Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
Shuji Kikuchi, profile picture
Uploaded byShuji Kikuchi
PDF, PPTX14,502 views

[AKIBA.AWS] VPN接続とルーティングの基礎

The document primarily discusses the configuration of AWS VPN connections, including details about virtual private gateways, customer gateways, BGP routing settings, and tunnel configurations. It outlines essential IP address schemes, routing protocols, and key management settings for establishing secure communications over the VPN. Additionally, there are references to specific commands and operational statuses relevant to networking equipment used for these purposes.

Technology◦
# #
2S C I # C 8 A New!
3 4 2 3 A # 4GB . 1
4 # .
5AWS VPN • N • N 2 V 2 N • P • • # ##
6AWS VPN • # VPN VPN
7AWS VPN • # VPN VPN
8AWS VPN • # VPN VPN
9AWS VPN • 2 # # 2 VPN VPN
10AWS VPN • = # • # = # • # #
11 . #
12VPN # Virtual Private Gateway Customer Gateway
13VPN a a • # # • V W k IS N • 2 # # • Pa c I V • eBib I • • # # C • B a eB • # G C a
14VPN • # • # • +
15VGW #
16CGW # CGW IP or AS
17VPN # VGW CGW
18 #
19K G E BT • / BV • / / • # IE BV S IE BP • BN c B W A Wa B b
20C G C 2 2 • # • C C VGW 10.10.10.0/24 2 AC VPCC C 10.10.10.0/24 2VGW
21S S P C • • i S P W • S P # Ga AS P V • S P RS • SP W • 2 2 2 eg bBC S P V
22 # .
23BGP • # • ca S B • 1 1 r Cbmi ko G • Cn A Cbm T P • S S e l G Cbm d
24BGP # BGP BGP 10.10.10.0/24172.16.0.0/24
25 # VGW 10.10.10.0/24172.16.0.0/24 VPC CIDR 172.16.0.0/24 CGW CIDR 10.10.10.0/24 BGP
26 # VPC CIDR 172.16.0.0/24 CGW CIDR 10.10.10.0/24 [Route Propagation] VGW VPC 10.10.10.0/24172.16.0.0/24 BGP
27BGP # #show ip bgp BGP table version is 5, local router ID is 192.168.1.253 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 10.10.10.0/24 0.0.0.0 0 32768 i *> 172.16.0.0/24 169.254.24.77 100 0 10124 i * 169.254.27.117 200 0 10124 i
28BGP # #show ip bgp BGP table version is 5, local router ID is 192.168.1.253 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 10.10.10.0/24 0.0.0.0 0 32768 i *> 172.16.0.0/24 169.254.24.77 100 0 10124 i * 169.254.27.117 200 0 10124 i Metric C
• D H SOW_ Ww G BC ALi s SW S N AL • # # • 0 • W_ FE • 1 O PT MLw RbWa D F • isHRbWa F # 1 O PTALw N AL 29BGPHisk
30 #
31 • W N • G • G G A • # T • CG
32CGW G • • G C #
33iCGW CL DCCWS • 0JG L P OT G R TY 3CTGWCY ev y ron • 0 S P 0 S P - ev y ron • 0 S P 49 0 S P 49 ) ev y ron • 1GMM PO 66 PO 9 . hcfbm ev y ron • 2PRT OGT 2PRT ICTG ) t u 2PRT 9 ) ev y ron • 5 O GR 5# GR GS 5 O9 . ev y ron • 5 O GR 5 O9 hcfbm ev y ron • RGGO9 + f + hcfbm n al 5 O GR 3 • RGGO9 + f + hcfbm n al 5 O GR 4 3 • 9 hcfbm ev y ron al 8GTICTG GOSG • CMP MTP 8GTWPRLS 89 ) hcfbm v y ro • ACNCJC GZ Z Z Z ( Z kg w • 7 RPSP T OFPWS GRVGR - ev y ro • 7 RPSP T OFPWS GRVGR ev y ro • d xp s ml 8 e YXGM YWCMM t u ) hcfbm v y roZhcf d xp s ml 8 e ) ( hcfbm v y ro https://docs.aws.amazon.com/ja_jp/AmazonVPC/latest/NetworkAdminGuide/Introduction.html
34BGP router bgp 65000 neighbor 169.254.27.xxx remote-as 10124 neighbor 169.254.27.xxx activate neighbor 169.254.27.xxx timers 10 30 30 address-family ipv4 unicast neighbor 169.254.27.xxx remote-as 10124 neighbor 169.254.27.xxx timers 10 30 30 neighbor 169.254.27.xxx default-originate neighbor 169.254.27.xxx activate neighbor 169.254.27.xxx soft-reconfiguration inbound ! To advertise additional prefixes to Amazon VPC, copy the 'network' statement ! and identify the prefix you wish to advertise. Make sure the prefix is present ! in the routing table of the device with a valid next-hop. network 0.0.0.0 #
# 35 router bgp 65000 neighbor 169.254.27.xxx remote-as 10124 neighbor 169.254.27.xxx activate neighbor 169.254.27.xxx timers 10 30 30 address-family ipv4 unicast neighbor 169.254.27.xxx remote-as 10124 neighbor 169.254.27.xxx timers 10 30 30 neighbor 169.254.27.xxx default-originate neighbor 169.254.27.xxx activate neighbor 169.254.27.xxx soft-reconfiguration inbound ! To advertise additional prefixes to Amazon VPC, copy the 'network' statement ! and identify the prefix you wish to advertise. Make sure the prefix is present ! in the routing table of the device with a valid next-hop. network 192.168.1.0 mask 255.255.255.0 network 172.16.0.0 mask 255.255.255.0 O C I BGP C
36CGW NATN G F C P # VGW CGW VPN FW
37CGWFNATw KA i 4 b N l F K PCK S k • • • 5 0 c e e TW S cUa KsG DF • E M 0 Sr I
# 38 crypto keyring keyring-vpn-xxxxxxxx-0 local-address xxx.xxx.xxx.xxx pre-shared-key address yyy.yyy.yyy.yyy key xxxxxxxxxxxxxxxxxxxxxxxxxxx ~~~~~~~~ ~~~~~~~~ crypto isakmp profile isakmp-vpn-xxxxxxxx-0 local-address xxx.xxx.xxx.xxx match identity address yyy.yyy.yyy.yyy keyring keyring-vpn-xxxxxxxx ~~~~~~~~ ~~~~~~~~ interface Tunnel1 ip address 169.254.27.xxx 255.255.255.252 ip virtual-reassembly tunnel source xxx.xxx.xxx.xxx tunnel destination yyy.yyy.yyy.yyy tunnel mode ipsec ipv4 tunnel protection ipsec profile ipsec-vpn-xxxxxxxx-0 ! This option causes the router to reduce the Maximum Segment Size of ! TCP packets to prevent packet fragmentation. ip tcp adjust-mss 1379 no shutdo CGW NAT
39V / N e Fi GCIA C • SW FALB • # SW FALB a • V c FALB • b FALB • • P W
40WT 5 4 N CE • D D ebCE A • / / 0 caCE A • 4 ISWU P K G A • 4 4
41P GR A B • GSV • # P B • N B • A W
42 #
43C • I BPN c • # C B G W • A B b • a V S A # A
#
#
46- W A 4 - K • P CA D 9 • P - 140/5 220/5 9 • 5 IB S # • P N 9 . /..32
. 4783 / 73 AKA 19:30 - 19:35 - 19:35 - 20:05 AWS Route 53 20:05 - 20:35 VGW 20:35 - 21:05 AWS VPN - - W 7/ 83 :2 : / :8 3 3 # B ST B I /6 //