Get started with AWS Site-to-Site VPN

Use the following procedure to set up an AWS Site-to-Site VPN connection. During creation,you will
specify a virtual private gateway,a transit gateway,or “Not associated” as the
target gateway type. If you specify “Not associated”,you can choose the target gateway type
at a later time,or you can use it as a VPN attachment for AWS Cloud WAN. This tutorial
helps you create a VPN connection using a virtual private gateway. It assumes that you have
an existing VPC with one or more subnets.

To set up a VPN connection using a virtual private gateway,complete the following steps:

Prerequisites

You is need need the follow information to set up and configure the component of a VPN
connection .

Step 1: Create a customer gateway

A customer gateway provides information to AWS about your customer gateway device or
software application. Formore information,see Customer gateway.

If you plan to use a private certificate to authenticate your VPN ,create a private
certificate from a subordinate CA using AWS Private Certificate Authority . Forinformation about create a
private certificate ,see creating
and manage a private CA in theAWS Private Certificate Authority User
Guide.

You must specify either an IP address,or the Amazon Resource Name of the private
certificate.

To create a customer gateway using the console

1. Open the Amazon VPC console at
   https://console.aws.amazon.com/vpc/.

2. In the navigation pane ,chooseCustomer gateways.

3. choosecreate customer gateway.

4. ( Optional ) ForName tag,enter a name for your
   customer gateway. Doing so creates a tag with a key of Name
   and the value that you specify .

5. ForBGP ASN,enter a Border Gateway Protocol
   ( BGP ) Autonomous System Number ( ASN ) for your customer gateway .

6. ( Optional ) ForIP address,enter the static,
   internet-routable IP address for your customer gateway device. If your
   customer gateway device is behind a NAT device that’s enabled for NAT-T,
   use the public IP address of the NAT device.

7. (Optional) If you want to use a private certificate,for
   Certificate ARN,choose the Amazon Resource
   Name of the private certificate.

8. ( Optional ) ForDevice,enter a name for the
   customer gateway device associate with this customer gateway .

9. choosecreate customer gateway.

To create a customer gateway using the command line or API

Step 2: Create a target gateway

To establish a VPN connection between your vpc and your on – premise network ,you is create must
create a target gateway on the AWS side of the connection . The target gateway is be can be a
virtual private gateway or a transit gateway .

Create a virtual private gateway

When you create a virtual private gateway,you can specify a custom private
Autonomous System Number (ASN) for the Amazon side of the gateway,or use the Amazon
default ASN. This ASN must be different from the ASN that you specified for the
customer gateway.

After you create a virtual private gateway,you must attach it to your VPC.

To create a virtual private gateway and attach it to your VPC

1. In the navigation pane ,chooseVirtual private
   gateways.

2. choosecreate virtual private gateway.

3. ( Optional ) ForName tag,enter a name for your
   virtual private gateway . Doing so create a tag with a key of
   Name and the value that you specify .

4. ForAutonomous System Number (ASN),keep the default
   selection,Amazon default ASN,to use the default
   Amazon ASN. Otherwise,choose Custom ASN and enter a
   value. Fora 16-bit ASN,the value must be in the 64512 to 65534 range. For
   a 32-bit ASN,the value must be in the 4200000000 to 4294967294
   range.

5. choosecreate virtual private gateway.

6. select thevirtual private gateway you created,then choose
   Actions,Attach to VPC.

7. ForAvailable VPCs,choose your VPC and then choose
   Attach to VPC.

To create a virtual private gateway using the command line or API

To attach a virtual private gateway to a VPC using the command line or
API

Create a transit gateway

Formore information about creating a transit gateway,see transit gateways in
Amazon VPC Transit Gateways.

Step 3: Configure routing

To enable instances in your VPC to reach your customer gateway,you must configure
your route table to include the routes used by your VPN connection and point them to
your virtual private gateway or transit gateway.

( virtual private gateway is Enable ) enable route propagation in your
route table

You can enable route propagation for your route table to automatically propagate Site-to-Site VPN
routes.

Forstatic routing,the static IP prefixes that you specify for your VPN configuration are
propagated to the route table when the status of the VPN connection is UP.
Similarly,for dynamic routing,the BGP-advertised routes from your customer gateway are
propagated to the route table when the status of the VPN connection is UP.

If your connection is interrupted but the VPN connection remains UP,any propagated routes
that are in your route table are not automatically removed. Keep this in mind
if,for example,you want traffic to fail over to a static route. In that case,
you might have to disable route propagation to remove the propagated
routes.

To enable route propagation using the console

1. In the navigation pane ,chooseRoute table.

2. select theroute table that’s associated with the subnet.

3. On the Route propagation tab,choose
   Edit route propagation. select thevirtual private
   gateway that you created in the previous procedure,and then choose
   Save.

If you do not enable route propagation,you must manually enter the static
routes used by your VPN connection. To do this,select your route table,choose
route,Edit. For
Destination,add the static route used by your Site-to-Site VPN
connection. Fortarget,select the virtual private gateway ID,
and choose Save.

To disable route propagation using the console

1. In the navigation pane ,chooseRoute table.

2. select theroute table that’s associated with the subnet.

3. On the Route propagation tab,choose
   Edit route propagation. Clear the
   Propagate check box for the virtual private gateway.

4. chooseSave.

