Site-To-Site VPN Configuration with AWS

​

Overview

• A one-time or temporary access to the MacStadium cloud from a single virtual or physical machine is required.
• Cisco AnyConnect VPN is recommended.
• For more information, see Connecting to Your Cloud (via VPN)

​

Creating Stable IPSec Site-to-Site VPN

1. Check the software version and model ( of the Cisco ASA/ASAv device of the MacStadium cloud.
2. Configure the private cloud to connect to your MacStadium cloud. One or more of the following must be configured:
   • Provide the public endpoint of the MacStadium cloud.
     • This is the public network IP listed for the FW1-Outside network in Appendix B of the IP Plan.
   • Enable policy-based routing between the private cloud and the internal private network the MacStadium cloud (default the Private-1 network).
     • This is the private network host and range listed in Appendix A of the IP Plan.
   • Enable inbound traffic to the private cloud.
3. Set up the Cisco ASA/ASAv device of the MacStadium cloud. One or more of the following must be configured:
   • A nat exemption rule for traffic between the two clouds.
   • This allows traffic from the private cloud to the private network and the outside interface of the MacStadium cloud. By default, these are respectively the Private-1 and Outside networks listed in Appendix A of the IP Plan.
   • access-list rules permitting traffic from the private cloud to the public endpoint of the MacStadium cloud.
   • By default, this is the FW1-Outside network listed in Appendix B of the IP Plan.
   • A crypto map rule that maps traffic between the two clouds.
   • By default, this is the Outside network listed in Appendix A of the IP Plan.
   • IPSec and IKE policies.
   • tunnel-group rules that point to the private cloud that connect to the MacStadium cloud.
4. Prepare these settings based on the Cisco ASA/ASAv software and model

​

​

Helpful Links

​

Networking Setup for Private Cloud

​

Creating IPSec Site-To-Site VPN between Two Clouds

1. Check and document the software version and model of the Cisco ASA/ASAv device for the MacStadium cloud.
2. Configure the private cloud to connect to the MacStadium cloud.
   • One or more of the following might need to be configured.
     • Provide the public endpoint of the MacStadium cloud.
       • Usually, this is the public network IP listed for the FW1-Outside network in Appendix B of the IP Plan.
     • Enable routing between the private cloud and the internal private network of the MacStadium cloud (by, default the Private-1 network).
       • Usually, this is the private network host and range listed in Appendix A of the IP Plan (.).
       • Enable inbound traffic to the private cloud.
3. Set up the Cisco ASA/ASAv device of the MacStadium cloud.
   • You might need to configure one or more of the following rules:
     • A NAT exemption rule for traffic between the two clouds. It might need to allow traffic from the private cloud to the private network and the outside interface of the MacStadium cloud. By default, these are respectively the Private-1 and Outside networks listed in Appendix A of the IP Plan.
       • NOTE : NAT exemption allows the ability to exclude traffic from being translated with NAT. One scenario where this is typically done is for a site-to-site VPN tunnel.
     • Access-list rules permitting traffic from the private cloud to the public endpoint of your MacStadium cloud. By default, this is the FW1-Outside network listed in Appendix B of the IP Plan.
     • A crypto map rule that maps traffic between the two clouds. Usually, this is mapped to the outside interface of the MacStadium cloud. By default, this is the Outside network listed in Appendix A of the IP Plan.
     • IPSec and IKE policies.
     • Tunnel-group rules that point to the private cloud to connect to the MacStadium cloud.
     • The TCP State Bypass feature, which requires an access-list, class-map, policy-map, and a service-policy. This is a requirement for Site-To-Site VPN with Virtual Tunnel Interfaces only and is configured to allow asynchronous routing between separate VPN tunnels.

​

Networking Setup AWS

• Policy-based VPN, there are two VPN tunnels where in AWS one tunnel is active (up), and one is passive (down). A monitoring service checks frequently if the active tunnel is up and, if not, brings the passive tunnel up, what ensures minimal downtime.
• Route-based (VTI) VPN, both tunnels are active at the same time and can route traffic in and out simultaneously. Also, this allows routing between MacStadium and AWS to be configured statically or dynamically with BGP. Route-based VPN is the preferred option as it offers enhanced routing and monitoring control.

​

Creating Site-To-Site VPN

1. Log into the VPC service.
2. Create a customer gateway.
3. Set up a virtual private gateway.
4. Create the Site-To-Site VPN connection.
5. Ensure that AWS allows inbound traffic.
6. Log in to the WS Management Console and access the VPC service.

