Visualizing Your Global Network with AWS Network Manager - Centralized Management of Topology and Health
This article introduces techniques for visualizing the topology of a global network that includes Transit Gateway and VPN, and for verifying connectivity with route analysis.
Overview of Network Manager
Network Manager is a service that centrally manages the topology and health of a global network. It presents the connection relationships among Transit Gateway, Site-to-Site VPN, and Direct Connect visually, and automatically detects network change events. Route analysis investigates connectivity problems, and integration with Cloud WAN lets you perform policy-based network management.
Topology and Route Analysis
When you create a global network and register a Transit Gateway, the connection relationships of the attached VPCs, VPN connections, and Direct Connect are automatically displayed on the topology map. Route analysis takes a source and destination that you specify, analyzes the routes in the Transit Gateway route tables, and finds misconfigurations in the route tables (VPC route tables and security group rules are outside the scope of the analysis). Network events automatically detect VPN tunnel state changes, BGP peer disconnections, and Transit Gateway attachment changes, and send notifications through EventBridge.
Integration with CloudWAN
When you integrate AWS Cloud WAN with Network Manager, you can centrally manage the segmentation and routing of the global network with a core network policy. Based on policies, it assigns attachments (VPC, VPN, Direct Connect) to segments and controls which communication between segments is permitted. The Network Manager dashboard visualizes the Cloud WAN core network topology, the traffic volume of each segment, and the health of connections in real time. Network changes (attaching a new VPC, adding a route) are published as EventBridge events, and you can make use of them as an audit trail for change management. Combined with Reachability Analyzer, it verifies the reachability from a specific source to a destination in advance and reduces errors in routing settings.
Network Manager Pricing
There is no usage fee for Network Manager itself. Costs depend on the usage fees of the managed resources (Transit Gateway, Direct Connect, VPN). When you use Cloud WAN, charges are based on the number of core network edges, the number of attachments, the volume of data processed, and so on. Peering attachments incur inter-Region data transfer charges, so you check the volume of inter-Region traffic in advance. Route analysis and topology visualization in Network Manager can be used at no additional charge.
Visualization Through Registering Sites and Devices
Network Manager can represent the overall picture including not only connections on AWS but also on-premises sites. When you register sites (physical locations), links (lines), and devices (equipment such as routers), you can grasp them and their connection relationships with the AWS side together on the topology map. This lets you survey the entire network spanning headquarters / branch offices / data centers and AWS as a single map. Because you can visualize the configuration across the boundary between physical sites and the cloud, you can manage even complex hybrid environments without losing track of what is connected to what and how.
Detection and Notification of Network Events
Network Manager automatically detects network events such as VPN tunnel state changes, BGP peer disconnections, and attachment changes. Because these are published as EventBridge events, you can build mechanisms such as sending a notification when an anomaly is detected or starting related automated processing. The change history serves directly as an evidence trail for change management, and you can track when and what changed. You can build a setup in which the operations team can respond without missing signs of failures or configuration changes.
Value in Multi-Region Operations
Network Manager is a good fit for large-scale networks that span multiple Regions. You can bring Transit Gateways and connections distributed across Regions together into one global network, and grasp the overall topology and health on a single dashboard. Routing problems that cross Regions tend to be difficult to isolate, but visualization and route analysis make it easier to identify where communication is stopping. In environments with sites around the world, you can use it as a management foundation that gives an overview of the whole.
How to Proceed with Adoption and Integration with Existing Configurations
Because you can start using Network Manager by registering existing Transit Gateways and VPNs as they are, the barrier to adoption is fairly low. You start by creating a global network, registering existing resources, and visualizing the topology. There is no usage fee itself, and you can use visualization and route analysis at no additional cost, so you can first enable it and use it to understand the current state. If you want to move to policy-based management in the future, you can proceed to the stage of integrating with Cloud WAN and managing segmentation declaratively.
Summary
Adopting Network Manager is suited to multi-Region environments that use Transit Gateway or VPN. The topology map visualizes the overall picture of connections, and route analysis detects unintended routing. If you move to policy-based network management through integration with Cloud WAN, you can manage routing settings declaratively and evaluate the impact of network changes in advance. Because it is free to use, you can enable it in environments that operate networks spanning multiple Regions.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.