JD Alignment: "Working knowledge of Megaport services, including provisioning and managing Virtual Cross Connects (VXCs) to enable secure private connectivity" — Minimum 4 years required
Complete Megaport multi-cloud implementation: MCR provisioning, VXC creation to AWS and Azure, BGP peering configuration, redundant paths, and full Terraform automation using the official Megaport provider.
MEGAPORT SOFTWARE DEFINED NETWORK
┌──────────────────────────────────────────────────────────────────────┐
│ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Megaport Port (Equinix DC6, Washington DC) │ │
│ │ Customer physical cross-connect → 10G port │ │
│ └──────────────────────────┬────────────────────────────────┘ │
│ │ VXC 100 (on-prem) │
│ ┌───────────────────────────▼────────────────────────────────┐ │
│ │ MCR — Megaport Cloud Router (AS 133937) │ │
│ │ │ │
│ │ BGP Sessions: │ │
│ │ ┌──────────────────────────────────────────────────────┐ │ │
│ │ │ Peer 1: On-prem CE 169.254.0.2 AS 65001 │ │ │
│ │ │ Peer 2: AWS DXGW 169.254.10.2 AS 64512 │ │ │
│ │ │ Peer 3: Azure MSEE-1 169.254.20.2 AS 12076 │ │ │
│ │ │ Peer 4: Azure MSEE-2 169.254.20.6 AS 12076 │ │ │
│ │ └──────────────────────────────────────────────────────┘ │ │
│ │ │ │
│ │ Routing table: │ │
│ │ 10.10.0.0/16 → on-prem (to AWS + Azure) │ │
│ │ 10.1.0.0/14 → AWS (to on-prem + Azure) │ │
│ │ 10.2.0.0/14 → Azure (to on-prem + AWS) │ │
│ └────────┬───────────────────────────────────────┬────────────┘ │
│ │ VXC 200 (1Gbps) │ VXC 300 (1Gbps) │
└───────────┼────────────────────────────────────────┼─────────────────┘
│ │
┌────────▼──────────┐ ┌──────────▼──────────────┐
│ AWS Direct Conn │ │ Azure ExpressRoute │
│ us-east-1 │ │ East US │
│ → TGW → VPCs │ │ → ER GW → Hub VNet │
└───────────────────┘ └─────────────────────────┘
# Create API credentials at portal.megaport.com
# Settings → API Keys → Generate Key
export MEGAPORT_ACCESS_KEY="your_access_key"
export MEGAPORT_SECRET_KEY="your_secret_key"
# Validate API access
curl -X POST "https://api.megaport.com/v2/login" \
-H "Content-Type: application/json" \
-d '{"username":"'$MEGAPORT_ACCESS_KEY'","password":"'$MEGAPORT_SECRET_KEY'"}' \
| python3 -m json.tool | grep -E "token|error"
# List available locations with MCR support
curl -s -H "Authorization: Bearer $TOKEN" \
"https://api.megaport.com/v2/locations?has_mcr=true" \
| python3 -m json.tool | grep -E "\"name\"|\"id\""# terraform/megaport/main.tf
terraform {
required_version = ">= 1.7"
required_providers {
megaport = {
source = "megaport/megaport"
version = "~> 1.0"
}
}
backend "s3" {
bucket = "terraform-state-megaport"
key = "megaport/interconnect/terraform.tfstate"
region = "us-east-1"
}
}
provider "megaport" {
access_key = var.megaport_access_key
secret_key = var.megaport_secret_key
environment = "production"
}
# Discover available locations and their product UIDs
data "megaport_location" "equinix_dc6" {
name = "Equinix DC6"
has_mcr = true
}
data "megaport_location" "equinix_sv1" {
name = "Equinix SV1" # West Coast location for redundancy
has_mcr = true
}
# PRIMARY MCR — East Coast hub
resource "megaport_mcr" "primary" {
mcr_name = "mcr-enterprise-primary-dc6"
location_id = data.megaport_location.equinix_dc6.id
port_speed = 10000
lifecycle {
prevent_destroy = true
}
}
# SECONDARY MCR — West Coast (for redundancy)
resource "megaport_mcr" "secondary" {
mcr_name = "mcr-enterprise-secondary-sv1"
location_id = data.megaport_location.equinix_sv1.id
port_speed = 10000
}
# Customer physical port (cross-connect in Equinix DC6)
resource "megaport_port" "customer" {
port_name = "port-enterprise-customer"
port_speed = 10000
location_id = data.megaport_location.equinix_dc6.id
term = 1 # month-to-month
}
# VXC: Customer Port → MCR (on-prem into Megaport)
resource "megaport_vxc" "onprem_to_mcr" {
vxc_name = "vxc-customer-to-mcr-primary"
rate_limit = 1000
a_end {
port_id = megaport_port.customer.id
requested_vlan = 100
}
b_end {
product_uid = megaport_mcr.primary.mcr_uid
requested_vlan = 100
}
}cd terraform/megaport/
terraform init
terraform plan -out=tfplan
terraform apply tfplan
MCR_PRIMARY_UID=$(terraform output -raw mcr_primary_uid)
MCR_SECONDARY_UID=$(terraform output -raw mcr_secondary_uid)
echo "Primary MCR: $MCR_PRIMARY_UID"
echo "Secondary MCR: $MCR_SECONDARY_UID"# Add to terraform/megaport/main.tf
# VXC PRIMARY: MCR → AWS Direct Connect (us-east-1)
resource "megaport_aws_connection" "primary_to_aws_east" {
vxc_name = "vxc-mcr-primary-to-aws-east"
rate_limit = 1000
a_end {
