Building Hub-and-Spoke Network Topology with Transit Gateway

45 minutes
  • 4 Learning Objectives

About this Hands-on Lab

In this hands-on lab, we will build a hub-and-spoke network topology with Transit Gateway and attach two VPCs. We will review the propagated routes on the Transit Gateway, create the appropriate routes in our VPCs, and validate the connectivity. We will also do some troubleshooting to see why our environment is not working as we thought it should.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Configure AWS Transit Gateway
  1. Click Create Transit Gateway.
  2. Add name: "labtransitgw".
  3. Copy and paste the name for the description.
  4. Add "65065" for the Amazon side ASN.
  5. Leave DNS support and ECMP enabled.
  6. Leave the default route table propagation.
  7. Click Create Transit Gateway.
Attach Three VPCs to Transit Gateway and Create the Appropriate VPC Routes
  1. Click Create Transit Gateway Attachment.
  2. Select our Transit Gateway.
  3. Add "VPC1" as the attachment name.
  4. Select VPC1 for the VPC ID.
  5. Select the Public Subnet for Subnet ID.
  6. Click Create Attachment.
  7. Repeat the same steps for VPC2 and VPC3.
Create the Appropriate Routes on the VPCs
  1. Under Route tables, select Public1-RT.
  2. Click Edit routes and add a route to VPC2: Add, and choose our transit gateway as the target.
  3. Add another route for VPC3: Add, and choose our transit gateway as the target.
  4. Click Save routes.
  5. Select Public2-RT, click the Routes tab, click Edit routes, and add route to VPC1: Add, and choose our transit gateway as the target.
  6. Add another route for VPC3: Add, choose our transit gateway as the target.
  7. Click Save routes.
  8. Select Public3-RT, click the Routes tab, click Edit routes, and add a route to VPC1: Add, and choose our transit gateway as the target.
  9. Add another route to VPC2: Add and choose our transit gateway as the target.
  10. Click Save routes.
Validate Connectivity from Terminal to all VPCs
  1. Open Terminal.

  2. Log in to EC2 INSTANCE1 (using the credentials provided on the lab page):

    ssh cloud_user@<INSTANCE1_PUBLIC_IP>
  3. Ping the public IP address of INSTANCE2.

  4. Ping the private IP address of INSTANCE2.

  5. Ping the private IP address of INSTANCE3.


  1. In the AWS console, check INSTANCE3‘s NACLs, SG, subnet association, and update NACLs.
  2. Delete the VPC3 transit gateway attachment.
  3. Create a new VPC3 transit gateway attachment, and select the private subnet ID.
  4. Add routes to VPC1 and VPC2 using the transit gateway to your Private3-RT.
  5. Add routes to Private3-RT to VPC1 and VPC2.
  6. Try to ping the private IP address of INSTANCE3 again.

Additional Resources

You were just hired for a company that has multiple corporate VPCs in their environment. Due to recent compliance requirements, communication between each VPC must be made available. Let's see how we can easily meet the new requirements along with troubleshooting our environment's architecture.

Log in to the AWS Management Console using the credentials provided, and make sure you are in the us-east-1 (N. Virginia) region.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Get Started
Who’s going to be learning?

How many seats do you need?

  • $499 USD per seat per year
  • Billed Annually
  • Renews in 12 months

Ready to accelerate learning?

For over 25 licenses, a member of our sales team will walk you through a custom tailored solution for your business.


Sign In
Welcome Back!
Thanks for reaching out!

You’ll hear from us shortly. In the meantime, why not check out what our customers have to say about ACG?