SlideShare a Scribd company logo

Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS

Download as PPTX, PDF
Namba Kazuo, profile picture
Namba Kazuo

The document discusses using AWS VPC networking features to enable dual-stack IPv4 and IPv6 connectivity. It provides examples of setting up an internet-facing application load balancer and a site-to-site VPN connection using Transit Gateway with dual-stack support. The key steps involve configuring the VPC, subnets, route tables, and network interfaces to support both IPv4 and IPv6 addressing and routing.

Technology
1 of 50
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
AWS AS A WEEKEND HOBBY Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS
Kazuo Namba＠JAWS-UG Okayama RHIZOME CO.,LTD Twitter:@kazu_0  Occupation  System Administrator  In charge of cloud and On-Premises Infrastructure  Certification  Chief Telecommunications Engineer Transmissionand Switching and Line Engineer  On-The-Ground I-Category Special Radio Operator  Technical Engineer Network My favorite AWS Service ：Transit Gateway/VPC/DX ：Global Accelerator
IPV4/IPV6 DUAL STACK • Since it was released about Decade, have you ever used VPC function that IPv4 and IPv6 dual stack? • Let's consider about use case for IPv6 solution on the AWS environment.
IPV4/IPV6 DUAL STACK • Since it was released about Decade, have you ever used VPC function that IPv4 and IPv6 dual stack? Elastic Load Balancing – IPv6, Zone Apex Support, Additional Security | AWS News Blog (amazon.com)
IPV4/IPV6 DUAL STACK • World IPv6 Day IPv6が本格的に展開していくことに弾みをつけるための試み として、Internet Society (ISOC)が2011年6月8日の1日だけ、 サービス事業者が一斉にIPv6を有効化してみることを呼びか けたのがWorld IPv6 Dayです As an attempt to give momentum to the full-scale deployment of IPv6, the Internet Society (ISOC) held World IPv6 Day on June 8, 2011, to encourage service providers to enable IPv6 simultaneously for one day. https://www.worldipv6launch.org/ https://blog.nic.ad.jp/2021/6406/
IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
• VPC IPv6 setting is very simple • Action - Edit CIDRｓ • Add new IPｖ６ CIDR • you can get /56 IPv6 prefix 1. CONFIGURE VPC FOR DUAL STACK
• VPC IPv6 setting is very simple • Action - Edit CIDRｓ • Add new IPｖ６ CIDR • you can get /56 IPv6 prefix 1. CONFIGURE VPC FOR DUAL STACK
• What’s /56 prefix address like? • can create 256 subnets what have 64 power of 2 = 1844,6744,0737,0955,1616 address • 1844京6744兆0737億0955万1616 1. CONFIGURE VPC FOR DUAL STACK
• Subnet IPv6 setting is very simple same as VPC • Action - Edit IPv6 CIDRｓ • Add IPｖ６ CIDR 2. CONFIGURE SUBNET FOR DUAL STACK
• Subnet ipv6 setting is very simple same as VPC • you can set up /64 IPv6 prefix subnet in to the /56 VPC IPv6 prefix network 2. CONFIGURE SUBNET FOR DUAL STACK
• Internet-facing VPC Route Tables Setting • set up the IPｖ６ default Route (::/0) to internet gateway 3. CONFIGURE ROUTE TABLE
• VPC Route Tables Setting When you want to permit only outbound traffic, recommendation is using Egress-only internet gateways 3. CONFIGURE ROUTE TABLE
• in the case of creating a new ELB • Edit IP address type • please choose dualstack 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
• setting change existing ELB • Action - Edit IP address type • please choose dualstack 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
• setting change existing ELB • Action - Edit IP address type • please choose dualstack 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
> Resolve-DnsName -name Oreg-VPC218-alb-511053037.us-west- 2.elb.amazonaws.com Name Type TTL Section IPAddress ---- ---- --- ------- --------- Oreg-VPC218-alb-511053037.us-west-2.elb.amazon AAAA 60 Answer 2600:1f14:260:1d10:90c0:cae5:77ff:6cb3 aws.com Oreg-VPC218-alb-511053037.us-west-2.elb.amazon A 60 Answer 44.240.137.147 aws.com 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
• ELB Security Group Setting • Plese set up port range what you want to permit e.g. HTTP（８０） ::/0 HTTPS（４４３） ::/0 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
• Record type - AAAA • you can set up alias record to target that routing traffic to ELB 5. DNS RESOLUTION FOR APPLICATION ENDPOINTS WITH ROUTE53
Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 3. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table
