Configure the Amazon Web Services (AWS) environment

To connect your local network to the AWS Virtual Private Cloud (VPC), Amazon recommends creating a redundant tunnel between the SNS firewall and the AWS VPC and routing traffic using the BGP dynamic routing protocol. The AWS environment configuration relies on various resources:

  • Virtual private cloud (VPC): this is a virtual network to which the other resources are attached. Configuring a VPC consists primarily of a CIDR block (IPv4 and/or IPv6). The chosen network must not overlap with a locally defined (on-premise) network.

  • Subnet: the subnet is contained within the VPC. A VPC can contain multiple public or private subnets.

  • Client gateway: this is the endpoint of the IPsec tunnel on the client site (on-premise).

  • Virtual Private Gateway: this is the IPsec tunnel endpoint in the VPC.

NOTE
We recommend that you review the Amazon Web Services documentation before following these steps:

Log in to your AWS console to complete all the steps for configuring your Amazon Web Services environment.

Configure the Virtual Private Cloud (VPC) resource

  1. Go to VPC > Virtual private cloud > Your VPCs.

  2. Click on Create VPC.

  3. Fill in the following fields:

    • Resources to create: select VPC only,

    • Name tag: enter the name of the resource (for example AWS VPC ),

    • IPv4 CIDR block: select IPv4 CIDR manual input,

    • IPv4 CIDR: enter the address of the network used in the AWS environment (for example, 192,168.2.0/24),

    • IPv6 CIDR block: select No IPv6 CIDR block,

    • Tenancy : leave the value at Default,

    • VPC encryption control: Select None.

  4. Click on Create VPC.

Configure Subnet resource

  1. Go to VPC > Virtual private cloud > Subnets.

  2. Click on Create subnet.

  3. In the VPC > VPC ID section, select the previously created VPC (AWS VPC in the example).

  4. In the Subnet Settings section, enter the following fields:

    • Subnet name: enter the name of the subnet (for example AWS Subnet ),

    • Availability zone: select No preference,

    • IPv4 VPC CIDR block: indicate the address plan in which to create this subnet (for example 192,168.2.0/24),

    • IPv4 subnet CIDR block: Specify the address plan used on this subnet (for example, 192,168.2.0/24 or 192,168.2.96/27).

  5. Click on Create subnet.

Configure the Client Gateway resource

  1. Go to VPC > Virtual private network > Customer Gateways.

  2. Click Create customer gateway.

  3. Fill in the following fields:

    • Name tag: enter the name of the gateway (e.g. SNS gateway ).

    • BGP ASN: Enter the autonomous system number (ASN) of the SNS gateway (for example 65532). Note that RFC 6996 defines the following private use Autonomous System Numbers (ASNs):

      • 16 bits: 64512 - 65534,

      • 32 bits: 4200000000 - 4294967294.

    • IP Address: specify the public IP address of the SNS gateway (for example 198.51.100.1).

  4. Click Create customer gateway.

Configure the Virtual Private Gateway resource

  1. Go to VPC > Virtual private network > Virtual private gateways.

  2. Click Create virtual private gateway.

  3. Fill in the following fields:

    • Name tag: enter the name of the gateway (e.g. AWS gateway ),

    • Autonomous System Number (ASN): Select Custom ASN,

    • Enter custom ASN: Enter the virtual private gateway autonomous system number (ASN) (e.g. 65000). Note that RFC 6996 defines the following private use Autonomous System Numbers (ASNs):

      • 16 bits: 64512 - 65534,

      • 32 bits: 4200000000 - 4294967294.

  4. Click Create virtual private gateway.

  5. Select the Virtual Private Gateway you just created (AWS gateway in the example) and click Actions.

  6. Select Attach to VPC.

  7. In the Available VPCs drop-down menu, select the previously created VPC resource (AWS VPC in the example).

  8. Click Attach to VPC.

Configure routing

You must define how packets are routed between your VPC subnets and your local (on-premise) network.

