![Architecture Overview
[On-Premises Network] --> [Customer Gateway] --> [Internet]
|
v
[VPG] <-- [Site-to-Site VPN Tunnels] --> [AWS VPC]
Visualizes the secure connection between on-premises and AWS.
NextGen_Outlier 5](https://image.slidesharecdn.com/awsvpn-250710170607-fb52cb54/85/How-to-Connect-Your-On-Premises-Site-to-AWS-Using-Site-to-Site-VPN-pdf-5-320.jpg)
How to Connect Your On-Premises Site to AWS Using Site-to-Site VPN.pdf
- 1. Connecting On-Premises to AWS with Site-to- Site VPN By - Tamanna NextGen_Outlier 1
- 2. What is AWS Site-to-Site VPN? A secure, encrypted connection between your on-premises network and AWS VPC. Uses IPsec protocol over the public internet. Ideal for hybrid cloud setups. Example: Office database (192.168.1.0/24) connects to AWS web app (10.0.1.0/24). NextGen_Outlier 2
- 3. Why Use Site-to-Site VPN? Secure: Encrypts data between on-premises and AWS. Cost-Effective: Uses internet, no dedicated lines needed. Flexible: Works with most firewalls (Cisco, Fortinet, etc.). Hybrid Cloud: Seamlessly integrates on-premises and cloud resources. NextGen_Outlier 3
- 4. Key Components of AWS Site-to-Site VPN Component Description VPC Your isolated cloud network in AWS. Virtual Private Gateway (VPG) AWS-side VPN endpoint. Customer Gateway (CGW) Your on-premises VPN device. Site-to-Site VPN Encrypted IPsec tunnels (two for redundancy). NextGen_Outlier 4
- 5. Architecture Overview [On-Premises Network] --> [Customer Gateway] --> [Internet] | v [VPG] <-- [Site-to-Site VPN Tunnels] --> [AWS VPC] Visualizes the secure connection between on-premises and AWS. NextGen_Outlier 5
- 6. Requirements and Prerequisites AWS account with VPC access. Compatible on-premises VPN device (e.g., Cisco, Juniper). Static public IP for VPN device (e.g., 203.0.113.1). Non-overlapping CIDRs: On-Premises: 192.168.0.0/16 AWS VPC: 10.0.0.0/16 Firewall rules: Allow UDP 500, 4500, ESP protocol. NextGen_Outlier 6
- 7. Step-by-Step Setup Overview 1. Create and attach a Virtual Private Gateway (VPG). 2. Configure the Customer Gateway (CGW). 3. Set up the Site-to-Site VPN connection. 4. Configure your on-premises VPN device. 5. Verify and test the connection. NextGen_Outlier 7
- 8. Step 1: Set Up Virtual Private Gateway (VPG) Go to VPC > Virtual Private Gateways. Create VPG: Name: MyVPG ASN: 64512 (AWS default) Attach to your VPC (e.g., vpc-12345678). Enable route propagation in VPC route table. Example Route Table: Destination Target 10.0.0.0/16 local 192.168.0.0/16 vgw-12345678 NextGen_Outlier 8
- 9. Step 2: Configure Customer Gateway (CGW) Go to VPC > Customer Gateways. Create CGW: Name: MyCGW IP Address: 203.0.113.1 (on-premises VPN device) Routing: Dynamic (BGP) or Static BGP ASN: 65000 (if dynamic) NextGen_Outlier 9
- 10. Step 3: Create Site-to-Site VPN Connection Go to VPC > Site-to-Site VPN Connections. Create VPN: Name: MyVPN VPG: MyVPG CGW: MyCGW Routing: Dynamic or Static (match CGW) Static Routes (if static): 192.168.0.0/16 Download configuration file for your VPN device. NextGen_Outlier 10
- 11. Step 4: Configure On-Premises VPN Device Use AWS configuration file for settings (e.g., Cisco ASA). Configure IPsec tunnels (two for redundancy). Set up routing (static or BGP). Update firewall rules: Allow UDP 500, 4500, ESP. Example Cisco CLI: crypto ikev2 enable outside tunnel-group 52.1.2.3 type ipsec-l2i route outside 10.0.0.0 255.255.0.0 52.1.2.3 NextGen_Outlier 11
- 12. Step 5: Verify and Test the Connection Check VPN status in AWS: Both tunnels should be UP. Ping test: Ping from on-premises to AWS (e.g., 10.0.1.10). Monitor logs: AWS CloudWatch and on-premises device. Test application access (e.g., database queries). Troubleshooting: Verify pre-shared keys. Check firewall rules and routes. Use VPC Flow Logs for debugging. NextGen_Outlier 12
- 13. Additional Configuration Tips High Availability: Use both tunnels with BGP for failover. Security: Use AES-256, SHA-256 encryption. Performance: Monitor bandwidth (~1.25 Gbps per tunnel). Monitoring: Set up CloudWatch alarms for tunnel status. NAT Traversal: Enable NAT-T if behind NAT. NextGen_Outlier 13
- 14. Common Pitfalls to Avoid Issue Solution Overlapping CIDRs Use non-overlapping ranges (e.g., 10.0.0.0/16 vs. 192.168.0.0/16). Incorrect Pre-shared Keys Copy keys from AWS configuration file. Firewall Blocking IPsec Open UDP 500, 4500, ESP. Missing Routes Verify AWS and on-premises routing. NextGen_Outlier 14
- 15. Conclusion AWS Site-to-Site VPN enables secure hybrid cloud connectivity. Follow the 5-step process for a robust setup. Test thoroughly and monitor for reliability. Refer to AWS documentation: https://docs.aws.amazon.com/vpn NextGen_Outlier 15