Skip to main content
Download the VPN configuration file from Amazon and fill it in with your Orka network configuration.
You need:
  • The name Outside from your IP Plan.
  • The IP address for the Private-1 network from your IP Plan.
  • The subnet mask for the Private-1 network from your IP Plan.
  • The IPv4 address of your Amazon VPC.
  • The subnet mask for your Amazon VPC converted from its CIDR notation (i.e. 255.255.0.0 instead of /16).
After you have created your VPN tunnel in Amazon, you need to configure your Cisco firewall to recognize the connection and let traffic into your Orka cluster. Amazon provides a semi-prefilled configuration file with very detailed instructions. First, you need to download the configuration file and provide the missing information indicated by placeholders. Next, you’ll need to feed the configuration into your Cisco ASAv to complete the setup.

​
Step 1: Download the file from Amazon

  1. Verify that you are logged in to your AWS Management Console and you’re working in the correct region.
  2. Verify that you have created a tunnel in Amazon.
  3. Navigate to your VPC service. In the VPC service sidebar, locate the Virtual Private Network menu and select Site-to-Site VPN Connections.
AWS VPC sidebar with Site-to-Site VPN Connections selected
  1. In the list, select your newly created VPN connection and click Download Configuration.
AWS VPN connection selected with Download Configuration button visible
  1. Fill in the form and click Download.
    1. For Vendor, select Cisco Systems, Inc..
    2. For Platform, select ASA 5500 Series.
    3. For Software, select ASA 9.x for a policy-based VPN OR ASA 9.7 + VTI for a route-based VPN.
Download Configuration dialog with Cisco ASA 5500 vendor and platform selected

​
Step 2: Fill in the configuration file

Unless you have extensive experience with AWS and ASAv configurations, follow the instructions in the configuration file to the letter. Otherwise, your site-to-site VPN might not work as expected.
  1. Open the configuration file in a text editor.
  2. Replace all placeholders with their respective values.
  1. Uncomment the following lines. To uncomment, remove ! at the start of the line.
    • access-list amzn-filter extended permit ip ...
    • object- and nat-related configuration at the end of the config file.
  2. Keep the following line. This ensures the SLA monitor works as expected.
Note that based on your network configuration and requirements, you can modify this line to map to the subnet and the subnet mask for the Private-1 network from your IP Plan. If you choose to modify this line, do not configure the <sla_monitor_address> value.
  1. Change nat (inside,outside) to nat (Private-1,Outside).
  2. (Optional) Delete the remaining commented lines to clean up the file. Commented lines are indicated by ! at the beginning of the line.
  3. Save your changes.