This section describes how to activate or deactivate your Verizon Secure Cloud Interconnect (SCI) Customer Connection to your Amazon Web Services (AWS) Account. The activation will establish a network connection to your AWS Account. The deactivation will remove the network connection from your AWS Account.

Note: Please make sure you have read the main Verizon SCI Welcome Kit to understand the main SCI principles, please go to https://www.verizon.com/business/welcome-kits/sci/

Note: Please make sure you have read AWS Direct Connect service information, please go to https://aws.amazon.com/directconnect/

Note: The SCI Customer Connection activation and deactivation can only be performed after the SCI Customer Connection is successfully added to your Verizon Account.

Note: To remove the SCI Customer Connection from your Verizon Account you need to place a disconnect order through the Verizon Enterprise Centre customer portal or you can ask your Verizon Account Team to place a disconnect order.

1. Please make sure to first deactivate your SCI Customer Connection before you remove the connection from your Verizon Account by following the deactivation procedure below.
2. Please make sure you have read “The rules for change and disconnect Aggregated Billing orders” section in the main Verizon SCI Welcome Kit.

Note: In case you require AWS Direct Connect virtual interfaces of type “Transit” to establish a network connection to Amazon Transit Gateway, then please order a SCI Customer Connection configured with SCI partner Equinix and partner service Amazon. That provides you the option to manually configure an Amazon virtual interface of type “Transit”.

Note: SCI Customer Connections configured with SCI partner Amazon supports AWS Direct Connect virtual interfaces of type “Private” or type “Public” depending on the ordered SCI Amazon partner service. Future development is planned to support type “Transit” as well. Please check the status of this development with your Verizon Account Team.

The activation and deactivation steps are different per peering option but they do have common start and end steps.

1. Please check the common activation start step.
   
   

2. The SCI Customer Connection provides a “Click to Establish Connection” button. By pressing the button, the activation screen pops up.

   

   
   In the below Activation screen enter your AWS Account ID in the empty field and press the “Confirm Activation” button.
   

   

   
   The activation process creates two AWS Direct Connect virtual hosted interfaces of type “Private” which will be in state “confirming”. After closing the window, the SCI Customer Connection shows Amazon Status “confirming”.
   

   
   
   

3. Login into your AWS Account and search for “Direct Connect”.
   

   

   
   Select the service and look in the menu Interfaces. When you search for the SCI Customer Connection Service ID you will find two Verizon hosted Amazon private virtual interfaces (VIF’s) in state “confirming”.
   

   
    

4. Click on the first interface ID and in the next screen press the “Accept” button.
   

   

   
   The AWS acceptance procedure will require you to select a Virtual Private Gateway or Direct Connect Gateway. One of these should already have been created.
   

   Note: When you create an AWS Direct Connect Gateway you can assign a BGP Autonomous System Number (ASN) which is default set to 64512. In case you change the AWS default value please make sure to modify the SCI Customer Connection Amazon AS Number in the Verizon Dynamic Network Manager “Details” menu by clicking the pencil and modify the Amazon AS Number to the value you will be using.
   

   

   
   Press “Accept virtual interface”. 

   
   After acceptance the screen returns to the interface menu.
   

   

   
   Click on the second interface ID and accept the interface by selecting the same gateway.
   

   The two Amazon private virtual interfaces will start changing state, first to “pending”, then to “down” and final to “available”. Available means that the connection and the routing protocol BGP has been established.
   

   
    

5. Switch back to Verizon Dynamic Network Manager, the SCI Customer Connection shows Amazon Status “available”. Press the “BGP Status” button, which returns the Primary and Secondary state “Up”.
   

   

   Note: In case BGP does not establish successfully, check if the SCI Customer Connection Amazon AS Number is matching with the AS number of your Direct Connect Gateway.
   

   Note: In case your SCI Customer Connection continues to show “BGP Status” state “Down” then your SCI Customer Connection prefix advertisement can be incorrectly configured. Please check the next step about route advertisement.
   