• Route Table • Transit gateway route table and VPC route table • Transit gateway can has some route table like VRF. • (I won't explain this session.) • Attachments • Connection point to Transit Gateway from VPC/VPN/DX-GW • Associations • Propagations TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE
• Route Table • Transit gateway route table and VPC route table • Transit gateway can has some route table like VRF. • (I won't explain this session.) • Attachments • Connection point to Transit Gateway from VPC/VPN/DX-GW • Associations • Propagations TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE
• Route Table • Transit gateway route table and VPC route table • Transit gateway can has some route table like VRF. • (I won't explain this session.) • Attachments • Connection point to Transit Gateway from VPC/VPN/DX-GW • Associations • Propagations TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
• you can't set up site to site VPN ipv6 support via Transit gateway attachment menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
• you can't set up site to site VPN ipv6 support via Transit gateway attachment menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
• for that reason please set up from Site-to-Site VPN Connections menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
• for that reason please set up from Site-to-Site VPN Connections menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
• RTX Static route sample ikev2/nat-t 2.CUSTUMER GATEWAY CONFIG ip route default gateway 10.1.0.254 ipv6 routing on ipv6 route default gateway tunnel 1 ipv6 prefix 1 2001:db8:1::/64 ip lan1 address 10.1.100.61/16 ipv6 lan1 address 2001:db8:1::1/64 • The outer address of the IPSec tunnel is IPv4, so set the default route to IPv4 internet gateway. • IPv6 default route is configured to the virtual tunnel interface.
• RTX Static route sample ikev2/nat-t 2.CUSTUMER GATEWAY CONFIG tunnel select 1 ipsec tunnel 201 ipsec sa policy 201 1 esp aes256-cbc sha256-hmac ipsec ike version 1 2 ipsec ike duration ipsec-sa 1 3600 ipsec ike duration isakmp-sa 1 28800 ipsec ike encryption 1 aes256-cbc ipsec ike group 1 modp1536 ipsec ike hash 1 sha256 ipsec ike keepalive log 1 on ipsec ike keepalive use 1 on rfc4306 10 3 ipsec ike local name 1 10.1.100.61 ipv4-addr ipsec ike nat-traversal 1 on type=2 ipsec ike pfs 1 on ipsec ike message-id-control 1 on ipsec ike pre-shared-key 1 text tunnel1-Pre-Shared Key ipsec ike remote address 1 52.33.151.55 ipsec ike remote name 1 52.33.151.55 ipv4-addr ipsec ike negotiation receive 1 off ipsec auto refresh 1 on ipsec tunnel outer df-bit clear tunnel backup tunnel 2 switch-interface=on ip tunnel tcp mss limit auto ipv6 tunnel address fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7e/126 tunnel enable 1 subnet fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 AWS side fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7d/126 CGW side fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7e/126
• Site-to-Site VPN Connection (Static route) 2.CUSTUMER GATEWAY CONFIG When the Customer Gateway configuration is complete, the connection status will be Up as shown in the figure.
• Transit gateway route table 3.SET UP ROUTE TABLE FOR TRANSIT GATEWAY AND EACH VPC ATTACHMENTS Configure the IPv6 route to the on-premises network via Transit Gateway VPN attachment.
5.SET UP ROUTE TABLE FOR TRANSIT GATEWAY AND EACH VPC ATTACHMENTS • VPC route table need to set up static route to On-Pre to VPC route table because ,it does not registered automatic.
Transit Gateway Destination Target 2600:1f13:964:c100::/56 TGW 2001:db8:1:0:0:0:0:0/64 TGW 2600:1f14:aff:e000::/56 local VPC-A Route table Attachments A Attachments VPN Destination Target ::/0 TGW 2001:db8:1:0:0:0:0:0/64 local On-prem Route table TGW route table Associations Propagations Up_till_Down-tgw-rt VPC-A, VPC- B,VPN VPC-A, VPC-B,VPN Attachments B TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE VPC-B Route table Destination Target 2600:1f14:aff:e000::/56 TGW 2001:db8:1:0:0:0:0:0/64 TGW 2600:1f13:964:c100::/56 local
AWS AS A WEEKEND HOBBY • Summaｒｙ • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway • Reference • IPv6 Reference Architectures for AWS and Hybrid Networks (awsstatic.com)
AWS as a weekend hobby Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS

