Recently Amazon announced, (see also) “You can now create Hardware VPN connections to your VPC using static routing.” This is great news as it greatly expands the type of devices from which a point-to-point IPSec VPN can be created to your Virtual Private Cloud. Previously only dynamic routing was supported, which required BGP and a device (like Cisco ISR). Now VPC supports static routing, greatly expanding the types of devices through which a VPN can be connected. Now devices like Cisco ASA 5500 firewalls, and even Microsoft Windows Server 2008 R2 (or later) can be used. And, as I finally got working, SonicWALL firewalls (I connected with a NSA 2400, but I’m sure others will work as well).
Here’s what I did to get my statically routed point-to-point IPSec VPN setup between my Amazon Virtual Private Cloud (VPC) and a SonicWALL NSA 2400.
First, create a VPC. Here is a great step-by-strep guide to create a VPC: How to Create an Amazon VPC.
In the VPC Management Console click on VPN Connections, select your VPN (you may only have one), then click Download Configuration. Next to Vendor select Generic, then Download.
This file contains all the critical information you’ll need, like pre-shared keys, IP addresses, etc.
Connect to your SonicWALL’s web interface and perform the following.
Step 1 – Create Address Object
Go to Network, select Address Object. In the Address Objects section, click the Add button and configure with these settings:
- Name: VPC LAN (this is arbitrary)
- Zone Assignment: VPN
- Type: Network
- Network: the subnet portion of the VPC CIDR
- Netmask: the subnet mask portion of the VPC CIDR
Step 2 – Create New VPN Policy
From VPN, Settings add new policy, using the following information:
- General Tab
- Authentication Method: IKE using Preshared Secret
- Name: Any name you choose
- IPsec Primary Gateway: IP address from downloaded config
- IPsec Secondary Gateway: Secondary IP address from config
- Shared Secret: Shared secret from config
- Network Tab
- Local Networks: Select appropriate setting for your environment
- Destination Networks: VPC LAN from previous step
- Proposals Tab
- Exchange: Main Mode
- DH Group: Group 2
- Encryption: AES-128
- Authentication: SHA1
- Life Time: 28800
- Protocol: ESP
- Encryption: AES-128
- Authentication SHA1
- DH Group: Group 2
- Life Time 28800
- Advanced Tab
- Set as required for your environment.
Once all the settings are correct you should be able to see the tunnel status in both your SonicWALL and AWS Console. Test connections over the tunnel using ICMP ping or other methods.
 |
| VPN Status from SonicWALL |
 |
| VPN Status from AWS Console |