   

6. You can verify the SCI Customer Connection egress route filter configuration in the Verizon Dynamic Network Manager “Network Settings” menu. For SCI partner Amazon option 1 peering the default configuration is presented like below:
   

   

   
   “Distribute List Default Only” allows only your default route to be advertised to Amazon. With this configuration your SCI Customer Connection will not exceed Amazon maximum received route limit of 100 prefixes for Amazon private virtual interfaces.
   

   Note: In case you don’t see a filter mentioned that means there is no filter configured. No egress route filter can be requested to your Verizon Account Team for Private IP VPN which stay below 100 routing prefixes. In case 100 prefixes are exceeded Amazon brings BGP into state “Down” which causes that no network traffic will pass.
   

   In case your Private IP VPN contains a default route then Verizon Dynamic Network Manager “Diagnostics” menu command “advertised-routes” will show the below result. 
   

   

   
   In case your Private IP VPN does not contain a default route then contact your Verizon Account Team for a modification of the egress route filter.
   

   You can choose from the below five options for advertising routing prefixes to your Amazon private virtual interfaces:

   Opción	Descripción
   No Filter	All your Private IP VPN prefixes will be advertised to the Amazon private virtual interface.
   Allow Default Only	The default SCI egress route filter configuration which allows only your customer default prefix and will deny all other prefixes, this filter stays below 100 prefixes.
   Deny Default Only	In case you have a default route conflict in Amazon then you can use this option, all other prefixes will be advertised so the total number of prefixes must stay below 100.
   Default Originate	In case you use the default route to Amazon but your Private IP VPN does not have a default route. The default route is injected by your SCI Customer Connection and is only sent to Amazon and not advertised into your Private IP VPN.
   BGP Community	In case your network design supports BGP Community, connected routers to Private IP can tag an agreed BGP community value like 65000:8000 to a customer advertised routing prefix. Your SCI Customer Connection configured to allow BGP community 65000:8000 will then only advertise your tagged prefix. Or the BGP Community filter can be configured to deny a specific BGP Community.

   Note: For extra information see as well the main Verizon SCI Welcome Kit section “Verification of Network Settings Phase”.
   
   

7. You can use the Verizon Dynamic Network Manager “Diagnostics” menu to check for received routing prefixes from Amazon. 
   

   

   Note: In case the maximum advertised route limit of 100 is exceeded then Amazon forces BGP into state “Down” and the received routes command will show an empty result as well.
   

   
   In case you are using a Virtual Private Gateway you only receive routing prefixes when the Virtual Private Gateway is attached to your Virtual Private Cloud (VPC). The VPC CIDR IP address block will then be received from Amazon and distributed into your Private IP VPN.
   

   In case you are using a Direct Connect Gateway associated to (multiple) Virtual Private Gateways make sure you have each Direct Connect Gateway to Virtual Private Gateway association configured with the correct Allowed Prefixes to support your VPC CIDR IP address block else no routing prefix will be received by your SCI Customer Connection.
   

   See below an example of a Direct Connect Gateway with Allowed prefixes from the associated Virtual Private Gateway (attached to your VPC).
   

   
    

8. Please check the common activation end step.
   

1. Please check the common deactivation start step.
   
   

2. The SCI Customer Connection provides a “Deactivate” button.

   

   By pressing the button, the deactivation screen pops up. This screen shows the cloud connection details so that you can verify the details before deactivating the connection.
   

   

   
   

3. Press “Confirm Deactivate” or press “Close” to cancel the deactivation. The “Confirm Deactivate” will immediately delete both Amazon private virtual interfaces from your AWS Account. The SCI Customer Connection will stop exchanging customer traffic with Amazon. After pressing “Confirm Deactivate” the following screen appears and the Amazon private virtual interfaces will be in state “deleting” or “deleted” which cannot be reverted.
   

   

   

   Press “Close” to leave the deactivation procedure.
   

