This article describes how to establish a Site-To-Site IPSec VPN connection between your AWS server and the Perimeter 81 network.
- Configuring the tunnel in the AWS Console
- Configuring a virtual private gateway
- Creating a virtual private network connection
- Configuring the tunnel in your Management Platform
Please follow the steps below:
Configuring the tunnel in the AWS Console
- Go to the VPC section in the AWS Console.
- Under Services, scroll down to Networking & Content Delivery and select VPC.
3. Under the left menu VPN section, go to Customer Gateways.
- Select Create Customer Gateway.
- Select static routing.
- Fill in the IP Address of the Perimeter 81 Gateway. This can be obtained within the Perimeter 81 Panel, under Networks.
7. Select Create Customer Gateway. A message should display indicating the gateway was created successfully.
Configuring a virtual private gateway
Go back to Services, scroll down to Networking & Content Delivery, and select VPC.
On the left side, under Virtual Private Network (VPN) select Virtual Private Gateways.
Select Create Virtual Private Gateway.
Type the name of the gateway (for example US_HQ ).
Select ASN as Amazon default ASN.
Select Create Virtual Private Gateway.
A message should display indicating that the virtual Private Gateway was created successfully.
7. Select the newly created gateway and select Actions; on the context menu select Attach to VPC.
8. From the drop-down menu, select the VPC and select Yes, Attach.
Creating a virtual private network connection
- Under Virtual Private Network in the left menu, go to Site-to-Site VPN Connections.
- Select Create VPN Connection.
- Enter the name tag (for example US_HQ).
- Select the created Virtual Private Gateway.
- Under Customer Gateway, select Existing.
- Select the Customer Gateway that you have created.
- Under Routing Options, select Static.
- Fill in the following Static IP Prefixes: 10.XXX.0.0/16 (according to your Perimeter 81 network subnet).ImportantThis address might differ in case you haven't chosen the default subnet mask for your tunnel.
9. Under Tunnel Options leave the default values as-is.
10. Select Create VPN Connection.
11. A message should display indicating that a VPN Connection Request was created successfully.
Configuring the routing rules to the default gateway
- Select the VPC section in the AWS Console and enter the Route table associated with your PC.
2. For the Route Tables menu option, select the routing table that is associated with the VPC you have created for the tunnel.
3. Select Edit and add the new static routes for the subnets below:
Fill in 10.255.0.0/16 or your Perimeter 81 network subnet at the destination field and your new VPN Gateway ID as the target (it will appear under the subcategory Virtual Private Gateway).
4. Select Save.
Allow incoming connections from Perimeter 81 local network within your security groups: Configure your AWS security groups to allow all traffic from Perimeter 81 subnets (10.255.0.0/16) or allow only special traffic using the port or services from these sources.
Configuring the tunnel in your Platform
- Return to Site-to-Site VPN Connections and select Download Configuration.
2. Fill in the following information:
3. Go to the Management Platform. Under the Networks tab in the left menu, select the name of the network where you'd like to set the tunnel.
4. Locate the desired gateway, select the three-dotted menu (...), select Add Tunnel, and then IPSec Site-2-Site Tunnel.
- Open the configuration file that you have downloaded. Fill in the following fields according to the file's content: Public IP, Remote ID (both identical; marked in red in the attached example), and Shared Secret (marked in yellow; remember to omit the quotation marks).
- The rest of the fields should be filled in with the following information:
- Name: Enter the name you chose for the tunnel.
- Perimeter 81 Gateway Proposal Subnets: By default, this should be set to 10.255.0.0/16.
- Remote Gateway Proposal Subnets: Select specified Subnets. Insert your VPC CIDR.
At the Advanced Settings section fill in the following information:
- IKE Version: V1
- IKE Lifetime: 8h
- Tunnel Lifetime: 1h
- Dead Peer Detection Delay: 10s
- Dead Peer Detection Timeout: 30s
- Encryption (Phase 1): aes128
- Encryption (Phase 2): aes128
- Integrity (Phase 1): sha1
- Integrity (Phase 2): sha1
- Diffie-Hellman Groups (Phase 1): 2
- Diffie-Hellman Groups (Phase 2): 2
8. Select Add Tunnel.