AWS virtual private gateway with redundant tunnels¶

Connect a Vipilink network to an Amazon VPC with two IPsec tunnels, one from each of two Vipilink gateways to the same AWS virtual private gateway. If one tunnel or gateway goes down, traffic keeps flowing through the other.

BGP runs over the tunnels for redundancy and failover. You still add static routes on both sides, as shown in Step 5 and Step 7.

Example used on this page¶

AWS resources created for the Vipilink connection get names that start with vipilink-. You create one customer gateway and one VPN connection for each Vipilink gateway.

All the AWS pages used below are in the VPC console, in the left menu under Virtual private network (VPN).

Step 1: Create and attach a virtual private gateway¶

If you already have a virtual private gateway attached to your VPC, you can use it and skip this step.

1. In the AWS console, open VPC and go to Virtual private network (VPN) → Virtual private gateways.

2. Click Create virtual private gateway, enter a Name tag such as vipilink-vgw, keep Amazon default ASN and click Create virtual private gateway.

   

   

3. Select the gateway, click Actions → Attach to VPC, choose your VPC and click Attach to VPC.

   

Step 2: Create two customer gateways¶

Each customer gateway represents one Vipilink gateway.

1. In the Vipilink console, open your network and note the public IP of each gateway.

2. In the AWS console, go to Virtual private network (VPN) → Customer gateways and click Create customer gateway.

   

3. Create the first customer gateway:

   Field	Value
   Name tag	vipilink-gw-new-jersey
   BGP ASN	64520
   IP address	Public IP of the first Vipilink gateway

   

4. Repeat for the second gateway, for example vipilink-gw-miami, with BGP ASN 64520 and the public IP of the second Vipilink gateway.

   

Step 3: Create two Site-to-Site VPN connections¶

Create one VPN connection for each customer gateway.

1. Go to Virtual private network (VPN) → Site-to-Site VPN connections and click Create VPN connection.

   

2. Fill in the form:

   Field	Value
   Name tag	vipilink-vpn-new-jersey
   Target gateway type	Virtual private gateway
   Virtual private gateway	vipilink-vgw
   Customer gateway	Existing, then choose vipilink-gw-new-jersey
   Routing options	Dynamic (requires BGP)

   Leave the other fields at their defaults.

   

3. Expand Tunnel 1 options, choose Edit tunnel 1 options and set DPD timeout (seconds) to 60.

   

4. Click Create VPN connection.

5. Repeat for the second customer gateway, for example vipilink-vpn-miami.

Wait until both connections show Available.

Step 4: Download both configuration files¶

1. Select the first VPN connection (1) and click Download configuration (2).

   

2. Choose Generic, Generic, Vendor Agnostic and ikev2, then click Download.

   

3. Repeat for the second VPN connection. Rename the files so you know which gateway each one belongs to, for example add -new-jersey and -miami to the names.

Step 5: Route VPC traffic to Vipilink¶

1. Go to Virtual private cloud → Route tables (1) and select the route table used by your VPC subnets (2).

2. Open the Routes tab (3) and click Edit routes (4).

   

3. Click Add route:

   • Destination: your Vipilink network subnet, for example 10.14.0.0/16
   • Target: Virtual Private Gateway, then choose vipilink-vgw
4. Click Save changes.

Step 6: Add the dual tunnel in Vipilink¶

1. In the Vipilink console, open your network. On either gateway card, click the ... menu and choose Add Tunnel.

   

2. Choose IPsec Site-to-Site Tunnel (1) and click Continue. Then choose Dual-Tunnel (2) and click Continue.

   

   Tip

   Dual-Tunnel is only available when the network has at least two gateways.

3. Enter a Tunnel Name, for example AWSDual. Use letters and numbers only. Vipilink names the two tunnels AWSDual 1 and AWSDual 2.

4. In the first tunnel section, click Upload and select the first configuration file. Then choose the matching Vipilink gateway in Gateway.

   

5. In the second tunnel section, upload the second file and choose the second Vipilink gateway.

   

   Vipilink fills in the pre-shared key, internal IPs, remote public IP, remote AS number and remote ID from each file.

   Match each file to its gateway

   Each file belongs to the customer gateway you created for one Vipilink gateway. If you pick the wrong gateway for a file, that tunnel will not come up.

6. In Shared Settings, keep Vipilink Side Subnets and Remote Side Subnets set to Any. The Vipilink ASN is fixed at 64520.

   

7. Keep the Advanced Settings defaults: IKE V2, IKE lifetime 8h, tunnel lifetime 1h, DPD 10s / 30s, aes256, sha256 and group 14.

8. Click Add Tunnel.

Step 7: Route Vipilink traffic to the VPC¶

1. On the network card, click the ... menu and choose Route Table.

   

2. Click Add Routes, choose the dual tunnel, enter the VPC CIDR (for example 10.50.0.0/16) and click Add Routes.

   

3. The route appears in the table with the type Manual. It covers both tunnels.

   

Step 8: Check the connection¶

1. In the Vipilink console, both tunnel cards show Up.

   

2. In the AWS console, open Tunnel details for each VPN connection. One tunnel shows Up with BGP routes in Details.

   

   One tunnel per VPN connection shows Down

   This is expected. AWS creates two tunnels for every VPN connection, and each Vipilink gateway uses one of them. AWS also shows a banner saying the connection is not using both tunnels. Redundancy comes from the two VPN connections and the two Vipilink gateways.

3. Connect a device to the network with the Vipilink agent and reach a resource in the VPC, for example with ping or SSH to a private IP.

   

Troubleshooting¶