Question: How do I access FSx for ONTAP using a transit gateway across different VPCs in the same Region?

I have Amazon FSx for NetApp ONTAP file systems in different Amazon Virtual Private Clouds (Amazon VPCs) in the same Region. How can I access my file systems using AWS Transit Gateway?Short descriptionFSx for ONTAP file systems have floating IP addresses that are outside of the VPC's CIDR. You can access your FSx for ONTAP file systems from the VPC if the client and the file system use the same route table. This makes VPC peering impossible, because peering can only be used to access iSCSI luns because the luns endpoints are in the VPC CIDR itself. To share the file system across VPCs or Regions, you must use a transit gateway.

ResolutionThe following resolution uses the following examples:VPC-A : The VPC that has the FSx for ONTAP file system. The CIDR is 172.31.0.0/16.VPC-B : The VPC that has the Amazon Elastic Compute Cloud (Amazon EC2) instance. The CIDR is 10.0.0.0/16.Step 1: Create a transit gatewayOpen the VPC console, then select Transit gateways.Create a transit gateway.Select the default options when creating the transit gateway. You don't need to select a CIDR range on the console.Step 2: Create transit gateway attachmentsCreate two attachments for the transit gateway by doing the following:Open the VPC console.Select Transit gateway attachments, Create transit gateway attachment.Create a transit gateway attachment. For Transit gateway ID, make sure that you select the transit gateway you just created.Repeat steps 1-3 to create a second transit gateway.Select the transit gateway you just created.Step 3: Create routesThe routes must be configured as shown in the following example:EC2 instance to VPC-B route table to tgw-attachment-VPC-B to TGW route table (198.19.0.0/16) to tgw-attachment-VPC-A to FSx for ONTAP file systemNote: 198.19.0.0/16 CIDR is an example CIDR range for the FSx for ONTAP file system.VPC-B Route Table to tgw-attachment-VPC-BOpen the VPC console and then select Route tables.Open the route table of VPC-B.In the Routes section, select Edit Routes, Add route.Enter the CIDR Range 198.19.0.0/16 under Destination.In the Target selectTransit Gateway, and then select the tgw-xxx that you created.Select Save changes.To access the file system over iSCSI or a snapmirror relationship, you must add another route to 172.31.0.0/16 over the same target (tgw-xxx). This is because iSCSI and snapmirror relationships use inter-cluster endpoints. Inter-cluster endpoints have IP addresses that belong to the VPC-A CIDR range.TGW route table (198.19.0.0/16) to tgw-attachment-VPC-AThis routing must be within the transit gateway. This means that you need to create a static route in the transit gateway route table.Open the VPC console, and then select Transit gateways, Transit gateway route tables.Select the route table corresponding to the transit gateway Id tgw-xxx and then select the Routes tab.Select Create static route, and enter the CIDR 198.19.0.0/16.Choose tgw-attachment-VPC-B as the attachment.Select Create static route.tgw-attachment-VPC-A to FSxN OntapThis route is already created. The 198.19.x.x/y destination is hitting one of the target elastic network interfaces (eni-xxx) on the VPC-A route table. These are the routes created on the selected route table by the Amazon FSx service when the ONTAP file system is provisioned. However, the flow shown in the previous example represents a uni-directional packet flow. To make the flow a symmetric route so that packets can travel back to the EC2 instance, add another route on the VPC-A route table.Open the VPC console, and then select Route tables.Open the route table of the VPC-A,In the Routes section, select Edit routes, Add routes.Enter the CIDR Range 10.0.0.0/16 under Destination.Under Target, select Transit gateway, and then select the tgw-xxx that you created.Select Save changes.