amazon-web-services - 在 terraform IPSec 隧道中使用的 AWS IP 地址(通过 Transit Gateway)

Question

我正在尝试构建 AWS terraform IPSec VPN 配置。但是，我不记得在哪里可以找到 AWS IPSec IP 地址； terraform cgw documentation表示 ip_address 字段是必需的。

答案应该假定 VPN 将附加到我的 AWS Transit Gateway .

我的地形:

resource "aws_customer_gateway" "cgw-abbv-for-local-and-remote" {
  bgp_asn    = 65001
  ip_address = "A.B.C.D"   #<-- I need this IP before terraform apply
  type       = "ipsec.1"

  tags = {
    Name        = "insert-cgw-name-here"
  }
}

resource "aws_vpn_connection" "vpn-abbv-for-local-and-remote" {
  customer_gateway_id = aws_customer_gateway.cgw-abbv-for-local-and-remote.id
  transit_gateway_id  = aws_ec2_transit_gateway.my-tgw-name.id
  type                = aws_customer_gateway.cgw-abbv-for-local-and-remote.type

  tags = {
    Name        = "insert-vpn-name-here"
  }
}

Answer 1

似乎 OP 已经找到了答案，但让我加两分钱，因为两年前我花了很多时间来解决 AWS VPN 问题，以便通过 AWS Advanced Networking 证书。这可能对 VPN 新手很有用 - 特别是在 AWS 生态系统中:

有一本很棒的书，叫做 AWS 认证高级网络官方学习指南，我会推荐所有担任云网络工程师角色的人阅读。 [1]

它指出了以下几点:

• >

  After you create a VPN connection, the VPN tunnel activates when traffic is generatedfrom your side of the VPN connection. The VGW is not the initiator; your customer gateway must initiate the tunnels. If your VPN connection experiences a period of idle time (usually10 seconds, depending on your configuration), the tunnel may go down. This is becauseAWS uses an on-demand DPD mechanism. If AWS receives no traffic from a VPN peer for10 seconds, AWS sends a DPD “R-U-THERE” message. If the VPN peer does not respondto three successive DPDs, the VPN peer is considered dead and AWS closes the tunnel. [pp. 100, 101]

• >

  At the non-AWS end of a VPN connection, the VPN is terminated on a customer gateway.A customer gateway is the AWS term for the VPN termination device at the customer’s onpremises end. A customer gateway can also be hosted in AWS as an EC2 instance runningVPN software that meets the requirements given in the next section.Most customers don’t require the purchase of an additional device and can reuse anexisting on-premises VPN termination device to create a tunnel to a VPC. [p. 110]

• >

  You can use any third-party VPN device that supports Layer 3 VPN technologies. AWSdoes not support Layer 2 VPN technologies.IPsec is used for the VGW at the AWS end of VPN termination, and so the IPsec protocol must be supported by your VPN device. You will set up two VPN tunnels per VGW.Support for BGP routing protocol is optional but recommended for advanced routing capabilities. Other routing protocols like Open Shortest Path First (OSPF) are not supported byAWS. You must ensure that you have opened the right ports in your on-premises firewallfor the IPsec traffic to flow. [p. 111]
  That is in particular: both ends of the VPN connection must possess a public IP address!

如果您还没有，我真的非常建议您跳过这些页面，以了解最佳实践和 AWS 在(混合)云架构方面的思维方式。如果事情没有按照您想要的方式进行，您可以避免事后感到困惑。 IPSec(即第 3 层)VPN 比大多数人想象的要难。应该了解所有与路由和安全相关的内容，例如:IKE、SA、基于策略的路由、NAT-遍历、ISAKMP 等 [另见第97:VPN 功能 -> 安全和路由部分]。

另一个很好的引用是 AWS 站点到站点 VPN 指南 (PDF)。 [2]

另请注意:许多 terraform 属性也可以在 AWS CloudFormation 文档中找到。 AWS::EC2::CustomerGateway 资源的 IpAddress 属性状态 [3] 的文档:

The Internet-routable IP address for the customer gateway's outside interface. The address must be static.

[1] https://www.programmer-books.com/wp-content/uploads/2019/04/AWS-Certified-Advanced-Networking-Official-Study-Guide.pdf
[2] https://docs.aws.amazon.com/vpn/latest/s2svpn/s2s-vpn-user-guide.pdf
[3] https://docs.aws.amazon.com/de_de/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-customer-gateway.html#cfn-ec2-customergateway-ipaddress