AWS — Site-to-Site VPN Connections Overview / Blogs / Perficient

Agenda

• • Autonomous System and BGP
  • what is  Site-to-Site VPN
  • Flow Diagram and Architecture
  • Site-to-Site VPN features
  • Site-to-Site VPN limitations
  • Customer gateway and Virtual Gateway
  • Limitation
  • Alternate VPN
  • Demo

What is Autonomous System:

The Internet is a network of networks, and autonomous systems are the big networks that make up the Internet. More specifically, an autonomous system (AS) is a large network or group of networks that has a unified routing policy. Every computer or device that connects to the Internet is connected to an AS.

 

What is an AS routing policy?

An AS routing policy is a list of the IP address space that the AS controls, plus a list of the other ASes to which it connects. This information is necessary for routing packets to the correct networks. ASes announce this information to the Internet using the Border Gateway Protocol (BGP)

What is BGP?( Border Gateway Protocol)

ASes announce their routing policy to other ASes and routers via the Border Gateway Protocol (BGP). BGP is the protocol for routing data packets between ASes. Without this routing information, operating the Internet on a large scale would quickly become impractical: data packets would get lost or take too long to reach their destinations.

Each AS uses BGP to announce which IP addresses they are responsible for and which other ASes they connect to. BGP routers take all this information from ASes around the world and put it into databases called routing tables to determine the fastest paths from AS to AS. When packets arrive, BGP routers refer to their routing tables to determine which AS the packet should go to next.

With so many ASes in the world, BGP routers are constantly updating their routing tables. As networks go offline, new networks come online, and ASes expand or contract their IP address space, all of this information has to be announced via BGP so that BGP routers can adjust their routing tables.

 

AWS Site-to-Site VPN?

Gateway Types

• Instances that you launch into an Amazon VPC can’t communicate with your own remote (On-premises) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN connection and configuring routing to pass traffic through the connection.
• AWS Site-to-Site VPN creates encrypted tunnels between your network and your Amazon VPCs or AWS Transit Gateways. On the AWS side of the VPN connection, a Virtual Private Gateway or Transit Gateway provides two VPN tunnels (endpoints which use a unique public IP address) which you can simultaneously use for high availability and automatic failover (redundancy).
• on-premises (remote) network includes a customer gateway device, which you must configure to enable the Site-to-Site VPN connection. You set up the routing so that any traffic from the VPC bound for our network is routed to the virtual private gateway.

 concepts for Site-to-Site VPN:

VPN connection: A secure connection between your on-premises equipment and your vpcs.

Vpn tunnel: an encrypted link where data can pass from the customer network to or from aws.

Customer gateway (cgw): a resource that you create in aws that represents the customer gateway device in your on-premises network.

Customer gateway device: a physical device or software application on your side of the site-to-site vpn connection.

Virtual Private Gateway (VGW): It is the VPN concentrator on the AWS side of the VPN connection. You have to attach it to the VPC from which you want to create the Site-to-Site VPN connection. (dynamic Routing)

Transit Gateway (TGW): It is a transit hub that you can use to interconnect your VPC and on-premises networks. You can create a VPN connection as an attachment on a transit gateway.

Site-to-Site VPN features

The following features are supported on AWS Site-to-Site VPN connections:

Virtual private gateway

A virtual private gateway is the VPN concentrator on the Amazon side of the Site-to-Site VPN connection. You create a virtual private gateway and attach it to the VPC from which you want to create the Site-to-Site VPN connection.

 

Customer gateway

A customer gateway is a resource that you create in AWS that represents the customer gateway device in your on-premises network. When you create a customer gateway, you provide information about your device to AWS. For more information, see Customer gateway options for your Site-to-Site VPN connection.

Single Site-to-Site VPN connection

The VPC has an attached virtual private gateway, and your on-premises (remote) network includes a customer gateway device, which you must configure to enable the Site-to-Site VPN connection. You set up the routing so that any traffic from the VPC bound for your network is routed to the virtual private gateway.

Multiple Site-to-Site VPN connections with a transit gateway

The VPC has an attached transit gateway, and you have multiple Site-to-Site VPN connections to multiple on-premises locations. You set up the routing so that any traffic from the VPC bound for your networks is routed to the transit gateway.

You can also use this scenario to create Site-to-Site VPN connections to multiple geographic locations and provide secure communication between sites.

 

Note :

Private IP Site-to-Site VPN connection with AWS Direct Connect

 

With a private IP Site-to-Site VPN you can encrypt AWS Direct Connect traffic between your on-premises network and AWS without the use of public IP addresses. Private IP VPN over AWS Direct Connect ensures that traffic between AWS and on-premises networks is both secure and private, allowing customers to comply with regulatory and security mandates.