Setting Up an AWS Site-to-Site VPN

Detailed guide on configuring AWS Site-to-Site VPN, covering Customer Gateway, Virtual Private Gateway, VPN Connection setup, static vs. BGP routing, firewall configuration examples, and VPC route table updates.

Establishing secure, reliable connectivity between an on-premises network and an Amazon Web Services (AWS) Virtual Private Cloud (VPC) is a fundamental requirement for hybrid cloud architectures. AWS Site-to-Site VPN provides an IPsec-based solution to achieve this, offering encrypted tunnels over the public internet. This guide details the step-by-step configuration of an AWS Site-to-Site VPN connection, encompassing both the AWS console setup and critical on-premises considerations.

We will cover the creation and configuration of the necessary AWS components – Customer Gateway, Virtual Private Gateway, and VPN Connection – and discuss the implications of static versus BGP routing. Practical examples for on-premises firewall configuration and VPC route table updates will also be provided to ensure a robust and functional VPN tunnel.

Prerequisites and Planning

Before initiating the AWS Site-to-Site VPN setup, ensure you have the following information and access:

  • On-premises Public IP Address: A static, publicly routable IP address for your on-premises VPN device (e.g., firewall, router). This cannot be behind NAT unless specific NAT traversal (NAT-T) is configured, which AWS VPN supports.
  • On-premises CIDR Block(s): The IP range(s) used in your on-premises network that need to be accessible from AWS (e.g., 10.0.0.0/16).
  • AWS VPC CIDR Block(s): The IP range(s) of your AWS VPC (e.g., 172.31.0.0/16). Ensure there are no overlapping CIDRs with your on-premises network.
  • AWS IAM Permissions: Sufficient permissions to create and manage VPC, VPN, and EC2 resources (e.g., ec2:*, iam:* for roles if using BGP).
  • On-premises VPN Device: Access to configure your physical or virtual firewall/router that supports IPsec VPN (e.g., Cisco ASA, Palo Alto Networks, Fortinet, pfSense).

AWS Site-to-Site VPN establishes two redundant IPsec tunnels. This redundancy ensures high availability in case one tunnel or AWS VPN endpoint becomes unavailable. Your on-premises device should be configured to utilize both tunnels.

1. Create a Customer Gateway

The Customer Gateway (CGW) resource in AWS represents your on-premises VPN device. It provides AWS with the necessary information to establish the VPN connection.

  1. Navigate to the AWS VPC console.
  2. In the left navigation pane, under Virtual Private Network (VPN), choose Customer Gateways.
  3. Click Create Customer Gateway.

  4. Configure the following:

    • Name tag: A descriptive name (e.g., MyOnPremFirewallCGW).
    • Routing:
      • Static: If your on-premises device uses static routing. You'll manually specify on-premises CIDRs in the VPN connection configuration.
      • Dynamic (BGP): If your on-premises device supports Border Gateway Protocol (BGP). This is generally preferred for its automatic route propagation and failover capabilities. You will provide the BGP Autonomous System Number (ASN) for your on-premises device (e.g., 65000). Common private ASNs range from 64512-65534 (16-bit) or 4200000000-4294967294 (32-bit).
    • IP Address: The static, public IP address of your on-premises VPN device.
    • Device Name (Optional): A helpful identifier for your device type.
  5. Click Create Customer Gateway.

2. Create a Virtual Private Gateway and Attach to VPC

The Virtual Private Gateway (VGW) serves as the AWS-side endpoint for the VPN connection. It must be attached to the specific VPC you intend to connect to.

  1. In the AWS VPC console, under Virtual Private Network (VPN), choose Virtual Private Gateways.
  2. Click Create Virtual Private Gateway.

  3. Configure the following:

    • Name tag: A descriptive name (e.g., MyVPC-VGW).
    • ASN:
      • Amazon default ASN: 64512 (recommended unless you have specific BGP requirements).
      • Custom ASN: Specify a different private ASN if needed (e.g., to avoid conflicts).
  4. Click Create Virtual Private Gateway.
  5. Once created and its state is available, select the VGW and choose Actions > Attach to VPC.
  6. Select your target VPC from the dropdown and click Attach.

3. Create a Site-to-Site VPN Connection

This resource connects the Customer Gateway and Virtual Private Gateway, defining the IPsec tunnel parameters.

  1. In the AWS VPC console, under Virtual Private Network (VPN), choose Site-to-Site VPN Connections.
  2. Click Create VPN Connection.

  3. Configure the following:

    • Name tag: A descriptive name (e.g., OnPrem-to-AWS-VPN).
    • Target Gateway Type: Select Virtual Private Gateway.
    • Virtual Private Gateway: Choose the VGW you created earlier.
    • Customer Gateway: Select Existing and choose the CGW you created.
    • Routing Options:
      • Static: If your CGW routing is static. Under Static IP Prefixes, add the CIDR blocks of your on-premises network (e.g., 10.0.0.0/16). Repeat for all on-premises ranges.
      • Dynamic (BGP): If your CGW routing is dynamic. AWS will automatically learn routes from your on-premises device via BGP.
    • Tunnel Options (Optional but Recommended for Customization): This section allows you to customize IPsec parameters. If left default, AWS will use strong defaults. For interoperability with specific on-premises devices, you might need to match settings. Key parameters include:
      • IKE Version: IKEv2 is generally preferred for stronger security and better performance. IKEv1 is for older devices.
      • Pre-Shared Key: Can be left blank for AWS to generate one, or you can provide your own (16-32 alphanumeric characters).
      • Phase 1/2 Algorithms: Encryption (AES-256, AES-128), Hashing (SHA256, SHA1), Diffie-Hellman Group (DH14, DH2). Match these with your on-premises device.
      • DPD Timeout: Dead Peer Detection (DPD) interval (e.g., 10-30 seconds).
  4. Click Create VPN Connection.

