AWS VXC Setup

Architecture

We will construct the following architecture:

Prerequisites

VPC

This step is performed on AWS.

⚠️ Note: Ensure the intended region is selected. In this example, we are using eu-central-1 as the region.

Parameter	Value
Resources to create	VPC only
IPv4 CIDR block	IPv4 CIDR manual input
IPv4 CIDR	RFC1918, e.g. 10.10.11.0/24
IPv6 CIDR block	No IPv6 CIDR block
Tenancy	Default

Virtual Private Gateway

This step is performed on AWS. Create and attach a virtual private gateway to the VPC created.

⚠️ Note: Ensure the intended region is selected. In this example, we are using eu-central-1 as the region.

⚠️ Note: Amazon default ASN value is 64512. You will need this value for VXC creation. Next, attach the virtual private gateway to the VPC created in the first step.

The state of the virtual private gateway will go from “Detached” to “Attaching” and finally “Attached”.

VPC Route Table

This step is performed on AWS.

Internet Gateway

This step is performed on AWS. This is optional. Create and attach an internet gateway to the VPC created.

Subnet

This step is performed on AWS. Assuming you don’t have a subnet setup — Choose the VPC created. Subnet CIDR block should be chosen from within the VPC block.

EC2

This step is performed on AWS. Assuming you don’t have an EC2 instance — spin one up in the same region. Assign the VPC and Subnet created previously. Enable public IP on the instance so you can ssh into it.

Account ID

This step is performed on AWS. ⚠️ You would need this number when you create the Telnyx VXC later.

Network

This step is performed on Telnyx. If you don’t have a network created already, you may follow this guide to create one.

Procedure

Create a VXC resource

This step is performed on Telnyx.

request

POST /v2/network_agents_gateway/vxc HTTP/1.1
Host: api.telnyx.com
Content-Type: application/json
Authorization: Bearer ***

{
    "customer_name": "my-company",
    "network_id": "<network-id>",
    "type": "single",
    "csp": "AWS",
    "csp_account": "<aws-account-id>",
    "region": "eu-central-1",
    "location": "Frankfurt, DE",
    "speed": "50M",
    "cross_connect": {"primary": "169.254.0.0/30"},
    "bgp_asn": 64512,
    "bgp_key_primary": "<optional-md5-auth-key>"
}

Parameter	Value
`csp`	`AWS`
`csp_account`	AWS account ID from the last step
`region`	Match what you selected on AWS
`location`	Telnyx PoP name from the coverage API, e.g. `Frankfurt, DE`
`speed`	Chosen from available bandwidth in the VXC coverage API response
`cross_connect`	A `/30` CIDR for the BGP session between Telnyx and AWS
`bgp_asn`	BGP ASN of the user’s AWS virtual private gateway (0–65535)
`bgp_key_primary`	Optional MD5 BGP authentication key. Omit for no authentication.
`bgp_key_secondary`	Optional, redundant connections only.

BGP auth key: If you supply bgp_key_primary, configure the same MD5 key on the AWS Direct Connect virtual interface BGP peer — both sides must match.

Take note of the VXC id returned in the response.

Direct Connect

This step is performed on AWS. If the connection is not accepted in the user’s AWS account within 1 hour of VXC creation, the VXC is deleted and must be created again.

Enable Routing

This step is performed on Telnyx. The connection must be enabled to be used.

request

PATCH /v2/network_agents_gateway/vxc/{vxc_id} HTTP/1.1
Host: api.telnyx.com
Content-Type: application/json
Authorization: Bearer ***

{
    "bgp_enabled": true
}

At this point, the connection on AWS will show as “available”.

Virtual Interface

This step is performed on AWS. The connection created above needs to have an interface to which to connect.

Interface Parameters

Parameter	Value
Type	Private
Connection	Choose the Direct Connection you accepted previously.
Virtual interface owner	My AWS account
Gateway Type	Virtual Private Gateway and select the one you created in Prerequisite – AWS → Virtual Private Gateway
BGP ASN	63440 - Telnyx ASN
Your router peer IP - optional	`primary_telnyx_ip`
Amazon router peer IP - optional	`primary_cloud_ip`
BGP authentication key - optional	`primary_bgp_key`

Lastly you should see the following – the interface is “available”.

Validate Connection

This step is performed on AWS. SSH into an EC2 instance in the VPC and either ping or traceroute to one of the IPs in the route table of the VPC. You can see the route went over the VXC instead of the public internet.

Guides

Virtual Cross Connects API

For AI Agents

Architecture

Prerequisites