More Related Content

PDF
20211120 Automating EC2 operations / EC2運用の自動化
Masaru Ogura
 
PDF
Advanced Task Scheduling with Amazon ECS
Julien SIMON
 
PDF
[AWS Dev Day] 실습워크샵 | Amazon EKS 핸즈온 워크샵
Amazon Web Services Korea
 
PDF
Advanced Security Masterclass - Tel Aviv Loft
Ian Massingham
 
PPTX
Continuous Delivery in the AWS Cloud
Nigel Fernandes
 
PDF
ECS and ECR deep dive
Shiva Narayanaswamy
 
PPTX
Aws atlanta march_2015
Adam Book
 
PDF
AWS EC2 tutorial
Alexander Novikov
 
20211120 Automating EC2 operations / EC2運用の自動化
Masaru Ogura
 
Advanced Task Scheduling with Amazon ECS
Julien SIMON
 
[AWS Dev Day] 실습워크샵 | Amazon EKS 핸즈온 워크샵
Amazon Web Services Korea
 
Advanced Security Masterclass - Tel Aviv Loft
Ian Massingham
 
Continuous Delivery in the AWS Cloud
Nigel Fernandes
 
ECS and ECR deep dive
Shiva Narayanaswamy
 
Aws atlanta march_2015
Adam Book
 
AWS EC2 tutorial
Alexander Novikov
 

What's hot (7)

PDF
Advanced Task Scheduling with Amazon ECS (June 2017)
Julien SIMON
 
PDF
AWS VPC, ELB, Route53 and CloudFront
Szilveszter Molnár
 
PDF
Building Open Source Platforms on AWS (April 2017)
Julien SIMON
 
PDF
An Introduction to Amazon VPC
Sarah Z
 
PPTX
AWS Introduction
Dimosthenis Botsaris
 
PDF
5 things you don't know about Amazon Web Services
Simone Brunozzi
 
PDF
VMware and AWS together (June 2017)
Julien SIMON
 
Advanced Task Scheduling with Amazon ECS (June 2017)
Julien SIMON
 
AWS VPC, ELB, Route53 and CloudFront
Szilveszter Molnár
 
Building Open Source Platforms on AWS (April 2017)
Julien SIMON
 
An Introduction to Amazon VPC
Sarah Z
 
AWS Introduction
Dimosthenis Botsaris
 
5 things you don't know about Amazon Web Services
Simone Brunozzi
 
VMware and AWS together (June 2017)
Julien SIMON
 
Ad

Similar to Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS (20)

PPTX
Apnic IPv6 Deployment
APNIC
 
PDF
02 - IDNOG04 - Sheryl Hermoso (APNIC) - IPv6 Deployment at APNIC
Indonesia Network Operators Group
 