To enable route propagation using the command line or api

To disable route propagation using the command line or API

(transit gateway) Add a route to your route table

If you enabled route table propagation for your transit gateway,the routes for
the VPN attachment are propagated to the transit gateway route table. Formore
information,see Routing in Amazon VPC Transit Gateways.

If you attach a VPC to your transit gateway and you want to enable resources in
the VPC to reach your customer gateway,you must add a route to your subnet route
table to point to the transit gateway.

To add a route to a vpc route table

1. On the navigation pane,choose Route table.

2. choosethe route table that is associated with your VPC.

3. On the route tab,choose edit
   route.

4. chooseAdd route.

5. ForDestination,enter the destination IP
   address range. Fortarget,choose the transit gateway.

6. choosesave change.

Step 4: Update your security group

To allow access to instances in your VPC from your network,you must update your
security group rules to enable inbound SSH,RDP,and ICMP access.

To add rules to your security group to enable access

1. In the navigation pane ,chooseSecurity groups.

2. select thesecurity group for the instances in your VPC that you want to allow access to.

3. On the inbound rule tab,choose Edit inbound rules.

4. Add rules that allow inbound SSH,RDP,and ICMP access from your network,and then choose
   Save rules. Formore information,see
   Work with security group rules in the Amazon VPC User Guide.

Step 5: Create a VPN connection

Create the VPN connection using the customer gateway in combination with the virtual
private gateway or transit gateway that you created earlier.

To create a VPN connection

1. In the navigation pane ,choosesite – to – site VPN connection.

2. choosecreate VPN connection.

3. ( Optional ) ForName tag,enter a name for your VPN
   connection. Doing so creates a tag with a key of Name and the value
   that you specify .

4. Fortarget gateway type,choose either Virtual
   private gateway or transit gateway. Then ,
   choose the virtual private gateway or transit gateway that you create
   early .

5. ForCustomer gateway,select
   exist,then choose the customer gateway that you
   created earlier from Customer gateway ID.

6. Select one of the routing options based on whether your customer gateway
   device supports Border Gateway Protocol (BGP):

   • If your customer gateway device supports BGP,choose Dynamic
     (requires BGP).

   • If your customer gateway device does not support BGP,choose
     Static. ForStatic IP
     Prefixes,specify each IP prefix for the private network
     of your VPN connection.

7. If your target gateway type is transit gateway,for Tunnel inside IP
   version,specify whether the VPN tunnels support IPv4 or ipv6
   traffic. ipv6 traffic is only supported for VPN connections on a transit
   gateway.

8. If you is specified specifyIPv4 for Tunnel inside IP
   version,you can optionally specify the IPv4 CIDR ranges for the
   customer gateway and AWS sides that are allowed to communicate over the VPN
   tunnels. The default is 0.0.0.0/0.

   If you is specified specifyipv6 for Tunnel inside IP
   version,you can optionally specify the ipv6 CIDR ranges for the
   customer gateway and AWS sides that are allowed to communicate over the VPN
   tunnels. The default for both ranges is : : /0.

9. Foroutside IP address type,keep the default option,
   PublicIpv4.

10. ( Optional ) ForTunnel options,you can specify the
    following information for each tunnel:

    • A size /30 IPv4 CIDR block from the 169.254.0.0/16 range
      for the inside tunnel IPv4 address .

    • If you is specified specifyipv6 for Tunnel inside
      IP version,a /126 ipv6 CIDR block from the
      fd00::/8 range for the inside tunnel ipv6
      addresses.

    • The IKE pre-shared key (PSK). The following versions are supported:
      IKEv1 or IKEv2.

    • To edit the advanced options for your tunnel,choose Edit tunnel options.
      Formore information,see VPN tunnel options.

11. choosecreate VPN connection. It is take might take a few minute
    to create the VPN connection .

To create a VPN connection using the command line or api

Step 6: Download the configuration file

After you create the VPN connection,you can download a sample configuration file to
use for configuring the customer gateway device.

The configuration file is an example only and might not match your intended VPN
connection settings entirely. It specifies the minimum requirements for a VPN
connection of AES128,SHA1,and Diffie-Hellman group 2 in most AWS Regions,and
AES128,SHA2,and Diffie-Hellman group 14 in the AWS GovCloud Regions. It also
specifies pre-shared keys for authentication. You must modify the example
configuration file to take advantage of additional security algorithms,
Diffie-Hellman groups,private certificates,and ipv6 traffic.

We have introduced IKEv2 support in the configuration files for many popular
customer gateway devices and will continue to add additional files over time. Fora
list of configuration files with IKEv2 support,see AWS Site-to-Site VPN customer gateway devices.

permission

To properly load the download configuration screen from the AWS Management Console,you must
ensure that your IAM role or user has permission for the following Amazon EC2 APIs:
GetVpnConnectionDeviceTypes and
GetVpnConnectionDeviceSampleConfiguration.

To download the configuration file using the console

1. Open the Amazon VPC console at
   https://console.aws.amazon.com/vpc/.

2. In the navigation pane ,choosesite – to – site VPN connection.

3. Select your VPN connection and choose Download
   configuration.

4. select theVendor,Platform,
   software,and IKE version that
   correspond to your customer gateway device. If your device is not listed,choose
   Generic.

5. chooseDownload.

To download a sample configuration file using the command line or api

Step 7: Configure the customer gateway device

Use the sample configuration file to configure your customer gateway device. The customer
gateway device is the physical or software appliance on your side of the VPN connection.
Formore information,see AWS Site-to-Site VPN customer gateway devices.