Azure & AWS: Site-to-Site VPN

Monday. March 01, 2021 - 4 mins

INTRODUCTION
Azure provides a how-to guide for how to create a Site-to-Site VPN in their technical documentation here: Product Directory -> Azure -> VPN Gateway -> Create a Site-to-Site.

AWS provides a how-to guide for how to create a Site-to-Site VPN in their technical documentation here: AWS Documetation -> VPN -> AWS Site-to-Site

I was curious to see what this would look like, so I decided to set this up in my test lab and run through the process my self. I documented the steps below.

WHAT IS A SITE TO SITE VPN?

A site-to-site virtual private network (VPN) is a connection between two or more networks, such as a corporate network and a branch office network. A site-to-site VPN is a permanent connection designed to function as an encrypted link between offices (i.e., “sites”). This is typically set up as an IPsec network connection between networking equipment.

GOOD TO KNOW

1. AWS supports certificates for Internet Key Exchange (IKE) authentication. To use certifiates for IKE Authenitcation, you must first create a subordinate Certificate Authority (CA). See here for more details.

HOW DO YOU SET UP A SITE-TO-SITE VPN?

Now that we know the key benefits and the important terminology, we are better prepared to dive into the Site-to-Site VPN deployment process.

DEPLOYMENT PROCESS OVERVIEW

1. Create a Virtal Network Gateway in Azure.
2. Create a Virtual Private Gateway in AWS.
3. Attach the Virtual Private Gateway in AWS to a Virtual Private Cloud in AWS.
4. Create a Customer Gateway in AWS for Azure.
5. Create a VPN Connection in AWS.
6. Create a Local Gateway in Azure.
7. Create the Connection in Azure.
8. Update the Routing Table in AWS.

CREATE A VIRTUAL NETWORK GATEWAY IN AZURE

1. Sign in to the Azure portal
2. Click on create resource and search for Virtual Network Gateway.
3. Click Create
4. Fill out fields.


5. Tag your resources appropriately.


6. Review and create the Virtual Private Gateway.

CREATE A VIRTUAL PRIVATE GATEWAY IN AWS

1. Sign in to the AWS Console
2. Navigate to Virtual Private Gateways -> Create Virtual Private Gateway
3. Name your Virtual Private Gateway and click Create.

CREATE A VIRTUAL PRIVATE GATEWAY IN AWS

1. Click on your newly created Virtual Private Gateway and attached it to your Virtual Private Cloud.

CREATE A CUSTOMER GATEWAY IN AWS FOR AZURE

1. In your Virtual Private Cloud Dashbord, click Customer Gaweways.
2. Fill out the Name, IP Address, and choose your Certificate ARN.

CREATE VPN CONNECTION IN AWS

1. Select Site-to-Site VPN Connections from the left Menu Bar.


2. Enter the details, alpong with the Virtual Private Gateway and Customer Gateway created earlier. In this example, I am using the static routing so I added the CIDR block from my Azure VNET. Leave all other fields default.


3. Download the configuration file as follows:

CREATE A LOCAL GATEWAY IN AZURE

1. Back in the Azure portal, search for Local Network Gateway and click Create


2. Fill out the fields. Use the IP Address under Outside IP Adresses -> Virtual Private Gateway

CREATE A CONNECTION IN AZURE

1. In the Azure portal, search for Connection and click Create
2. Select the appropriate Connection Type, Subscription, Resource Group, and Location and click OK.
3. Select the Virtual Network Gateway and Local Network Gatewway created earlier and enter the PSK from the configuration file. Set the connection name


4. After the deployment succeeds, the tunnel should be established. To verify this, go to the connection and check the status.
5. Verify the status of the tunnel in the AWS Console:

UPDATE THE TOURING TABLE IN AWS

1. Search for Route table in your AWS Console.
2. Edit the routing table to include the CIDR block from your Azure Virtual Private Gateway, this will ensure any traffic destined for the Azure network will route through the Virtual Private Gatewaye rather than going out of the internet gateway.

Tweet Share

comments powered by Disqus