cleaner.

If the customer has a small number of sites, I'm now just as likely to use this approach to go from MXs in a DC straight to Amazon AWS.

[JamesT91]

Makes sense - thanks Philip.