PDF
npNOG 2: APNIC IPv6 deployment
APNIC
 
PPTX
IPv6 deployment at APNIC
APNIC
 
PDF
Deploying IPv6 in OpenStack Environments
Shannon McFarland
 
PPTX
APNIC IPv6 Deployment
APNIC
 
PPTX
AWS SSA Webinar 10 - Getting Started on AWS: Networking
Cobus Bernard
 
PPTX
AWS network services
Nagesh Ramamoorthy
 
PDF
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PROIDEA
 
PPTX
Introduction to AWS VPC & Networking
Michael Pearce
 
PPTX
SESSION8_AWS how to deploy the resources and services
Saravanan68713
 
PPTX
IP Multicast on ec2
Kenta Yasukawa
 
PPTX
Cloud Architecture and protocols ipv6 addressing.pptx
dhruvisrishwal06
 
PPTX
Introduction to AWS VPC, Guidelines, and Best Practices
Gary Silverman
 
PDF
saa3_wk5.pdf
Michgo1
 
PDF
Distribua, gerencie e escale suas aplicações com o aws elastic beanstalk
Amazon Web Services LATAM
 
PPTX
Deploying your web application with AWS ElasticBeanstalk
Julien SIMON
 
PPTX
CON410 - Deep Dive into Container Networking (re:Invent 2018)
aniait
 
PPTX
How Easy to Automate Application Deployment on AWS
Institut Teknologi Sepuluh Nopember Surabaya
 
PPTX
vBrownBag AWS Certified SysOps : Associate Domain 4
Eric Santelices
 
Apnic IPv6 Deployment
APNIC
 
02 - IDNOG04 - Sheryl Hermoso (APNIC) - IPv6 Deployment at APNIC
Indonesia Network Operators Group
 
npNOG 2: APNIC IPv6 deployment
APNIC
 
IPv6 deployment at APNIC
APNIC
 
Deploying IPv6 in OpenStack Environments
Shannon McFarland
 
APNIC IPv6 Deployment
APNIC
 
AWS SSA Webinar 10 - Getting Started on AWS: Networking
Cobus Bernard
 
AWS network services
Nagesh Ramamoorthy
 
PLNOG 17 - Tomasz Stachlewski - Infrastruktura sieciowa w chmurze AWS
PROIDEA
 
Introduction to AWS VPC & Networking
Michael Pearce
 
SESSION8_AWS how to deploy the resources and services
Saravanan68713
 
IP Multicast on ec2
Kenta Yasukawa
 
Cloud Architecture and protocols ipv6 addressing.pptx
dhruvisrishwal06
 
Introduction to AWS VPC, Guidelines, and Best Practices
Gary Silverman
 
saa3_wk5.pdf
Michgo1
 
Distribua, gerencie e escale suas aplicações com o aws elastic beanstalk
Amazon Web Services LATAM
 
Deploying your web application with AWS ElasticBeanstalk
Julien SIMON
 
CON410 - Deep Dive into Container Networking (re:Invent 2018)
aniait
 
How Easy to Automate Application Deployment on AWS
Institut Teknologi Sepuluh Nopember Surabaya
 
vBrownBag AWS Certified SysOps : Associate Domain 4
Eric Santelices
 
Ad

More from Namba Kazuo (7)

PPTX
AWS Site-to-Site VPN with IKEv2 from CGW under NAT and served with PrivateLink.
Namba Kazuo
 
PPTX
週末趣味のAWS VPC Traffic Mirroring
Namba Kazuo
 
PPTX
週末趣味のAWS Transit Gatewayでの経路制御
Namba Kazuo
 
PPTX
ドキュメント週末趣味のAWS ElasticBeanstalk編 Health Cheack Type
Namba Kazuo
 
PDF
ドキュメント週末趣味のAWS Elastic Beanstalk 編
Namba Kazuo
 
PDF
Aws of the_weekend_hobby
Namba Kazuo
 
PDF
Azure of the_weekend_hobby
Namba Kazuo
 
AWS Site-to-Site VPN with IKEv2 from CGW under NAT and served with PrivateLink.
Namba Kazuo
 
週末趣味のAWS VPC Traffic Mirroring
Namba Kazuo
 
週末趣味のAWS Transit Gatewayでの経路制御
Namba Kazuo
 
ドキュメント週末趣味のAWS ElasticBeanstalk編 Health Cheack Type
Namba Kazuo
 
ドキュメント週末趣味のAWS Elastic Beanstalk 編
Namba Kazuo
 
Aws of the_weekend_hobby
Namba Kazuo
 
Azure of the_weekend_hobby
Namba Kazuo
 

Recently uploaded (20)

PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PDF
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PDF
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Blue Purple Modern Animated Computer Science Presentation.pdf.pdf
Akar16
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
Encapsulation theory and applications.pdf
gurumoop
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
MIND Revenue Release Quarter 2 2025 Press Release
MIND CTI
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
Peak of Data & AI Encore- AI for Metadata and Smarter Workflows
Safe Software
 
Approach and Philosophy of On baking technology
30anthuong17
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 

Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS

  • 1. AWS AS A WEEKEND HOBBY Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS
  • 2. Kazuo Namba＠JAWS-UG Okayama RHIZOME CO.,LTD Twitter:@kazu_0  Occupation  System Administrator  In charge of cloud and On-Premises Infrastructure  Certification  Chief Telecommunications Engineer Transmissionand Switching and Line Engineer  On-The-Ground I-Category Special Radio Operator  Technical Engineer Network My favorite AWS Service ：Transit Gateway/VPC/DX ：Global Accelerator
  • 3. IPV4/IPV6 DUAL STACK • Since it was released about Decade, have you ever used VPC function that IPv4 and IPv6 dual stack? • Let's consider about use case for IPv6 solution on the AWS environment.
  • 4. IPV4/IPV6 DUAL STACK • Since it was released about Decade, have you ever used VPC function that IPv4 and IPv6 dual stack? Elastic Load Balancing – IPv6, Zone Apex Support, Additional Security | AWS News Blog (amazon.com)
  • 5. IPV4/IPV6 DUAL STACK • World IPv6 Day IPv6が本格的に展開していくことに弾みをつけるための試み として、Internet Society (ISOC)が2011年6月8日の1日だけ、 サービス事業者が一斉にIPv6を有効化してみることを呼びか けたのがWorld IPv6 Dayです As an attempt to give momentum to the full-scale deployment of IPv6, the Internet Society (ISOC) held World IPv6 Day on June 8, 2011, to encourage service providers to enable IPv6 simultaneously for one day. https://www.worldipv6launch.org/ https://blog.nic.ad.jp/2021/6406/
  • 6. IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
  • 7. IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
  • 8. IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
  • 9. Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
  • 10. Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
  • 11. Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
  • 12. Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
  • 13. Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 2. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
  • 14. • VPC IPv6 setting is very simple • Action - Edit CIDRｓ • Add new IPｖ６ CIDR • you can get /56 IPv6 prefix 1. CONFIGURE VPC FOR DUAL STACK
  • 15. • VPC IPv6 setting is very simple • Action - Edit CIDRｓ • Add new IPｖ６ CIDR • you can get /56 IPv6 prefix 1. CONFIGURE VPC FOR DUAL STACK
  • 16. • What’s /56 prefix address like? • can create 256 subnets what have 64 power of 2 = 1844,6744,0737,0955,1616 address • 1844京6744兆0737億0955万1616 1. CONFIGURE VPC FOR DUAL STACK
  • 17. • Subnet IPv6 setting is very simple same as VPC • Action - Edit IPv6 CIDRｓ • Add IPｖ６ CIDR 2. CONFIGURE SUBNET FOR DUAL STACK
  • 18. • Subnet ipv6 setting is very simple same as VPC • you can set up /64 IPv6 prefix subnet in to the /56 VPC IPv6 prefix network 2. CONFIGURE SUBNET FOR DUAL STACK
  • 19. • Internet-facing VPC Route Tables Setting • set up the IPｖ６ default Route (::/0) to internet gateway 3. CONFIGURE ROUTE TABLE
  • 20. • VPC Route Tables Setting When you want to permit only outbound traffic, recommendation is using Egress-only internet gateways 3. CONFIGURE ROUTE TABLE
  • 21. • in the case of creating a new ELB • Edit IP address type • please choose dualstack 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