   As long as the Amazon private virtual interfaces are in state “deleting” any attempt to activate this specific SCI Customer Connection will fail because the VLAN IDs are still in use by Amazon.
   

   You can check the Amazon virtual interface status in your AWS web console, after a few minutes the Amazon private virtual interfaces will change to state “deleted”. Only then you can make a successful new SCI Customer Connection activation.
   
   

4. Please check the common deactivation end step.

1. Please check the common activation start step.
    

2. Before you activate the SCI Customer Connection for public peering with Verizon provided Network Address Translation (NAT), make sure your Private IP VPN can support the amount of routing prefixes that Amazon public peering will be advertising to you. Your Private IP VPN is by default limited to a maximum amount of 1250 routing prefixes.

   You can check your SCI Customer Connection specific routing prefix limit in the Verizon Dynamic Network Manager “Network Settings” menu.
   

   

   Note: Contact your Verizon Account Team in case you need a maximum routing prefix increase.
   

   You can access all AWS prefixes through this connection; for example, Amazon EC2, Amazon S3, and Amazon.com. If your VRF table does not have the space to accommodate the additional AWS advertised routes, please request your Verizon Account Team to increase your Private IP VPN maximum routing prefix limit. You can find the AWS IP address ranges on the following link https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
   

   The public peering prefixes will be distributed through the Verizon provided NAT function to your locations connected to your Private IP VPN. This makes it possible for the locations to initiate outbound IP NAT sessions to Amazon services. The source IP address of your network traffic will be replaced with the source IP of the Verizon provided public NAT IP address.  Amazon services cannot initiate inbound sessions to your locations because inbound sessions are blocked by the Verizon NAT function.
   
   

3. The SCI Customer Connection provides a “Click to Establish Connection” button. By pressing the button, the activation screen pops up.
   

   

   Enter your AWS Account ID in the empty field and press the “Confirm Activation” button.
   

   

   The activation process creates two AWS Direct Connect virtual interfaces of type “Public” which will be in state “confirming”. After closing the window, the SCI Customer Connection shows Amazon Status “confirming”.
   

   
   

4. Login into your AWS Account and search for “Direct Connect”.
   

   

   Select the service and look in the menu Interfaces. Search for the SCI Customer Connection Service ID which will find two Amazon public virtual interfaces (VIF’s) in state “confirming”.
   

   
    

5. Click on the first interface ID and in the next screen press the “Accept” button.
   

   

   For public interfaces the AWS acceptance procedure will require you to only press “Confirm”.
   

   Click on the second interface ID and in the next screen press the “Accept” button followed by the “Confirm” button.
   

   The two Amazon public virtual interfaces will change to state “verifying”.
   

   
    

6. Switch back to Verizon Dynamic Network Manager, the SCI Customer Connection shows Amazon Status “Verifying”.
   

   

7. You then contact your Verizon Account Team to provide you a Letter of Authorization (LOA) for both the Verizon provided IP subnets used for the two Amazon public virtual interfaces and the Verizon provided Network Address Translation (NAT) IP address assigned to your SCI Customer Connection.
   
   

8. Your Verizon Account Team will provide you the following Letter of Authorization (LOA):

   Note: Replace the text between [] with the actual information.
   

    

   LETTER OF AUTHORIZATION (LOA)
   

   [Date]
   

   To whom it may concern,
   

   This letter serves as authorization for [AWS Account Name] with Account Number: [AWS Account Number for the Public VIF] 
   

   to advertise the following IP address blocks over: 

   1) The primary AWS Public Virtual Interface [vif-xxxxx]:
   

       [Primary IP address block /30]

       [Secondary IP address block /30]

       [NAT IP address block /32]

   &
   

   2) The secondary AWS Public Virtual Interface [vif-xxxxx]:
   

       [Primary IP address block /30]

       [Secondary IP address block /30]

       [NAT IP address block /32]

   Which belongs to the product Verizon Secure Cloud Interconnect Service ID [xxxxxxxxxx].
   