Creating a routing table resource

  1. Go to VPC > Virtual private cloud > Route tables.

  2. Click Create route table.

  3. Fill in the following fields:

    • Name: enter the name of the routing table (e.g. AWS Route Table ),

    • VPC: Select the previously created VPC resource from the drop-down menu ( AWS VPC in the example).

  4. Click Create route table.

  5. Select the routing table you just created ( AWS Route Table in the example) and click Actions.

  6. Select Edit route propagation.

  7. Select the Enable Gateway check box ( AWS gateway in the example) to enable route propagation.

  8. Click Save.

Propagate routes to the Subnet resource

  1. Go to VPC > Virtual private cloud > Subnets.

  2. Select the previously created subnet (AWS subnet in the example) and click Actions.

  3. Select Edit route table association.

  4. From the Routing table ID drop-down menu, select the previously created routing table (AWS Route Table in the example).

  5. Click Save.

Configure the VPN Connection resource

You must define the VPN connection and select the resources and configuration options required for the site-to-site connection.

  1. Go to VPC > Virtual private network (VPN) > Site-to-site VPN connections.

  2. Click Create VPN Connection.

  3. Fill in the following fields:

    • Name tag: enter the name of the connection (e.g. VPN with SNS),

    • Target gateway type: Select Virtual private gateway,

    • Virtual private gateway: select the previously created virtual network gateway (AWS gateway in the example),

    • Customer gateway: select Existing,

    • Customer gateway ID: select the previously created client gateway (SNS gateway in the example),

    • Routing options: select Dynamic (requires BGP),

    • Pre-shared key storage: select Standard,

    • Local IPv4 network CIDR: leave this field blank,

    • Remote IPv4 network CIDR: leave this field blank.

  4. You can leave the default settings for the Tunnel 1 options and Tunnel 2 options fields, or you can customize them.

  5. Click Create VPN connection.

Download the IPsec configuration

  1. Go to VPC > Virtual private network (VPN) > Site-to-site VPN connections.

  2. Select the previously created VPN connection (VPN with SNS in the example).

  3. Click Download configuration.

  4. In the pop-up window that appears, fill in the following fields:

    • Vendor: select Generic,

    • Platform: select Generic,

    • Software: Select Vendor Agnostic,

    • IKE version: select IKEv2.

  5. Click on Download.

As in the example below, a text file (.txt) with the ID of the previously created VPN connection (VPN with SNS in the example) is downloaded. It describes the configuration to be implemented on the SNS gateway and contains:

  • The IP addresses of the tunnels,

  • The IP addresses of the AWS gateways

  • The pre-shared key (PSK) defined by AWS.

vpn-0d928d8b22f89021f.txt

[...]#3: Tunnel Interface Configuration

Your Customer Gateway must be configured with a tunnel interface that is
associated with the IPSec tunnel. All traffic transmitted to the tunnel
interface is encrypted and transmitted to the Virtual Private Gateway.

The Customer Gateway and Virtual Private Gateway each have two addresses that relate
to this IPSec tunnel. Each contains an outside address, upon which encrypted
traffic is exchanged. Each also contains an inside address associated with
the tunnel interface.

The Customer Gateway outside IP address was provided when the Customer Gateway
was created. Changing the IP address requires the creation of a new
Customer Gateway.

The Customer Gateway inside IP address should be configured on your tunnel
interface.

Outside IP Addresses:
  - Customer Gateway: 198.51.100.1	           ◄ SNS PUBLIC IP ADDRESS 
  - Virtual Private Gateway: 52.51.13.54	   ◄ AWS PUBLIC IP ADDRESS 

Inside IP Addresses
  - Customer Gateway: 169.254.238.178/30	   ◄ LOCAL IP ADDRESS(SNS)
  - Virtual Private Gateway: 169.254.238.177/30   ◄ REMOTE IP ADDRESS (AWS)

Configure your tunnel to fragment at the optimal size:
  - Tunnel interface MTU     : 1436 bytes
[...]