requested_vlan = 200
mcr_uid = megaport_mcr.primary.mcr_uid
}
b_end {
aws_account_id = var.aws_account_id
aws_connection_type = "private"
requested_product_uid = data.megaport_location.equinix_dc6.products.aws[0].uid
}
bgp_config {
local_asn = var.mcr_asn # 133937
peer_asn = 64512 # AWS Amazon ASN
local_ip_address = "169.254.10.1/30"
peer_ip_address = "169.254.10.2"
password = var.bgp_auth_key
shutdown = false
}
}
# VXC PRIMARY: MCR → Azure ExpressRoute (East US)
resource "megaport_azure_connection" "primary_to_azure_east" {
vxc_name = "vxc-mcr-primary-to-azure-east"
rate_limit = 1000
a_end {
requested_vlan = 300
mcr_uid = megaport_mcr.primary.mcr_uid
}
b_end {
service_key = var.azure_er_service_key_east
}
bgp_config {
local_asn = var.mcr_asn
peer_asn = 12076 # Microsoft ASN
local_ip_address = "169.254.20.1/30"
peer_ip_address = "169.254.20.2"
password = var.bgp_auth_key
shutdown = false
}
}
# VXC SECONDARY: MCR → AWS Direct Connect (us-west-2) — redundancy
resource "megaport_aws_connection" "secondary_to_aws_west" {
vxc_name = "vxc-mcr-secondary-to-aws-west"
rate_limit = 1000
a_end {
requested_vlan = 200
mcr_uid = megaport_mcr.secondary.mcr_uid
}
b_end {
aws_account_id = var.aws_account_id
aws_connection_type = "private"
requested_product_uid = data.megaport_location.equinix_sv1.products.aws[0].uid
}
bgp_config {
local_asn = var.mcr_asn
peer_asn = 64512
local_ip_address = "169.254.11.1/30"
peer_ip_address = "169.254.11.2"
password = var.bgp_auth_key
shutdown = false
}
}terraform apply
echo "VXCs created. AWS DX connection IDs:"
terraform output aws_dx_connection_ids# Query Megaport API for BGP peer status on MCR
TOKEN=$(curl -s -X POST "https://api.megaport.com/v2/login" \
-H "Content-Type: application/json" \
-d "{\"username\":\"$MEGAPORT_ACCESS_KEY\",\"password\":\"$MEGAPORT_SECRET_KEY\"}" \
| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['session'])")
# Get MCR routing table
curl -s \
-H "Authorization: Bearer $TOKEN" \
"https://api.megaport.com/v2/product/$MCR_PRIMARY_UID/bgppeers" \
| python3 -c "
import sys, json
data = json.load(sys.stdin)
for peer in data.get('data', []):
print(f\"Peer: {peer['peerIp']:<20} ASN: {peer['peerAsn']:<8} State: {peer['bgpState']}\")
"
# Expected output:
# Peer: 169.254.0.2 ASN: 65001 State: ESTABLISHED (on-prem)
# Peer: 169.254.10.2 ASN: 64512 State: ESTABLISHED (AWS)
# Peer: 169.254.20.2 ASN: 12076 State: ESTABLISHED (Azure)
# Verify routes being exchanged
aws directconnect describe-virtual-interfaces \
--query 'virtualInterfaces[*].{Name:virtualInterfaceName,BGP:bgpPeers[0].bgpStatus,Routes:routesFilteredIn}' \
--output table
az network express-route list-route-tables \
--path primary \
--resource-group rg-hub-network \
--name erc-enterprise \
--peering-name AzurePrivatePeering \
--query value[*].network --output table# From AWS EC2 instance — ping on-prem and Azure
INSTANCE_ID=$(aws ec2 describe-instances \
--filters "Name=tag:Name,Values=test-instance" \
--query 'Reservations[0].Instances[0].InstanceId' --output text)
aws ssm send-command \
--document-name "AWS-RunShellScript" \
--targets "Key=instanceids,Values=$INSTANCE_ID" \
--parameters commands='[
"echo Testing on-prem connectivity...",
"ping -c 4 10.10.100.5 && echo ON_PREM_OK || echo ON_PREM_FAIL",
"echo Testing Azure connectivity...",
"ping -c 4 10.2.1.10 && echo AZURE_OK || echo AZURE_FAIL",
"echo Traceroute to on-prem:",
"traceroute -n 10.10.100.5"
]' \
--query 'Command.CommandId' --output text | xargs -I{} \
aws ssm get-command-invocation --command-id {} --instance-id $INSTANCE_ID \
--query 'StandardOutputContent' --output text# Create CloudWatch custom metric for VXC health (poll Megaport API via Lambda)
cat > scripts/megaport_monitor.py << 'SCRIPT'
import boto3, requests, os, json
def handler(event, context):
token = get_megaport_token()
mcr_uid = os.environ['MCR_UID']
response = requests.get(
f"https://api.megaport.com/v2/product/{mcr_uid}/bgppeers",
headers={"Authorization": f"Bearer {token}"}
)
peers = response.json().get('data', [])
cw = boto3.client('cloudwatch')
for peer in peers:
healthy = 1 if peer['bgpState'] == 'ESTABLISHED' else 0
cw.put_metric_data(
Namespace='Megaport/BGP',
MetricData=[{
'MetricName': 'BGPSessionHealth',
'Dimensions': [{'Name': 'PeerIP', 'Value': peer['peerIp']}],
'Value': healthy,
'Unit': 'Count'
}]
)
if not healthy:
print(f"ALERT: BGP peer {peer['peerIp']} (AS{peer['peerAsn']}) is DOWN")
SCRIPT
echo "Monitor Lambda deployed — BGP health metrics in CloudWatch every 60s"MIT License