# Connect upstream applications using the AWS CLI Type of document: How-to guide Product: F5 Application Delivery Service for AWS > Use the AWS CLI to create a VPC peering connection so an F5 Application Delivery Service for AWS deployment can reach applications in your upstream VPC. --- This guide shows how to use the AWS CLI to let an F5 Application Delivery Service for AWS deployment reach applications in your upstream network. You create an upstream virtual private cloud (VPC) and request a VPC peering connection to your deployment's VPC. Then you accept the connection in F5 ADS and update routing and security rules so traffic can flow between the two VPCs. For more background on VPC peering, see the AWS [Create a VPC peering connection](https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html) documentation. ## Before you begin - The [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) installed and configured with credentials that can manage VPC resources in your upstream AWS account. - An F5 ADS deployment. See [Create a new deployment](/f5ads/aws/deploy/create-deployment/deploy-console.md#create-a-new-deployment). - Your deployment's **AWS Account ID**, **VPC ID**, **IPv4 CIDR**, and **IPv6 CIDR** (if you plan to use IPv6), found on the deployment's Details tab. **Note:** Request the peering connection from the same region as your deployment. F5 ADS rejects peering connections from any other region. ## Create your upstream VPC If you already have an upstream VPC that hosts the applications your deployment needs to reach, skip to [Request a VPC peering connection](#request-a-vpc-peering-connection) and use its VPC ID instead. **Note:** Your upstream VPC CIDR block must not overlap with the deployment's VPC CIDRs, or the CIDRs of other peered upstream VPCs. If CIDRs overlap, VPC peering will fail. See [Upstream network](/f5ads/aws/overview.md#upstream-network) for more information. Otherwise, create a new VPC in the same AWS Region as your deployment. Replace `` with a CIDR block for the VPC and `` with your deployment's region: ```bash aws ec2 create-vpc \ --cidr-block \ --region ``` Example output: ```json { "Vpc": { "VpcId": "vpc-0123456789abcdef1", "CidrBlock": "10.1.0.0/16", "State": "pending" } } ``` Record the `VpcId`. You'll need it in the following steps. ## Request a VPC peering connection From your upstream VPC, request a peering connection targeting your deployment VPC. Replace `` with your upstream VPC ID, `` and `` with the values from your deployment Details tab, and `` with your deployment region: ```bash aws ec2 create-vpc-peering-connection \ --vpc-id \ --peer-vpc-id \ --peer-owner-id \ --region ``` Example output: ```json { "VpcPeeringConnection": { "VpcPeeringConnectionId": "pcx-0123456789abcdef0", "Status": { "Code": "initiating-request" } } } ``` Record the `VpcPeeringConnectionId`. You'll need it in the following steps. ## Accept the peering connection in F5 ADS 1. In the F5 ADS Console, open your deployment's **Details** tab and select **Edit**. 1. Go to **Cloud Details** > **Upstream Network**, select **+ Add Entry**, and add the `VpcPeeringConnectionId` you recorded when you requested the VPC peering connection. 1. Select **Save Changes** to allow F5 ADS to accept the peering connection request. Confirm that your AWS VPC peering connection is active by replacing ``: ```bash aws ec2 describe-vpc-peering-connections \ --vpc-peering-connection-ids \ --region \ --query "VpcPeeringConnections[0].Status" ``` Wait until `Code` shows `active` before continuing. ## Update your route tables Add a route in your upstream VPC's route tables so traffic destined for the deployment CIDRs goes through the peering connection. Replace `` with your upstream route table ID and `` with the deployment's IPv4 CIDR: ```bash aws ec2 create-route \ --route-table-id \ --destination-cidr-block \ --vpc-peering-connection-id \ --region ``` If you're using IPv6, add a matching route for the deployment's IPv6 CIDR. Replace ``: ```bash aws ec2 create-route \ --route-table-id \ --destination-ipv6-cidr-block \ --vpc-peering-connection-id \ --region ``` Repeat this step for every route table associated with a subnet that needs to reach the deployment. ## Update your security group rules Allow inbound traffic from the deployment CIDRs on the security groups attached to your upstream applications. Replace `` with the security group protecting your upstream application, and `` with the deployment's IPv4 CIDR: ```bash aws ec2 authorize-security-group-ingress \ --group-id \ --protocol tcp \ --port \ --cidr \ --region ``` **Note:** Scope the ingress rule to only the port and protocol your upstream application expects, and only the deployment CIDRs. For example, `--cidr 10.1.0.0/24` rather than a broad range like `0.0.0.0/0`. ## Verify the peering connection Confirm the peering connection is active and routes are in place, replacing `` and ``: ```bash aws ec2 describe-vpc-peering-connections \ --vpc-peering-connection-ids \ --region \ --query "VpcPeeringConnections[0].{Status:Status.Code,CIDR:AccepterVpcInfo.CidrBlock}" aws ec2 describe-route-tables \ --route-table-ids \ --region \ --query "RouteTables[0].Routes" ``` After the connection is `active` and the routes and security group rules are in place, your deployment can reach your upstream applications. The deployment reaches them at the addresses that your NGINX configuration proxies to. ## What's next - [Set up connectivity](/f5ads/aws/deploy/create-deployment/deploy-console.md#set-up-connectivity) - [Monitor your deployment](/f5ads/aws/monitoring/enable-monitoring.md)