How to Configure a Site-To-Site IPsec VPN to the Amazon AWS VPN Gateway Print

• BFW2AWSCloud

  BFW2AWSCloud
  ).
• Virtual Private Gateway – Select the virtual private gateway created in Step 1. 
• Routing Options – Select Static.

• Static Prefixes – Enter your local network (e.g., 

• • 10.0.10.0/25

    10.0.10.0/25
    ).

    If your local networks overlap with the address space reserved for the VPC add the on-premise networks by editing the VPN connections later.

    

• Click Yes, Create. 
• Click Download Configuration.
• Select generic vendor and platform settings for the configuration file: 
  
  • Vendor – Select Generic. 
  • Platform – Select Generic.
  • Software – Select Vendor Agnostic.
    

• Click Yes, Download, and save the 

8. vpn-<YOUR-VPC-ID>.txt

   vpn-<YOUR-VPC-ID>.txt
    file.
   Click here to see an example Amazon VPN configuration file

Step 4. Configure the X-Series Firewall Site-to-Site VPN Connection

The Amazon VPN configuration file provides settings for two IPsec tunnels, but you must only configure IPsec tunnel #1.

1. Log into the X-Series Firewall.

2. Go to the VPN > Site-to-Site VPN page.

3. In the Site-to-Site IPsec Tunnels section, click Add.
4. Enter the Name for the IPsec VPN. 
5. Configure the Phase 1 settings, as specified in the Amazon configuration file:
   • Encryption: AES
   • Hash Method: SHA
   • DH Group: Group 2
   • Lifetime: 28800
6. Configure the Phase 2 settings, as specified in the Amazon configuration file:
   • Encryption: AES
   • Hash Method: SHA
   • DH Group: Group 2
   • Lifetime: 3600
   • Perfect Forward Secrecy – Select the check box.
7. Configure the remaining settings:
   
   • Local End – Select Active.
   • Local Address – Select Dynamic. 

   • Local Networks – Enter your local subnet.

     Only enter one local subnet. Additional local subnets must use an additional firewall rule to connect the Amazon VPC subnet.

   • Remote Gateway – Enter the IP address for the Virtual Private Gateway supplied in the Amazon VPN configuration file.
   • Remote Networks – Enter the remote VPC subnet.
   • Authentication – Select Shared Passphrase.
   • Passphrase – Enter the Pre-Shared Key supplied in the Amazon VPN configuration file.
   • Enable Aggressive – Select No.
     
8. Click Save.

Your X-Series Firewall now automatically connects to the Amazon virtual private gateway.

Step 5. Create a Pass Access Rule for the VPN Traffic

Create an access rule to allow traffic from your local network to the Amazon VPC subnet. 

1. Log into the X-Series Firewall.

2. Go to the FIREWALL > Firewall Rules page.

3. Add an access rule: 
   
   • Type – Select ALLOW.
   • Source – Enter your local network or select a network object containing only your local network (e.g., 

• 10.0.10.0/25

  10.0.10.0/25
  ).
• Destination – Enter the remote VPC subnet (e.g., 

3. • 10.10.10.0/24

     10.10.10.0/24
     ).
   • Network Services – Select Any.
   • Connection – Select No SNAT.
4. Click Save. 
5. Place the firewall rule above the BLOCKALL rule.
6. Click Save.

Monitoring

You can verify that the VPN tunnel is up by selecting your VPN connection in the Amazon VPC Management Console and clicking the Tunnel Details tab in the bottom pane.