​

Creating Customer Gateway

1. In the VPC service sidebar, locate the Virtual Private Network (VPN) menu and select Customer gateways.
   
2. Click Create Customer Gateway.
3. Provide a Name. Set a name that is easy to remember.
4. In BGP ASN, use a private ASN in the range of 64,512–65,534. This is used later as the BGP process number in the MacStadium firewall.
5. In the IP Address text box, provide the IP address of the public network listed in Appendix B of the IP IP Plan ( ). By default, this is the FW1-Outside network.
6. Keep the other options with the default values and click Create Customer Gateway.

​

Setting Up Virtual Private Gateway

1. In the VPC service sidebar, locate the Virtual Private Network (VPN) menu and select Virtual Private Gateways.
2. Click Create Virtual Private Gateway.
3. Provide a Name tag. Set a name that is easy to remember.
4. Select Amazon default ASN and click Create Virtual Private Gateway.
5. Connect to the VPN.
   • After signing up, the IP Plan is sent. Review that information to configure access to the cloud environment. The recommended method of gaining access is via a Virtual Private Network (VPN), which is both easy to implement and secure.
     
6. On the Virtual Private Gateways dashboard, right-click the newly created virtual private gateway and select Attach to VPC.
   
7. Select the VPC to attach the Virtual Private Gateway to and click Attach to VPC.
   
8. Select the Propagation Enable checkbox.
9. Click Save.
   

​

Creating Site-To-Site VPN Connection

1. In the VPC service sidebar, locate the Virtual Private Network menu and select Site-To-Site VPN Connections.
2. Click Create VPN Connection.
3. Provide Name tag.
4. For Target Gateway Type, select Virtual Private Gateway.
5. For Virtual Private Gateway, select the virtual private gateway that was created earlier.
6. Select Existing customer gateway, and from the Customer Gateway ID dropdown menu, select the customer gateway that was created earlier.
7. Select the Routing Options:
   • Static manually specifies the destination subnets of the VPN.

   * Select static routing and provide in Static IP Prefixes the CIDR notation for the private network listed in Appendix A of the IP Plan (by default, the Private-1 network). To convert the subnet mask to a CIDR notation, use a CIDR calculator. Example: 10.221.254.0/24

 * Dynamic (requires BGP) and dynamically exchanges routes between AWS and MacStadium environments.  

   * Select dynamic routing to keep the default values and proceed to the next step.

   * **NOTE** : For more information about AWS VPN tunnel options, see: [Amazon VPC Documentation](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html).

8. Do not edit the Tunnel Options section.
9. Click Create VPN Connection.
   

​

Allowing AWS Inbound Traffic

​

AWS VPN Configuration for Cisco ASA/ASAv

1. Download the configuration from Amazon
2. Fill in the configuration blank

​

Downloading Amazon Configuration

1. Verify there is a Site-To-Site VPN connection in Amazon.
   • For more information about how to set up your VPN, see Setting Up the AWS Side of the Site-To-Site VPN.
2. Log in to the AWS Management Console and access your VPC service, which is located in the top right corner of the screen.
3. In the VPC service sidebar, locate the Virtual Private Network menu and select Site-To-Site VPN Connections.
4. In the list, select the newly created VPN connection and click Download Configuration.
5. Vendor, select Cisco Systems, Inc.
6. Platform, select ASA 5500 Series.
7. Software:
   • For a policy-based VPN, select ASA 9.x
   • For a route-based VPN, select ASA 9.7 + VTI
     • NOTE : If ASA 9.7 + VTI was selected, choose ikev2 as the IKE version and click Download.

​

Configuration Blanks

​

Configuration Parameters

<vpc_subnet>

<vpc_subnet_mask>

<amzn_vpn_map>

<sla_monitor_address>

<local_subnet>

1. Verify the configuration file from the AWS Management Console.
2. Open the configuration file.
3. Replace all placeholders with their respective values. Use Configuration parameters for reference.
4. Uncomment the line: access-list amzn-filter extended permit ip<.code> to uncomment, remove ! at the start of the line. </.code>
5. Uncomment the lines for object and nat configuration at the end of the config file.
   • To uncomment, remove ! at the start of the line.
   • Keep the following line to ensure the SLA monitor works as expected.
     • object network obj-SrcNet subnet 0.0.0.0 0.0.0.0
     • WARNING : Based on the network configuration and requirements, the line can be modified to map to the subnet and the subnet mask for the Private-1 network from your IP Plan. If this line is modified, then do not configure the <sla_monitor_address> value.
6. On the following line, change 0.0.0.0 0.0.0.0 to a combination of the IP address and the subnet mask for your Amazon VPC.
   • These values are in the AWS Management Console. Navigate to the VPC dashboard and select the VPC, and check the Description at the bottom of the screen.
   • Convert the subnet mask bit notation to the correct subnet mask (for example, the /16 notation converts to a 255.255.0.0 subnet mask).
   • For example:
     • object network obj-amzn subnet 0.0.0.0 0.0.0.0