   From,
   

   [Full Name]

   [Designation]

   [IP Owner Company Name]

   [IP Owner email ID]
    

9. You then provide the LOA to Amazon via a support case or in case you do not have a support plan you can send an email to directconnect-requests@amazon.com.
   

   Only you can authorize Amazon to move the Amazon public virtual interfaces to state “available” because you are the owner of the interfaces. Verizon is hosting “your” Amazon public virtual interfaces on the Verizon owned physical Direct Connect connection.
   

   After Amazon processed your case, the public interfaces will automatically change to state “available” and “BGP Status” will show state “Up” for both interfaces.
   
   

10. Please check the common activation end step.
    

1. Please check the common deactivation start step.
   
   

2. The SCI Customer Connection provides a “Deactivate” button.

   

   By pressing the button, the deactivation screen pops up. This screen shows the cloud connection details so that you can verify the details before deactivating the connection.
   

   

   
    

3. Press “Confirm Deactivate” or press “Close” to cancel the deactivation. The “Confirm Deactivate” will immediately delete both Amazon public virtual interfaces from your AWS Account. The SCI Customer Connection will stop exchanging customer traffic with Amazon. After pressing “Confirm Deactivate” the following screen appears and the Amazon public virtual interfaces will be in state “deleting” or “deleted” which cannot be reverted.
   

   

   

   Press “Close” to leave the deactivation procedure.
   

   As long as the Amazon public virtual interfaces are in state “deleting” any attempt to activate this specific SCI Customer Connection will fail because the VLAN IDs are still in use by Amazon.
   

   You can check the Amazon public virtual interface status in your AWS web console, after a few minutes the Amazon public virtual interfaces will change to state “deleted”. Only then you can make a successful new SCI Customer Connection activation.
   
   

4. Please check the common deactivation end step.
   

1. Please check the common activation start step.
   
   

2. For option 3 the main Verizon SCI Welcome Kit advises to use as an example a new Private IP VPN B (it can be a different name as well). The Private IP VPN B provides the transport of the Amazon public peering traffic to your on-premise Network Address Translation (NAT) device.

   Note: Your SCI Customer Connection should have been ordered for this new Private IP VPN B. Verify in Verizon Dynamic Network Manager “VPN” menu to which Private IP VPN your connection is connected. In case it shows the wrong Private IP VPN ask your Verizon Account Team to re-connect it to your Private IP VPN B.
   

   Before you activate the SCI Customer Connection for public peering with your customer provided NAT, make sure your Private IP VPN B can support the amount of routing prefixes that Amazon public peering will be advertising to you. Your Private IP VPN B is by default limited to a maximum amount of 1250 routing prefixes.
   

   You can check your SCI Customer Connection specific routing prefix limit in the Verizon Dynamic Network Manager “Network Settings” menu.
   

   

   Note: Contact your Verizon Account Team in case you need a maximum routing prefix increase.
   

   You can access all AWS prefixes through this connection; for example, Amazon EC2, Amazon S3, and Amazon.com. If your Private IP VPN B VRF table does not have the space to accommodate the additional AWS advertised routes, please request your Verizon Account Team to increase your Private IP VPN B maximum routing prefix limit. You can find the AWS IP address ranges on the following link https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
   

   The public peering prefixes will be distributed by Private IP VPN B to the location of your on-premise NAT device. You can make it possible for the locations to initiate outbound IP NAT sessions to Amazon services. Your NAT device will then need to replace the source IP address of your location network traffic by a public IP address provided by yourself. Amazon services can or cannot initiate inbound sessions to your location depending on how you configure your NAT device.
   

   In case you have other Private IP VPNs like Private IP VPN A which needs to make use of your on-premise NAT device then use Private IP Multi VRF for this location to route Private IP VPN A traffic to the location so that it can use the NAT device to access Amazon public peering services.
   