  • 22. • setting change existing ELB • Action - Edit IP address type • please choose dualstack 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
  • 23. • setting change existing ELB • Action - Edit IP address type • please choose dualstack 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
  • 24. > Resolve-DnsName -name Oreg-VPC218-alb-511053037.us-west- 2.elb.amazonaws.com Name Type TTL Section IPAddress ---- ---- --- ------- --------- Oreg-VPC218-alb-511053037.us-west-2.elb.amazon AAAA 60 Answer 2600:1f14:260:1d10:90c0:cae5:77ff:6cb3 aws.com Oreg-VPC218-alb-511053037.us-west-2.elb.amazon A 60 Answer 44.240.137.147 aws.com 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
  • 25. • ELB Security Group Setting • Plese set up port range what you want to permit e.g. HTTP（８０） ::/0 HTTPS（４４３） ::/0 4. APPLICATION LOAD BALANCER (ALB) FOR DUAL STACK
  • 26. • Record type - AAAA • you can set up alias record to target that routing traffic to ELB 5. DNS RESOLUTION FOR APPLICATION ENDPOINTS WITH ROUTE53
  • 27. Elastic Beanstalk container deployment deployment EC2 compute container certificate manager EC2 compute container 5. Route 53 festa-ghost.us-west-2.elasticbeanstalk.com ↓ festa2017.std-adhocracy.net AWS ElasticBeanstalk ELB Health Cheack Type (slideshare.net) 1. VPC 172.22.218.0/24 2600:1f14:260:1d00::/56 2. Subnet 172.22.218.64/26 2600:1f14:260:1d10::/64 3. Subnet 172.22.218.128/26 2600:1f14:260:1d11::/64 1. Configure VPC for dual stack 2. Configure subnet for dual stack 3. Configure internet connectivity by adding the default routes for IPv4 and IPv6 in pubic subnet 4. Configure Application Load Balancer (ALB)for dual stack 5. Configure DNS resolution for application endpoints with route53. 4. Application Load Balancer INTERNET-FACING APPLICATION LOAD BALANCER 3. route table
  • 28. IPV4/IPV6 DUAL STACK • Let's consider about use case to IPv6 solution on the AWS environment below 2 cases • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway
  • 29. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table
  • 30. • Route Table • Transit gateway route table and VPC route table • Transit gateway can has some route table like VRF. • (I won't explain this session.) • Attachments • Connection point to Transit Gateway from VPC/VPN/DX-GW • Associations • Propagations TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE
  • 31. • Route Table • Transit gateway route table and VPC route table • Transit gateway can has some route table like VRF. • (I won't explain this session.) • Attachments • Connection point to Transit Gateway from VPC/VPN/DX-GW • Associations • Propagations TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE
  • 32. • Route Table • Transit gateway route table and VPC route table • Transit gateway can has some route table like VRF. • (I won't explain this session.) • Attachments • Connection point to Transit Gateway from VPC/VPN/DX-GW • Associations • Propagations TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE
  • 33. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
  • 34. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
  • 35. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
  • 36. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
  • 37. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
  • 38. VPN CONNECTIVITY WITH AWS TRANSIT GATEWAY AWS Cloud 1.Transit Gateway 2.Customer gateway VPC A Corporate data center VPN connection for ipv6 VPC B Site to Site VPN connections VPN connection for ipv4 3.VPC Route table 2600:1f14:aff:e000::/56 2001:db8:1::1/64 fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 3.TGW Route table 3.VPC Route table 1. Configure Transit gateway attachment for dual stack Site to Site VPN The outer IP addresses of the Site to Site VPN connections are public IPv4 addresses One of the VPN tunnels is configured with inner IPv6 addresses, and routes IPv6 traffic The other VPN tunnel is configured with inner IPv4 addresses, routes IPv4 traffic 2. Set up Customer gateway 3. Set up route table for transit gateway and each VPC attachments