   * change to:
   * object network obj-amzn subnet 192.168.0.0 255.255.0.0

7. On the following line, change inside and outside to the names of the internal private network and the outside interface of the MacStadium private cloud, respectively, as provided in Appendix A of the IP Plan. By default, these are Private-1 and Outside, respectively.
   • nat (inside,outside) 1 source static obj-SrcNet obj-SrcNet destination static obj-amzn obj-amzn

• nat (Private-1,Outside) 1 source static obj-SrcNet obj-SrcNet destination static obj-amzn obj-amzn

8. (Optional) Delete the remaining commented lines to clean up the file. Commented lines are indicated by ! at the beginning of the line.
9. Save the changes.

​

Configuration Parameters for Route-based VPN - ASA 9.7 + VTI

‹outside_interface>

<local_subnet>

<local_subnet_mask>

<vpc_subnet>

1. Verify the configuration file from the AWS Management Console.
2. Open the configuration file.
3. Replace the placeholders with their respective values. Currently, only the placeholder <outside_interface> is available in the AWS script. Use Table 1: Configuration parameters for reference.
4. Change the name of the tunnel interfaces. Example:

 * interface tunnel 100 nameif aws-vpn-1 interface tunnel 200 nameif aws-vpn-2

5. Replace the network address and mask on the BGP configuration. Example: router bgp 65513 address-family ipv4 unicast network <local_subnet> mask <local_subnet_mask>
6. Replace the placeholders with their respective values.
7. For a route-based VPN, enable the TCP State Bypass feature to allow the outbound and inbound traffic to flow through separate VPN tunnels as follows:

     ‹acl-state-bypass>

     <cm_state-bypass>

     <pm-state-bypass>

• Define the Access list with the source and destination networks: access-list <acl-state-bypass> extended permit ip
  • <local_subnet> <local_subnet_mask> <vpc_subnet> <vpc_subnet_mask>

 * Create the Class Map to identify the traffic for which you want to disable stateful Firewall inspection: 
   * class-map <cm-state-bypass>

 * Enter the match parameter command to specify the traffic of interest within the class map: 
   * match access-list <acl-state-bypass>

 * Enter the policy-map name command to assign the actions to be taken in regards to the specified class map traffic: 
   * policy-map <pm-state-bypass> class <cm-state-bypass> set connection advanced-options tcp-state-bypass

 * Enter the service-policy command in global configuration mode to activate the policy map on the targeted interface: 
   * service-policy <pm-state-bypass> interface <private_interface>

8. Save changes

​

Completing Cisco ASA/ASAv Configuration

​

Manually Enabling Route Propagation

1. In the VPC service sidebar, locate the Virtual Private Cloud menu and select Route Tables.
   
2. In the list of routing tables, select the main route table for your VPC.
3. Select Route Propagation. If the virtual private gateway is not listed, the make sure that it is attached to the VPC.
4. Click Edit route propagation.
   

​

(Open-Source Option) OpenConnect

​

Why OpenConnect?

​

Download and Install OpenConnect

​

Why OpenConnect?

• Download and use Cisco AnyConnect

​

Download AnyConnect

1. Download a VPN client. The recommend VPN client for MacStadium Private Clouds is Cisco AnyConnect.
2. Open MacStadium Portal > Account Menu > Files.
3. Open the file and locate the VPN Server section.
4. From the browser, visit https://<YOUR_VPN_SERVER_ADDRESS_HERE>.
   • NOTE : Firefox is required to get past the self-signed certificate blocker.
5. When prompted, provide the VPN credentials from the IP Plan.
6. After log in, download a licensed version of AnyConnect directly from the firewall.

​

Setup Process

1. Log in using the username and password from the IP Plan.
2. Cisco AnyConnect SecureMobility checks to see if Java is installed.
   • If Java is installed, then Java is used.
   • If Java is not installed, then a link for download is provided.
3. Follow the installation prompts to complete the install.
4. Once installation has completed:
   • Select Settings
   • Uncheck “Block connections to untrusted servers,” as the Cisco ASA appliance by default will be using a self signed certificate.
5. From the main screen, enter the IP Address provided in theIP Plan.
6. Click connect.
7. Enter your username and password to confirm the connection.