Agenda

• • Autonomous System and BGP
  • what is  Site-to-Site VPN
  • Flow Diagram and Architecture
  • Site-to-Site VPN features
  • Site-to-Site VPN limitations
  • Customer gateway and Virtual Gateway
  • Limitation
  • Alternate VPN
  • Demo

What is Autonomous System:

The Internet is a network of networks, and autonomous systems are the big networks that make up the Internet. More specifically, an autonomous system (AS) is a large network or group of networks that has a unified routing policy. Every computer or device that connects to the Internet is connected to an AS.

What is an AS routing policy?

An AS routing policy is a list of the IP address space that the AS controls, plus a list of the other ASes to which it connects. This information is necessary for routing packets to the correct networks. ASes announce this information to the Internet using the Border Gateway Protocol (BGP)

What is BGP?( Border Gateway Protocol)

ASes announce their routing policy to other ASes and routers via the Border Gateway Protocol (BGP). BGP is the protocol for routing data packets between ASes. Without this routing information, operating the Internet on a large scale would quickly become impractical: data packets would get lost or take too long to reach their destinations.

Each AS uses BGP to announce which IP addresses they are responsible for and which other ASes they connect to. BGP routers take all this information from ASes around the world and put it into databases called routing tables to determine the fastest paths from AS to AS. When packets arrive, BGP routers refer to their routing tables to determine which AS the packet should go to next.

With so many ASes in the world, BGP routers are constantly updating their routing tables. As networks go offline, new networks come online, and ASes expand or contract their IP address space, all of this information has to be announced via BGP so that BGP routers can adjust their routing tables.

AWS Site-to-Site VPN?

Gateway Types

• Instances that you launch into an Amazon VPC can’t communicate with your own remote (On-premises) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN connection and configuring routing to pass traffic through the connection.
• AWS Site-to-Site VPN creates encrypted tunnels between your network and your Amazon VPCs or AWS Transit Gateways. On the AWS side of the VPN connection, a Virtual Private Gateway or Transit Gateway provides two VPN tunnels (endpoints which use a unique public IP address) which you can simultaneously use for high availability and automatic failover (redundancy).
• on-premises (remote) network includes a customer gateway device, which you must configure to enable the Site-to-Site VPN connection. You set up the routing so that any traffic from the VPC bound for our network is routed to the virtual private gateway.

 concepts for Site-to-Site VPN:

VPN connection: A secure connection between your on-premises equipment and your vpcs.

Vpn tunnel: an encrypted link where data can pass from the customer network to or from aws.

Customer gateway (cgw): a resource that you create in aws that represents the customer gateway device in your on-premises network.

Customer gateway device: a physical device or software application on your side of the site-to-site vpn connection.

Virtual Private Gateway (VGW): It is the VPN concentrator on the AWS side of the VPN connection. You have to attach it to the VPC from which you want to create the Site-to-Site VPN connection. (dynamic Routing)

Transit Gateway (TGW): It is a transit hub that you can use to interconnect your VPC and on-premises networks. You can create a VPN connection as an attachment on a transit gateway.

Site-to-Site VPN features

The following features are supported on AWS Site-to-Site VPN connections:

• Internet Key Exchange version 2 (IKEv2)
• NAT traversal
• 4-byte ASN in the range of 1 – 2147483647 for Virtual Private Gateway (VGW) configuration. See Customer gateway options for your Site-to-Site VPN connection for more information.
• 2-byte ASN for Customer Gateway (CGW) in the range of 1 – 65535. See Customer gateway options for your Site-to-Site VPN connection for more information.
• CloudWatch metrics
• Reusable IP addresses for your customer gateways
• Additional encryption options; including AES 256-bit encryption, SHA-2 hashing, and additional Diffie-Hellman groups
• Configurable tunnel options
• Custom private ASN for the Amazon side of a BGP session
• Private Certificate from a subordinate CA from AWS Private Certificate Authority
• Support for IPv6 traffic for VPN connections on a transit gateway

Site-to-Site VPN limitations

A Site-to-Site VPN connection has the following limitations.

• IPv6 traffic is not supported for VPN connections on a virtual private gateway.
• An AWS VPN connection does not support Path MTU Discovery.

In addition, take the following into consideration when you use Site-to-Site VPN.

• When connecting your VPCs to a common on-premises network, we recommend that you use non-overlapping CIDR blocks for your networks.

Pricing

Revolutionize Your Business With Generative AI

From product design and software development to virtual agents, content creation, and reporting, GenAI is transforming business. Our AI experts help you unlock GenAI’s full potential and drive growth.

Let’s Get Started

You are charged for each VPN connection hour that your VPN connection is provisioned and available. For more information, see AWS Site-to-Site VPN and Accelerated Site-to-Site VPN Connection pricing.

You are charged for data transfer out from Amazon EC2 to the internet. For more information, see Data Transfer on the Amazon EC2 On-Demand Pricing page.

When you create an accelerated VPN connection, we create and manage two accelerators on your behalf. You are charged an hourly rate and data transfer costs for each accelerator. For more information, see AWS Global Accelerator pricing.

How AWS Site-to-Site VPN works

A Site-to-Site VPN connection offers two VPN tunnels between a virtual private gateway or a transit gateway on the AWS side, and a customer gateway (which represents a VPN device) on the remote (on-premises) side.

Virtual private gateway

A virtual private gateway is the VPN concentrator on the Amazon side of the Site-to-Site VPN connection. You create a virtual private gateway and attach it to the VPC from which you want to create the Site-to-Site VPN connection.

Transit gateway

A transit gateway is a transit hub that you can use to interconnect your virtual private clouds (VPC) and on-premises networks. For more information, see Amazon VPC Transit Gateways. You can create a Site-to-Site VPN connection as an attachment on a transit gateway.

Customer gateway

A customer gateway is a resource that you create in AWS that represents the customer gateway device in your on-premises network. When you create a customer gateway, you provide information about your device to AWS. For more information, see Customer gateway options for your Site-to-Site VPN connection.

Site-to-Site VPN architectures

Single Site-to-Site VPN connection

The VPC has an attached virtual private gateway, and your on-premises (remote) network includes a customer gateway device, which you must configure to enable the Site-to-Site VPN connection. You set up the routing so that any traffic from the VPC bound for your network is routed to the virtual private gateway.

Single Site-to-Site VPN connection with a transit gateway

The VPC has an attached transit gateway, and your on-premises (remote) network includes a customer gateway device, which you must configure to enable the Site-to-Site VPN connection. You set up the routing so that any traffic from the VPC bound for your network is routed to the transit gateway.

Multiple Site-to-Site VPN connections

The VPC has an attached virtual private gateway, and you have multiple Site-to-Site VPN connections to multiple on-premises locations. You set up the routing so that any traffic from the VPC bound for your networks is routed to the virtual private gateway.

You can also use this scenario to create Site-to-Site VPN connections to multiple geographic locations and provide secure communication between sites. For more information, see Providing secure communication between sites using VPN CloudHub.

The VPC has an attached transit gateway, and you have multiple Site-to-Site VPN connections to multiple on-premises locations. You set up the routing so that any traffic from the VPC bound for your networks is routed to the transit gateway.

You can also use this scenario to create Site-to-Site VPN connections to multiple geographic locations and provide secure communication between sites.

Private IP Site-to-Site VPN connection with AWS Direct Connect

With a private IP Site-to-Site VPN you can encrypt AWS Direct Connect traffic between your on-premises network and AWS without the use of public IP addresses. Private IP VPN over AWS Direct Connect ensures that traffic between AWS and on-premises networks is both secure and private, allowing customers to comply with regulatory and security mandates.