How to Configure a Site-To-Site IPsec VPN to the Amazon AWS VPN Gateway If you are using the Amazon Virtual Private Cloud, you can transparently extend your local network to the cloud by connecting both networks with a site-to-site IPsec VPN tunnel. The Amazon virtual private gateway uses static routing and two parallel IPsec tunnels, of which only one tunnel is used when connecting with the Barracuda NextGen Firewall X-Series. Amazon also limits you to one local network. If multiple local networks require access to the cloud resources use routing and access rules on the X-Series Firewall to forward traffic from other local subnets to the VPN gateway. Additional Amazon AWS charges apply. For more information, see Amazon's monthly pricing calculator at http://calculator.samazonaws.com/calchtml. Before You Begin Configure an Amazon Virtual Private Cloud (VPC). Step Create a Virtual Private Gateway The Amazon virtual private gateway is the VPN concentrator on the remote side of the IPsec VPN connection. 7. Go to the Amazon VPC Management Console. In the left pane, click Virtual Private Gateways. Click Create Virtual Private Gateway. Enter the Nametag for the VPN gateway (e.g., Techlib Virtual Private Gateway). Click Yes, Create. Select the newly created virtual private gateway, and click Attach to VPC. Select your VPC from the VPC list, and click Yes, Attach. The virtual private gateway is now available. 1 / 7
Step Add Your Customer Gateway Configuration The Amazon customer gateway is your X-Series Firewall on your end of the VPN connection. Specify your external IP address and routing type in the customer gateway configuration: Go to the Amazon VPC Management Console. In the left pane, click Customer Gateway. Click Create Customer Gateway. Enter the connection information for your X-Series Firewall: Name Tag Enter a name for your device (e.g., My Barracuda Firewall). Routing Select Static. IP Address Enter your external IP Address. To look up your external IP address, go to the NETWORK INTERFACES section on the NETWORK > Routing page of the X-Series Firewall. Click Yes, Create. Your X-Series Firewall is now configured in the AWS cloud and can be used to configure VPN connections. Step Create a VPN Connection Create a VPN connection with the customer gateway and the virtual private gateway that you just created. Then download the VPN configuration file, because it contains all the necessary information for configuring the VPN connection on the X-Series Firewall. The Amazon VPN configuration file is different for every VPN connection. Go to the Amazon VPC Management Console. In the left pane, click VPN Connections. Click Create VPN Connection. In the Create VPN Connection window, enter the configuration information for your VPN connection: Name tag Enter a name for your VPN connection (e.g., BFW2AWSCloud). Virtual Private Gateway Select the virtual private gateway created in Step Routing Options Select Static. 2 / 7
Static Prefixes Enter your local network (e.g., 10.0.10.0/25). If your local networks overlap with the address space reserved for the VPC add the on-premise networks by editing the VPN connections later. 7. Click Yes, Create. Click Download Configuration. Select generic vendor and platform settings for the configuration file: Vendor Select Generic. Platform Select Generic. Software Select Vendor Agnostic. 8. Click Yes, Download, and save the vpn-<your-vpc-id>.txt file. Click here to see an example Amazon VPN configuration file [...] IPSec Tunnel #1 =============================================================================== = 3 / 7
#1: Internet Key Exchange Configuration Configure the IKE SA as follows - Authentication Method : Pre-Shared Key - Pre-Shared Key : YOUR-PRE-SHARED-KEY - Authentication Algorithm : sha1 - Encryption Algorithm : aes-128-cbc - Lifetime : 28800 seconds - Phase 1 Negotiation Mode : main - Perfect Forward Secrecy : Diffie-Hellman Group 2 #2: IPSec Configuration Configure the IPSec SA as follows: - Protocol : esp - Authentication Algorithm : hmac-sha1-96 - Encryption Algorithm : aes-128-cbc - Lifetime : 3600 seconds - Mode : tunnel - Perfect Forward Secrecy : Diffie-Hellman Group 2 [...] Outside IP Addresses: - Customer Gateway : YOUR EXTERNAL IP ADDRESS - Virtual Private Gateway : 87.238.842 Step Configure the X-Series Firewall Site-to-Site VPN Connection The Amazon VPN configuration file provides settings for two IPsec tunnels, but you must only configure IPsec tunnel # Log into the X-Series Firewall. 7. Go to the VPN > Site-to-Site VPN page. In the Site-to-Site IPsec Tunnels section, click Add. Enter the Name for the IPsec VPN. Configure the Phase 1 settings, as specified in the Amazon configuration file: Encryption: AES Hash Method: SHA DH Group: Group 2 Lifetime: 28800 Configure the Phase 2 settings, as specified in the Amazon configuration file: Encryption: AES Hash Method: SHA DH Group: Group 2 Lifetime: 3600 Perfect Forward Secrecy Select the check box. Configure the remaining settings: Local End Select Active. Local Address Select Dynamic. Local Networks Enter your local subnet. Only enter one local subnet. Additional local subnets must use an additional firewall rule to 4 / 7
connect the Amazon VPC subnet. Remote Gateway Enter the IP address for the Virtual Private Gateway supplied in the Amazon VPN configuration file. Remote Networks Enter the remote VPC subnet. Authentication Select Shared Passphrase. Passphrase Enter the Pre-Shared Key supplied in the Amazon VPN configuration file. Enable Aggressive Select No. 8. Click Save. Your X-Series Firewall now automatically connects to the Amazon virtual private gateway. Step Create a Pass Access Rule for the VPN Traffic Create an access rule to allow traffic from your local network to the Amazon VPC subnet. Log into the X-Series Firewall. Go to the FIREWALL > Firewall Rules page. Add an access rule: 5 / 7
Type Select ALLOW. Source Enter your local network or select a network object containing only your local network (e.g., 10.0.10.0/25). Destination Enter the remote VPC subnet (e.g., 10.10.10.0/24). Network Services Select Any. Connection Select No SNAT. Click Save. Place the firewall rule above the BLOCKALL rule. Click Save. For each additional subnet that must access the Amazon VPC through the VPN tunnel, create an additional ALLOW firewall rule: Source Enter the local network. Destination Enter the Amazon VPC subnet. Connection Select Default (SNAT). Monitoring You can verify that the VPN tunnel is up by selecting your VPN connection in the Amazon VPC Management Console and clicking the Tunnel Details tab in the bottom pane. 6 / 7
7 / 7