Amazon Virtual Private Cloud

1 Amazon Virtual Private CloudNetwork Administrator GuideAmazon Virtual Private Cloud Network Administrator GuideAmazon Virtual Private Cloud : Network Administrator GuideCopyright 2018 Amazon Web Services, Inc. and/or its affiliates. All rights 's trademarks and trade dress may not be used in connection with any product or service that is not Amazon 's, in any mannerthat is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon . All other trademarks notowned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored Virtual Private Cloud Network Administrator GuideTable of ContentsWelcome.

2 1 Your Customer Gateway .. 2 What Is a Customer Gateway? .. 2 Your Role .. 4 Overview of Setting Up a VPN Connection .. 4 Network Information .. 4 AWS VPN CloudHub and Redundant Customer Gateways .. 5 Configuring Multiple VPN Connections to Your VPC .. 6 Customer Gateway Devices We've Tested .. 7 Requirements for Your Customer Gateway .. 8 Configuring a Firewall Between the Internet and Your Customer Gateway .. 11 Example: Check Point Device using BGP .. 13 High-Level View of the Customer Gateway .. 13 Configuration 13 Configuring the Check Point Device.

3 14 Step 1: Configure the Tunnel Interfaces .. 15 Step 2: Configure BGP .. 16 Step 3: Create Network Objects .. 16 Step 4: Create a VPN Community and Configure IKE and IPsec .. 17 Step 5: Configure the Firewall .. 19 Step 6: Enable Dead Peer Detection and TCP MSS Clamping .. 19 How to Test the Customer Gateway Configuration .. 20 Example: Check Point Device (without BGP) .. 23 High-Level View of the Customer Gateway .. 23 Configuration 24 Configuring the Check Point Device .. 24 Step 1: Configure Tunnel Interface .. 25 Step 2: Configure the Static Route.

4 26 Step 3: Create Network Objects .. 28 Step 4: Create a VPN Community and Configure IKE and IPsec .. 29 Step 5: Configure the Firewall .. 30 Step 6: Enable Dead Peer Detection and TCP MSS Clamping .. 31 How to Test the Customer Gateway Configuration .. 32 Example: Cisco ASA Device .. 35A High-Level View of the Customer Gateway .. 35An Example 36 How to Test the Customer Gateway Configuration .. 40 Example: Cisco ASA Device with VTI and BGP .. 42A High-Level View of the Customer Gateway .. 42 Example 43 How to Test the Customer Gateway Configuration.

5 48 Example: Cisco ASA Device with VTI (without BGP) .. 50A High-Level View of the Customer Gateway .. 50 Example 51 How to Test the Customer Gateway Configuration .. 56 Example: Cisco IOS Device .. 58A High-Level View of the Customer Gateway .. 59A Detailed View of the Customer Gateway and an Example Configuration .. 60 How to Test the Customer Gateway Configuration .. 66 Example: Cisco IOS Device (without BGP) .. 69A High-Level View of the Customer Gateway .. 69A Detailed View of the Customer Gateway and an Example Configuration .. 70 How to Test the Customer Gateway Configuration.

6 75 Example: Dell SonicWALL Device .. 77iiiAmazon Virtual Private Cloud Network Administrator GuideA High-Level View of the Customer Gateway .. 77 Example Configuration 78 Configuring the SonicWALL Device Using the Management Interface .. 81 How to Test the Customer Gateway Configuration .. 81 Example: Dell SonicWALL Device (without BGP) .. 84A High-Level View of the Customer Gateway .. 84 Example Configuration 85 Configuring the SonicWALL Device Using the Management Interface .. 88 How to Test the Customer Gateway Configuration .. 90 Example: Fortinet Fortigate Device.

7 92A High-Level View of the Customer Gateway .. 93A Detailed View of the Customer Gateway and an Example Configuration .. 93 How to Test the Customer Gateway Configuration .. 101 Example: Juniper J-Series JunOS Device .. 103A High-Level View of the Customer Gateway .. 104A Detailed View of the Customer Gateway and an Example Configuration .. 105 How to Test the Customer Gateway Configuration .. 111 Example: Juniper SRX JunOS Device .. 113A High-Level View of the Customer Gateway .. 114A Detailed View of the Customer Gateway and an Example Configuration.

8 115 How to Test the Customer Gateway Configuration .. 121 Example: Juniper ScreenOS Device .. 123A High-Level View of the Customer Gateway .. 124A Detailed View of the Customer Gateway and an Example Configuration .. 125 How to Test the Customer Gateway Configuration .. 130 Example: Netgate PfSense Device (without BGP) .. 133A High-Level View of the Customer Gateway .. 133 Example 134 How to Test the Customer Gateway Configuration .. 137 Example: Palo Alto Networks Device .. 139A High-Level View of the Customer Gateway .. 140A Detailed View of the Customer Gateway and an Example Configuration.

9 140 How to Test the Customer Gateway Configuration .. 147 Example: Yamaha Device .. 149A High-Level View of the Customer Gateway .. 150A Detailed View of the Customer Gateway and an Example Configuration .. 150 How to Test the Customer Gateway Configuration .. 156 Example: Generic Customer Gateway Using BGP .. 158A High-Level View of the Customer Gateway .. 159A Detailed View of the Customer Gateway and an Example Configuration .. 159 How to Test the Customer Gateway Configuration .. 164 Example: Generic Customer Gateway (without BGP) .. 166A High-Level View of the Customer Gateway.

10 167A Detailed View of the Customer Gateway and an Example Configuration .. 167 How to Test the Customer Gateway Configuration .. 172 Troubleshooting .. 174 Cisco ASA Customer Gateway Connectivity .. 175 Routing .. 176 Cisco IOS Customer Gateway Connectivity .. 177 Tunnel .. 179 BGP .. 180 Virtual Private Gateway Attachment .. 181 Cisco IOS Customer Gateway Connectivity (without BGP) .. 181ivAmazon Virtual Private Cloud Network Administrator 182 Tunnel .. 184 Virtual Private Gateway Attachment .. 185 Juniper JunOS Customer Gateway Connectivity.