Site-to-Site VPN Options Using AWS
We recently worked with a customer that had a requirement that their application needed to connect via Site-to-Site VPN to there clients application. They had a few choices, but they decided to move there application to Amazon Web Services (AWS) and connect to there clients datacenter from there. Therefore we setup a Virtual Private Cloud (VPC) within Amazon and started down the path of setting up a Site-to-Site Virtual Private Network (VPN) connection.
There are multiple ways of implementing a VPN within Amazon as discussed here. In most cases, it’s going to come down to using a AWS Hardware VPN or a Software VPN. The AWS Hardware VPN can be configured within a couple clicks and it gives you the option to generate the configuration for multiple well known firewalls, which you can use to configure your firewall or you can provide to your firewall administrator. The Software VPN consists of running an EC2 instance that has software that implements VPN functionality.
The main factor in deciding AWS Hardware VPN versus Software VPN should be based on who’s initiating the traffic. In our case, the customers application needed to initiate the request. This means that we had to leverage the Software VPN approach because the AWS Hardware VPN can not initiate traffic. It can only accept request. So, it’s great for a company that wants to migrate systems from there datacenter to Amazon and then have there user access the systems. Hence, their users are the initiators of the traffic.
The installation and setup of a Software VPN isn’t really that difficult, but you have to have some basic understanding of how AWS networking works. There are a few Software VPN implementations, but we selected OpenSWAN. There’s a few good articles that we used.
One of the main gotcha’s in setting up OpenSwan are to ensure that the Access Control List (ACL) defined by the far end (the Router that you are establishing the VPN with) matches the Right side configuration parameter within the setup. Once you read thru the above articles you will know what I mean.
The average time to setup an AWS Hardware VPN is 5 hours. This includes configuration, testing and turn-up with the far end.
The average time to setup a Software VPN is 10-20 hours. It really depends on the complexity of the Amazon VPC and how you need traffic to be routed and represented.
About dOpenSource
We provide Amazon Web Services (AWS) consulting with a focus on DevOPs and Infrastructure Migration.
We are proud to be based in Detroit, MI with coverage from 9am-8pm ET. We have staff on the East and
West Coast. You can purchase support from us by going to http://dopensource.com/shop