Different outside IP per tunnel on a site-to-site VPN connection

When building an AWS site to site VPN each tunnel of the VPN connection gives me a different outside IP address for the AWS Virtual Private Gateway, which is a good practice for redundancy reasons, as explained in AWS documentation.

However, I am forced to use a single IP for the Customer Gateway, which is limiting the redundancy on the customer side. I would need to be able to provide a different outside IP for each tunnel of the same VPN connection. Otherwise I am limiting the resiliency of my site to site VPN.

Is there any way to achieve this?

トピック

ネットワークとコンテンツ配信回復力

タグ

Amazon VPC 回復力 AWS Virtual Private Network (VPN)

言語

English

Borja

質問済み 10ヶ月前737ビュー

2回答

新しい順
投票が多い順
コメントが多い順

これらの回答は役に立ちましたか？コミュニティがあなたの知識を活用できるように、正解に賛成票を投じてください。

You can only use a single CGW for each VPN. To have a redundancy on the CGW side, you can create two VPN connections, each with different CGW.

You can either configure both tunnels for each VPN (you will have a total of 4 tunnels, each 2 tunnels terminated on a single CGW) or a single tunnel for each VPN (total of 2 tunnels, 1 tunnel terminated on each CGW).

The design is discussed here https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.html

Matt_E

回答済み 10ヶ月前

エキスパート

iBehr

レビュー済み 10ヶ月前

エキスパート

Riku_Kobayashi

レビュー済み 10ヶ月前

Borja
10ヶ月前
Thanks for the response. Understood. If I have to create 2 CGWs with 2 VPN connections:

Could AWS be running an end point update on both tunnels at the same time? Would I loose all connectivity then? (including the redundant one) I am using this as a reference https://docs.aws.amazon.com/vpn/latest/s2svpn/endpoint-replacements.html

An additional VPN connection would double the cost, even though I would be using half of the tunnels, right?
Matt_E
10ヶ月前

AWS would use different time for the endpoint update, hence AWS recommend two tunnels so that when one tunnel goes down during the endpoint update, the other tunnel stays up.

Yes, it would increase the cost by around $36 (the VPN cost) but not double it.
Borja
10ヶ月前
Good, thanks I cannot have both tunnels on the same VPN connection because I need to use a different pubic IP per tunnel on the CGW side. So I have e.g. CGW A with VPN Connection A and CGW B with VPN Connection B, and use a single tunnel on each VPN Connection. In this case, could AWS update at the same time my only active tunnel of both VPN connections?
Borja
6ヶ月前
About the design shown here https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.html AWS is providing a different public IP for each tunnel on the same VPN connection. In my setup I am forced to do the same (for similar reasons). Therefore I need to setup a different AWS customer gateway for each public IP on my side. This means that on each VPN connection only one of the tunnels is configured and online. I know AWS would use a different time for the update of each endpoint. So in the diagram of the link above, since I would have only Tunnel 1 on each VPN connection, could it be the case that AWS is doing updates at the same time on Tunnel 1 of VPN Connection 1 and Tunnel 1 of VPN Connection 2?

@Borja did you manage to find out? I'm currently trying to implement a similar approach and would pretty much like to know if the two tunnels from the different VPNs are in the same AZ or not.

Lincon

回答済み 5ヶ月前

Different outside IP per tunnel on a site-to-site VPN connection

関連するコンテンツ