Transit routers connect virtual private clouds (VPCs), virtual border routers (VBRs), IPsec-VPN connections, and Cloud Connect Network (CCN) instances into a unified enterprise network. With custom route tables, routing policies, and traffic-forwarding rules, transit routers support intra-region communication, inter-region connectivity, and hybrid cloud access — giving enterprises a flexible, scalable foundation for cloud networking.
Intra-region networking
Traffic flows directly between network instances in the same region through a shared transit router — no peering connections required between individual VPCs.
Use case | Attach network instances in the same region to a transit router to enable intra-region communication. |
Key operations | Create a transit router and attach the network instances that need to communicate. |
References |
Inter-region networking
Traffic travels from a network instance in one region to its local transit router, crosses the inter-region connection to a transit router in the target region, and reaches the destination network instance.
Use case | Attach network instances in different regions to transit routers, then establish an inter-region connection between the transit routers to enable inter-region communication. |
Procedure | Create transit routers in the regions to connect, attach network instances to each transit router, and establish an inter-region connection between the transit routers. |
References |
Hybrid cloud networking
On-premises traffic enters the cloud through a VBR, CCN instance, or IPsec-VPN connection — all attached to a transit router — and routes to the target VPC. The same transit router enables on-premises networks to communicate with each other through the cloud.
Use case | Attach VPCs, VBRs, CCN instances, and IPsec-VPN connections to transit routers. Attach VBRs, CCN instances, and IPsec-VPN connections to on-premises networks to enable communication between cloud and on-premises networks, and between on-premises networks. |
Procedure | Create transit routers in the target regions, attach network instances to each transit router, and establish an inter-region connection between the transit routers. |
References |
Enterprise-class networking
Transit routers support custom routing, network isolation, and traffic-redirection policies — the building blocks for enterprise-class network design.
Centralized internet egress for multiple VPCs
Internet-bound traffic from all VPCs routes through the transit router to a single Internet-facing VPC, which handles the outbound connection. This consolidates egress management and reduces the attack surface.
Use case | Route internet-bound traffic from multiple VPCs through a single egress VPC using custom routing policies. This simplifies network management and improves workload security. |
Procedure | Create transit routers in the target regions, attach VPCs to the transit routers, establish inter-region connections between the transit routers, and create custom route tables and routes to forward internet-destined traffic to the Internet-facing VPC. |
Secure communication among VPCs
Untrusted traffic between VPCs is redirected to a dedicated security VPC for scrubbing before reaching its destination. Trusted traffic routes directly, keeping inspection overhead minimal.
Use case | Use custom routing policies to separate trusted from untrusted traffic. Route untrusted traffic to a dedicated VPC running security services for scrubbing before it reaches the destination. |
Procedure | Create transit routers in the target regions, attach VPCs to the transit routers, establish inter-region connections between the transit routers, and create custom route tables and routes to redirect untrusted traffic to the security VPC. |
References | Use an Enterprise Edition transit router to filter traffic for secure communication |
Shared services across multiple CEN instances
Each CEN instance's transit router connects to the shared-services VPC and forwards requests to it. The shared-services VPC serves all CEN instances without requiring a separate connection to each.
Use case | A VPC can be attached to multiple transit routers. If multiple CEN instances need to access services in a VPC, attach the VPC to the transit router of each CEN instance. The transit routers forward requests from their respective CEN instances to the VPC. |
Procedure | Attach the shared-services VPC to each CEN instance's transit router, and add routes on each transit router to forward requests from that CEN instance to the VPC. |
References |