AWS Virtual Gateway
  • 03 Nov 2020
  • 3 Minutes To Read
  • Contributors
  • Print
  • Dark
    Light

AWS Virtual Gateway

  • Print
  • Dark
    Light

This article describes how to establish a Site-To-Site IPSec VPN connection between your AWS server and the Perimeter 81 network. 

  • Configuring the tunnel in the AWS Console
  • Configuring a virtual private gateway
  • Creating a virtual private network connection
  • Configuring the tunnel in your Management Platform

Please follow the steps below:

Configuring the tunnel in the AWS Console

  1. Go to the VPC section in the AWS Console.
  2. Under Services, scroll down to Networking & Content Delivery and select VPC.

360004436499mceclip61.png
3. Under the left menu VPN section, go to Customer Gateways.

360004436399mceclip4.png

  1. Select Create Customer Gateway.
  2. Select static routing.
  3. Fill in the IP Address of the Perimeter 81 Gateway. This can be obtained within the Perimeter 81 Panel, under Networks.

360005255260mceclip01.png
7. Select Create Customer Gateway. A message should display indicating the gateway was created successfully.

360004517539mceclip0.png

Configuring a virtual private gateway

  1. Go back to Services, scroll down to Networking & Content Delivery, and select VPC.
    360004436499mceclip62.png

  2. On the left side, under Virtual Private Network (VPN) select Virtual Private Gateways.
    360004380360mceclip7.png

  3. Select Create Virtual Private Gateway.
    360004436519mceclip8.png

  4. Type the name of the gateway (for example US_HQ ).

  5. Select ASN as Amazon default ASN.

  6. Select Create Virtual Private Gateway.

httpsfilesreadmeio1d3f3f3-ScreenShot2018-04-16at180054.png

A message should display indicating that the virtual Private Gateway was created successfully.
7. Select the newly created gateway and select Actions; on the context menu select Attach to VPC.

360004380380mceclip9.png
8. From the drop-down menu, select the VPC and select Yes, Attach.

Creating a virtual private network connection

  1. Under Virtual Private Network in the left menu, go to Site-to-Site VPN Connections.
    360004380400mceclip10.png
  2. Select Create VPN Connection.
    360004380440mceclip12.png
  3. Enter the name tag (for example US_HQ).
  4. Select the created Virtual Private Gateway.
  5. Under Customer Gateway, select Existing.
  6. Select the Customer Gateway that you have created.
  7. Under Routing Options, select Static.
  8. Fill in the following Static IP Prefixes: 10.XXX.0.0/16 (according to your Perimeter 81 network subnet).
    Important
    This address might differ in case you haven't chosen the default subnet mask for your tunnel.

360004436559mceclip13.png
9. Under Tunnel Options leave the default values as-is.
10. Select Create VPN Connection.

360004436579mceclip14.png
11. A message should display indicating that a VPN Connection Request was created successfully.

Configuring the routing rules to the default gateway

  1. Select the VPC section in the AWS Console and enter the Route table associated with your PC.

360004406260mceclip23.png
2. For the Route Tables menu option, select the routing table that is associated with the VPC you have created for the tunnel.

360004461879mceclip22.png
3. Select Edit and add the new static routes for the subnets below:

Fill in 10.255.0.0/16 or your Perimeter 81 network subnet at the destination field and your new VPN Gateway ID as the target (it will appear under the subcategory Virtual Private Gateway).
4. Select Save.

In case have a customized security group associated with your VPC

Allow incoming connections from Perimeter 81 local network within your security groups: Configure your AWS security groups to allow all traffic from Perimeter 81 subnets (10.255.0.0/16) or allow only special traffic using the port or services from these sources.

Configuring the tunnel in your Platform

  1. Return to Site-to-Site VPN Connections and select Download Configuration.

360004436599mceclip16.png
2. Fill in the following information:

httpsfilesreadmeiod6430ba-Untitled.png

Important
Examining the configuration file, you may notice that AWS has created two separate tunnels for the same VPN connection, however Perimeter 81 utilizes only one of them. You may randomly choose any of the two, but for consistency purposes and in order to avoid possible confusion we advise you to use the one that appears first in the file.

3. Go to the Management Platform. Under the Networks tab in the left menu, select the name of the network where you'd like to set the tunnel.
360004305679ScreenShot2019-08-27at1406157.png

4. Locate the desired gateway, select the three-dotted menu (...), select Add Tunnel, and then IPSec Site-2-Site Tunnel

  1. Open the configuration file that you have downloaded. Fill in the following fields according to the file's content: Public IP, Remote ID (both identical; marked in red in the attached example), and Shared Secret (marked in yellow; remember to omit the quotation marks).
  2. The rest of the fields should be filled in with the following information:
  • Name: Enter the name you chose for the tunnel.
  • Perimeter 81 Gateway Proposal Subnets: By default, this should be set to 10.255.0.0/16.
  • Remote Gateway Proposal Subnets: Select specified Subnets. Insert your VPC CIDR.

360008885499ScreenShot2020-02-11at152346.png

At the Advanced Settings section fill in the following information:

360006209039mceclip0.png

  • IKE Version: V1
  • IKE Lifetime: 8h
  • Tunnel Lifetime: 1h
  • Dead Peer Detection Delay: 10s
  • Dead Peer Detection Timeout: 30s
  • Encryption (Phase 1): aes128
  • Encryption (Phase 2): aes128
  • Integrity (Phase 1): sha1
  • Integrity (Phase 2): sha1
  • Diffie-Hellman Groups (Phase 1): 2
  • Diffie-Hellman Groups (Phase 2): 2

8. Select Add Tunnel.