  • 39. • you can't set up site to site VPN ipv6 support via Transit gateway attachment menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
  • 40. • you can't set up site to site VPN ipv6 support via Transit gateway attachment menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
  • 41. • for that reason please set up from Site-to-Site VPN Connections menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
  • 42. • for that reason please set up from Site-to-Site VPN Connections menu 1.CONFIGURE TRANSIT GATEWAY ATTACHMENT FOR DUAL STACK SITE TO SITE VPN
  • 43. • RTX Static route sample ikev2/nat-t 2.CUSTUMER GATEWAY CONFIG ip route default gateway 10.1.0.254 ipv6 routing on ipv6 route default gateway tunnel 1 ipv6 prefix 1 2001:db8:1::/64 ip lan1 address 10.1.100.61/16 ipv6 lan1 address 2001:db8:1::1/64 • The outer address of the IPSec tunnel is IPv4, so set the default route to IPv4 internet gateway. • IPv6 default route is configured to the virtual tunnel interface.
  • 44. • RTX Static route sample ikev2/nat-t 2.CUSTUMER GATEWAY CONFIG tunnel select 1 ipsec tunnel 201 ipsec sa policy 201 1 esp aes256-cbc sha256-hmac ipsec ike version 1 2 ipsec ike duration ipsec-sa 1 3600 ipsec ike duration isakmp-sa 1 28800 ipsec ike encryption 1 aes256-cbc ipsec ike group 1 modp1536 ipsec ike hash 1 sha256 ipsec ike keepalive log 1 on ipsec ike keepalive use 1 on rfc4306 10 3 ipsec ike local name 1 10.1.100.61 ipv4-addr ipsec ike nat-traversal 1 on type=2 ipsec ike pfs 1 on ipsec ike message-id-control 1 on ipsec ike pre-shared-key 1 text tunnel1-Pre-Shared Key ipsec ike remote address 1 52.33.151.55 ipsec ike remote name 1 52.33.151.55 ipv4-addr ipsec ike negotiation receive 1 off ipsec auto refresh 1 on ipsec tunnel outer df-bit clear tunnel backup tunnel 2 switch-interface=on ip tunnel tcp mss limit auto ipv6 tunnel address fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7e/126 tunnel enable 1 subnet fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7c/126 AWS side fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7d/126 CGW side fd86:84f6:c9a2:c471:de4d:507f:a5ec:3c7e/126
  • 45. • Site-to-Site VPN Connection (Static route) 2.CUSTUMER GATEWAY CONFIG When the Customer Gateway configuration is complete, the connection status will be Up as shown in the figure.
  • 46. • Transit gateway route table 3.SET UP ROUTE TABLE FOR TRANSIT GATEWAY AND EACH VPC ATTACHMENTS Configure the IPv6 route to the on-premises network via Transit Gateway VPN attachment.
  • 47. 5.SET UP ROUTE TABLE FOR TRANSIT GATEWAY AND EACH VPC ATTACHMENTS • VPC route table need to set up static route to On-Pre to VPC route table because ,it does not registered automatic.
  • 48. Transit Gateway Destination Target 2600:1f13:964:c100::/56 TGW 2001:db8:1:0:0:0:0:0/64 TGW 2600:1f14:aff:e000::/56 local VPC-A Route table Attachments A Attachments VPN Destination Target ::/0 TGW 2001:db8:1:0:0:0:0:0/64 local On-prem Route table TGW route table Associations Propagations Up_till_Down-tgw-rt VPC-A, VPC- B,VPN VPC-A, VPC-B,VPN Attachments B TRANSIT GATEWAY ATTACHMENT AND ROUTE TABLE VPC-B Route table Destination Target 2600:1f14:aff:e000::/56 TGW 2001:db8:1:0:0:0:0:0/64 TGW 2600:1f13:964:c100::/56 local
  • 49. AWS AS A WEEKEND HOBBY • Summaｒｙ • Internet-facing Application Load Balancer • Site to Site VPN connectivity with AWS Transit Gateway • Reference • IPv6 Reference Architectures for AWS and Hybrid Networks (awsstatic.com)
  • 50. AWS as a weekend hobby Don't think about the difficulty Let's try to connect easy to IPv6 network with AWS