IPsec tunnel to AWS VPC with Certificates

AWS VPC configuration

Create Certificates

1. Private CA
   
2. Private Subordinate CA which is used to sign the VPN certificates
   
   
3. Private Certificate, issued by the Subordinate for each Nodegrid IPsec endpoint. In this case this was one tunnel.
   NOTE: the domain name can be anything, but for best practices should the domain name include the hosts hostname, in this example the domain name "fre-ipsec.se.zpesystems.com" was choosen.
   
4. 2 Private Certificates, issued by the Subordinate for each VPC endpoint.
   These will automatically be created when the VPC is configured.
   

Configure AWS Virtual Private Network

Create Customer Gateway

Virtual Private Gateway

Site to Site VPN Connections

Policy Based

Routing Based

Extract Certificates and configuration details

Nodegrid configuration

Base Configuration

Create IKE Profile

AWS_IKEv1

1. Navigate  to Network -> IPsec -> IKE Profile
   
2. Click on add and create a new Profile
   
3. Fill on the following settings:
   
1. Profile Name: AWS_IKEv1
   
2. IKE Version: IKEv1
   
3. Phase 1:
   
1. Encryption: AES-GCM256
   
2. Authentication: SHA512
   
3. Diffie-Hellman Group: Group 21
   
4. Lifetime (sec): 28800
   
4. Phase 2:
   
1. Authentication Protocol: AES-GCM256
   
2. Authentication: SHA512
   
3. PFS Group: Group 21
   
4. Lifetime (sec): 3600
   
5. Dead Pear Detection
   
1. Number of Retries: 5
   
2. Interval (sec): 30
   
3. Action: Restart
   

Import Certificates

1. Copy all the exported certificates files to the Nodegrid's tmp directory
   
2. The following names were selected for the files
   Customer Gateway certificate - certificate.crt
   Customer Gateway certificate private key - privateKey.key
   Customer Gateway Certificate Chain - ca.crt
   Endpoint 0 certificate - endpoint.0.crt
   Endpoint 1 certificate - endpoint.1.crt
3. ssh to the Nodegrid and become root user with
   
   1. shell sudo su -
      
4. run the following commands to import the certificates
   

1. list the imported Certificates and their Aliases. NOTE: The full Alias for the important Customer Gateway in this example shown below is "fre-ipsec.se.zpesystems.com - Sales Engineers ZPE Systems"
   

Create Tunnel

1. create an IPsec configuration file in /etc/ipsec/ipsec.d/ with
   vi /etc/ipsec/ipsec.d/AWS.conf
2. Copy the following template into the file and replace the variables (marked by {{ }} ) with the required information. The below example is a policy based tunnel
   
   1. # Managed by Nodegrid
      conn AWS
              auto=start
              type=tunnel
              leftid=%fromcert
              left=%defaultroute
              leftrsasigkey=%cert
              leftcert={{ AWS CUSTOMER GATEWAY CERTIFICATE ALIAS }}                  #example "fre-ipsec.se.zpesystems.com - Sales Engineers ZPE Systems"
              rightid=%fromcert
              right={{ AWS VPC PUBLIC IP }}
              rightrsasigkey=%cert
              rightcert="endpoint-0"                                                                                         #For the 2nd tunnel use the value endpoint-1           
              also=AWS-IKEv1                                                                                                   #Use a profile name which was created earlier, in this example either AWS-IKEv1, AWS-IKEv2
              leftsourceip={{ Inside IP Addresses - Customer Gateway }}
              rightsourceip={{ Inside IP Addresses   - Virtual Private Gateway  }}
              leftsubnets={{ {Inside IP Address CIDR, Customer Gateway Network} }}       #example {169.254.109.12/30, 10.10.0.0/16}
              rightsubnets={{ {Inside IP Address CIDR, AWS Network} }}                             #example {169.254.109.12/30, 10.0.0.0/16}
      
3. Route based configuration example. NOTE: This will only set the IPsec policies, but no routes will be installed, this needs to be done manually.
   
   1. # Managed by Nodegrid
      conn AWS
              auto=start
              type=tunnel
              leftid=%fromcert
              left=%defaultroute
              leftrsasigkey=%cert
              leftcert={{ AWS CUSTOMER GATEWAY CERTIFICATE ALIAS }}                  #example "fre-ipsec.se.zpesystems.com - Sales Engineers ZPE Systems"
              rightid=%fromcert
              right={{ AWS VPC PUBLIC IP }}
              rightrsasigkey=%cert
              rightcert="endpoint-0"                                                                                         #For the 2nd tunnel use the value endpoint-1           
              also=AWS-IKEv1                                                                                                   #Use a profile name which was created earlier, in this example either AWS-IKEv1, AWS-IKEv2
              leftsourceip=                                                                                                            #This should be blank
              rightsourceip=                                                                                                          #This should be blank
              leftsubnets=0.0.0.0/0
              rightsubnets=0.0.0.0/0
              mark=-1
              vti-interface=vtiaws01
              vti-routing=no
              vti-shared=yes
              leftvti=
      

Appendix

import_settings commands

IPsec Global Settings