   

3. The SCI Customer Connection provides a “Click to Establish Connection” button. By pressing the button, the activation screen pops up. Enter your AWS Account ID in the empty fields and press the “Confirm Activation” button.

   

   The activation process creates two AWS Direct Connect virtual interfaces of type “Public” which will be in state “confirming”. After closing the window, the SCI Customer Connection shows Amazon Status “confirming”.
   

   
   

4. Login into your AWS Account and search for “Direct Connect”.
   

   

   Select the service and look in the menu Interfaces. Search for the SCI Customer Connection Service ID which will find two Amazon public virtual interfaces (VIF’s) in state “confirming”.
   

   
   

5. Click on the first interface ID and in the next screen press the “Accept” button.
   

   

   Click on the second interface ID and in the next screen press the “Accept” button.
   

   The two Amazon public virtual interfaces will change to state “verifying”.
   

   
   

6. You then contact your Verizon Account Team to provide you a Letter of Authorization (LOA) for only the Verizon provided IP subnets used for the two Amazon public virtual interfaces.
   
   

7. Your Verizon Account Team will provide you the following Letter of Authorization (LOA).

   Note: This LOA only includes the Verizon Primary and Secondary /30 address blocks.
   

   Note:Replace the text between [] with the actual information.
   

    

   LETTER OF AUTHORIZATION (LOA)

   [Date]
   

   To whom it may concern,
   

   This letter serves as authorization for [AWS Account Name] with Account Number: [AWS Account Number for the Public VIF] 
   

   to advertise the following IP address blocks over: 

   1) The primary AWS Public Virtual Interface [vif-xxxxx]:
   

       [Primary IP address block /30]

       [Secondary IP address block /30]

   &
   

   2) The secondary AWS Public Virtual Interface [vif-xxxxx]:
   

       [Primary IP address block /30]

       [Secondary IP address block /30]

   Which belongs to the product Verizon Secure Cloud Interconnect Service ID [xxxxxxxxxx].
   

   From,
   

   [Full Name]

   [Designation]

   [IP Owner Company Name]

   [IP Owner email ID]
    

8. You then provide the LOA to Amazon via a support case or in case you do not have a support plan you can send an email to directconnect-requests@amazon.com.

   Note: In the same case you will need to provide your own public NAT IP to Amazon so that Amazon implements both Verizon /30 and your public NAT IP in the same support case.
   

   Only you can authorize Amazon to make the Amazon public virtual interfaces available because you are the owner of the interfaces. Verizon is hosting “your” Amazon public virtual interfaces on the Verizon owned physical Direct Connect connection.
   

   After Amazon processed your case, the public interfaces will automatically change to state “available” and “BGP Status” will show state “Up” for both interfaces.
   
   

9. Please check the common activation end step.

1. Please check the common deactivation start step.
   
   

2. The SCI Customer Connection provides a “Deactivate” button.

   

   By pressing the button, the deactivation screen pops up. This screen shows the cloud connection details so that you can verify the details before deactivating the connection.
   

   

   
   

3. Press “Confirm Deactivate” or press “Close” to cancel the deactivation. The “Confirm Deactivate” will immediately delete both Amazon public virtual interfaces from your AWS Account. The SCI Customer Connection will stop exchanging customer traffic with Amazon. After pressing “Confirm Deactivate” the following screen appears and the Amazon public virtual interfaces will be in state “deleting” or “deleted” which cannot be reverted.
   

   

   

   Press “Close” to leave the deactivation procedure.
   

   As long as the Amazon public virtual interfaces are in state “deleting” any attempt to activate this specific SCI Customer Connection will fail because the VLAN IDs are still in use by Amazon.
   

   You can check the Amazon public virtual interface status in your AWS web console, after a few minutes the Amazon public virtual interfaces will change to state “deleted”. Only then you can make a successful new SCI Customer Connection activation.
   
   

4. Please check the common deactivation end step.