I'm familiar with setting up IPsec VPN connections from AWS to an on-prem firewall, but I'm a bit lost on creating an IPsec VPN connection between two AWS customers. Is the process that one side sets up a configuration with a placeholder for the customer gateway and then shares an external IP for the other customer to set up their side? Once both configs are in place, do we swap one of the IPs and adjust settings like the customer gateway CIDR, BGP ASN, and shared keys accordingly?
3 Answers
If you're looking for efficiency, consider using a Transit Gateway or Transit Gateway Peering, especially if you're connecting across different regions. The connection through the AWS backbone is much faster and encrypted compared to a Site-to-Site setup. Remember, you'll need different CIDRs to make this work as you set up the routing on both ends. Plus, attaching an AWS Firewall to the Transit Gateway can help inspect packets before transferring them across accounts.
Your approach is spot on! You can definitely set up two AWS site-to-site VPNs and have one tunnel live at a time. Just keep in mind that it only works with static routing since BGP has limitations with AWS's 169.254 range IPs. Also, only one tunnel can be active due to the single IP assigned to a CGW resource. For redundancy, you'd need to create additional VPNs. Make sure to use IKEv2 and configure the startup action to initiate the IPsec connection. It's also essential that the pre-shared keys are consistent on both ends and it can help to set local and remote CIDRs to 0.0.0.0/0 for ease. Using a Virtual Private Gateway is a great option since it's free—just ensure to have static routes in the VPNs and enable VGW propagation in the subnet route tables. It's not the most ideal way, but it'll work if you need IPsec across networks.
Just a quick question—are you referring to Client VPNs or Site-to-Site VPNs here?
I'm talking about Site-to-Site VPNs, where one VPC operated by one customer connects to another VPC managed by a different customer.
Thanks for the heads-up on BGP! I wasn't sure if it would work, so that clears things up. I noticed that having two CGW resources isn't feasible for redundancy either, so I appreciate your confirmation of that. I also found your info on IKEv2 and static routes super helpful. I'll check if VPC peering is allowed for us, but if it isn’t, I'll follow your advice on AWS site-to-site.