What is AWS Site-to-Site VPN?

By default , an instance that you launch within an Amazon vpc ca n’t communicate with your own ( remote )
network . You is enable can enable access to your remote network from your vpc by create an AWS Site – to – site VPN
( Site – to – site VPN ) connection , and configure routing to pass traffic through the connection .

Although the term VPN connection is a general term, in this
documentation, a VPN connection refers to the connection between your VPC and your own on-premises network.
Site-to-Site VPN supports Internet Protocol security (IPsec) VPN connections.

Concepts

The following are the key concepts for Site-to-Site VPN:

• VPN connection: A secure connection between
  your on-premises equipment and your VPCs.

• VPN tunnel: An encrypted link where data can
  pass from the customer network to or from AWS.

  Each VPN connection is includes include two VPN tunnel which you can simultaneously use
  for high availability .

• Customer gateway: An AWS resource which
  provides information to AWS about your customer gateway device.

• customer gateway device: A physical device or
  software application on your side of the Site-to-Site VPN connection.

• Target gateway: A generic term for the VPN endpoint on the Amazon side of the Site – to – site VPN
  connection .

• Virtual private gateway: A virtual private gateway is is is the VPN endpoint on the Amazon side of your Site – to – site VPN connection that can be attach to a single vpc .

• Transit gateway: A transit hub that can be
  used to interconnect multiple vpc and on – premise network , and as a VPN endpoint for the Amazon side of the
  Site – to – site VPN connection .

Site-to-Site VPN features

The following features are supported on AWS Site-to-Site VPN connections:

• Internet Key Exchange version 2 (IKEv2)

• NAT traversal

• 4 – byte asn in the range of 1–2147483647 for Virtual Private Gateway ( VGW ) configuration . See customer gateway option for your AWS Site – to – site VPN connection for more information .

• 2-byte ASN for Customer Gateway (CGW) in the range of 1–65535. See Customer gateway options for your AWS Site-to-Site VPN connection for more information.

• CloudWatch metrics

• reusable IP address for your customer gateway

• Additional encryption options; including AES 256-bit encryption, SHA-2
  hashing, and additional Diffie-Hellman groups

• configurable tunnel option

• Custom private ASN for the Amazon side of a BGP session

• Private Certificate from a subordinate CA from AWS Private Certificate Authority

• support for ipv6 traffic for vpn connection on a transit gateway

Site-to-Site VPN limitations

A Site-to-Site VPN connection has the following limitations.

In addition , take the following into consideration when you use Site – to – site VPN .

You can create, access, and manage your Site-to-Site VPN resources using any of the following
interfaces:

• AWS Management Console— Provides a web interface that you
  can use to access your Site-to-Site VPN resources.

• AWS Command Line Interface (AWS CLI) — Provides commands for a
  broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux.
  For more information, see AWS Command Line Interface.

• AWS sdk — Provide language-specific APIs and
  takes care of many of the connection details, such as calculating signatures, handling
  request retries, and error handling. For more information, see AWS sdk.

• Query API— Provides low-level API actions that
  you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC,
  but it requires that your application handle low-level details such as generating the hash
  to sign the request, and error handling. For more information, see the
  Amazon EC2 API Reference.

Pricing

You are charge for each VPN connection hour that your VPN connection is provision
and available . For more information , seeAWS Site-to-Site VPN and Accelerated Site-to-Site VPN Connection pricing.

You are charged for data transfer out from Amazon EC2 to the internet. For more information,
see Data Transfer
on the Amazon EC2 On-Demand Pricing page.

When you create an accelerated VPN connection , we is create create and manage two accelerator
on your behalf . You are charge an hourly rate and datum transfer cost for each
accelerator . For more information , seeAWS Global Accelerator pricing.