4. Download Configuration and Configure On-Premises VPN Device

After creating the VPN connection, its state will transition from pending to available. You'll then need to configure your on-premises VPN device using the parameters provided by AWS.

  1. Select your newly created VPN connection.
  2. Click Download Configuration.
  3. Choose your Vendor, Platform, and Software from the dropdowns. AWS provides tailored configuration files for many popular devices (e.g., Cisco ASA, Juniper SRX, Palo Alto Networks, Fortinet, Generic).
  4. Click Download.

The downloaded file will contain detailed instructions and configuration snippets for setting up both VPN tunnels (Tunnel 1 and Tunnel 2) on your device. Key information includes:

  • AWS Gateway Public IP Addresses for Tunnel 1 and Tunnel 2.
  • Pre-Shared Keys for each tunnel.
  • IPsec Phase 1 (IKE) and Phase 2 (IPsec) parameters (encryption, authentication, DH group, lifetimes).
  • Tunnel Interface IP addresses (often /30 or /29 networks for point-to-point links).
  • Static routes or BGP peer configuration.

Example On-premises Firewall Configuration (Generic Snippet)

This is a simplified example; always refer to the AWS-generated configuration for your specific device.


# --- Tunnel 1 Configuration --- 

# Phase 1 (IKE) - Main Mode
encryption_alg AES-256
auth_alg SHA256
dh_group 14
lifetime 28800
mode main

# Phase 2 (IPsec) - Tunnel Mode
encryption_alg AES-256
auth_alg SHA256
pfs_group 14
lifetime 3600
mode tunnel

# IPsec Tunnel Interface
interface Tunnel1
  ip address <YourOnPremTunnelIP> <SubnetMask>
  tunnel source <YourOnPremPublicIP>
  tunnel destination <AWSGatewayPublicIP_Tunnel1>

# IPSec VPN Tunnel Definition
vpn Tunnel1
  peer <AWSGatewayPublicIP_Tunnel1>
  pre-shared-key <PreSharedKey_Tunnel1>
  phase1_settings ...
  phase2_settings ...
  bind interface Tunnel1

# Static Route (if using static routing)
route <AWS_VPC_CIDR> <YourOnPremTunnelIP>

# BGP Configuration (if using dynamic routing)
router bgp <YourOnPremASN>
  neighbor <AWS_BGP_PeerIP_Tunnel1> remote-as <AWS_VGW_ASN>
  address-family ipv4 unicast
    network <YourOnPremCIDR>
  !

# Repeat similar configuration for Tunnel 2, using its respective AWS Gateway IP, Pre-Shared Key, and Tunnel Interface IP.

Ensure your on-premises device has appropriate firewall rules to allow UDP ports 500 (IKE) and 4500 (NAT-T, if applicable) for the public IP of your on-premises device, communicating with the AWS VPN endpoint public IPs.

5. Update VPC Route Tables

For traffic from your AWS VPC to reach your on-premises network, you must update the route tables associated with your VPC subnets.

  1. In the AWS VPC console, under Virtual Private Cloud, choose Route Tables.
  2. Select the route table(s) associated with the subnets that need to communicate with your on-premises network.
  3. Select the Routes tab, then click Edit routes.
  4. Click Add route.

  5. Configure the following:

    • Destination: Enter your on-premises CIDR block (e.g., 10.0.0.0/16).
    • Target: Select the Virtual Private Gateway and choose the VGW you created.
  6. Click Save changes.

If you are using Dynamic (BGP) routing, you will also need to enable Route Propagation on your VPC route tables for the VGW:

  1. Select the route table(s).
  2. Select the Route Propagation tab.
  3. Click Edit route propagation.
  4. Check the box next to your Virtual Private Gateway and click Save.

This allows routes learned via BGP from your on-premises network to be automatically added to the VPC route table. For static routing, manual route entries are required as described above.

Common Pitfalls and Troubleshooting

  • Mismatched IPsec Parameters: The most common issue. Ensure Phase 1 (IKE) and Phase 2 (IPsec) encryption, authentication, DH group, and lifetimes exactly match between AWS and your on-premises device. Use the AWS downloaded configuration as the authoritative source.
  • Incorrect Pre-Shared Key: Double-check the PSK for each tunnel.
  • Firewall Rules: Verify that UDP ports 500 and 4500 (for NAT-T, if used) are open bidirectionally between your on-premises public IP and the AWS VPN endpoint public IPs. Also, ensure internal firewall rules allow traffic between your on-premises network and the AWS VPC CIDR.
  • On-premises NAT: If your on-premises VPN device is behind a NAT, ensure NAT-T is correctly implemented. AWS VPN supports NAT-T, but your device must also be configured for it.
  • Routing Issues:
    • Static: Confirm on-premises routes point to the tunnel interfaces, and AWS VPC route tables correctly point the on-premises CIDR to the VGW.
    • BGP: Verify BGP peering is established (e.g., show ip bgp summary on Cisco), routes are advertised from on-premises, and route propagation is enabled in AWS. Check BGP ASN compatibility.
  • Tunnel Status: In the AWS console, check the VPN connection details. Both tunnels should show as UP. If a tunnel is down, check your on-premises device logs for IPsec errors.
  • Security Groups/Network ACLs: Even if the VPN tunnel is up and routes are correct, EC2 instance security groups and subnet Network ACLs in AWS can block traffic. Ensure they permit communication with your on-premises CIDR.
  • Overlapping CIDR Blocks: This will cause routing conflicts and prevent the VPN from functioning correctly. Ensure your on-premises and AWS VPC CIDRs are unique.

Back to the knowledge base · Ask the AI assistant