Skip to content

AWS virtual private gateway

Connect a Vipilink network to an Amazon VPC with one IPsec tunnel between a Vipilink gateway and an AWS virtual private gateway. Routing is static, and one Vipilink gateway is enough.

If you need automatic failover, use AWS virtual private gateway with redundant tunnels instead. It uses two Vipilink gateways and BGP.

Before you start

  • A Vipilink network with at least one active gateway.
  • An Amazon VPC, and permission to create VPN resources in it.
  • The Vipilink network subnet and the VPC CIDR must not overlap.

Example used on this page

Item Example value
Vipilink network Remote Access, subnet 10.13.0.0/16
Vipilink gateway Frankfurt
AWS Region US East (N. Virginia)
Amazon VPC app-vpc, CIDR 10.50.0.0/16

Replace these with your own values. AWS resources created for the Vipilink connection get names that start with vipilink-, so you can tell them apart from your own resources.

All the AWS pages used below are in the VPC console, in the left menu under Virtual private network (VPN).

VPC console left menu with the VPN pages highlighted

Step 1: Create a virtual private gateway

The virtual private gateway is the VPN endpoint on the AWS side.

  1. In the AWS console, open VPC and go to Virtual private network (VPN) → Virtual private gateways.

  2. Click Create virtual private gateway.

    Virtual private gateways page with Create virtual private gateway highlighted

  3. Enter a Name tag, for example vipilink-vgw, and keep Amazon default ASN.

  4. Click Create virtual private gateway.

Create virtual private gateway form with the name and ASN highlighted

Attach the new gateway to your VPC:

  1. Select the gateway, then click Actions → Attach to VPC.

    Actions menu with Attach to VPC highlighted

  2. Choose your VPC under Available VPCs and click Attach to VPC.

    Attach to VPC form with the VPC selected

Step 2: Create a customer gateway

The customer gateway tells AWS where your Vipilink gateway is.

  1. In the Vipilink console, go to Networks → Networks, open your network and copy the public IP shown on the gateway card.

    Vipilink network page with the gateway card highlighted

  2. In the AWS console, go to Virtual private network (VPN) → Customer gateways and click Create customer gateway.

    Customer gateways page with Create customer gateway highlighted

  3. Fill in the form:

    Field Value
    Name tag vipilink-gw-frankfurt
    BGP ASN Keep the default. It is not used with static routing.
    IP address The Vipilink gateway public IP you copied

  4. Click Create customer gateway.

Create customer gateway form with the name and IP address highlighted

Step 3: Create the Site-to-Site VPN connection

  1. Go to Virtual private network (VPN) → Site-to-Site VPN connections and click Create VPN connection.

    VPN connections page with Create VPN connection highlighted

  2. Fill in the form:

    Field Value
    Name tag vipilink-vpn-frankfurt
    Target gateway type Virtual private gateway
    Virtual private gateway vipilink-vgw
    Customer gateway Existing, then choose vipilink-gw-frankfurt
    Routing options Static
    Static IP prefixes Your Vipilink network subnet, for example 10.13.0.0/16

    Leave the other fields at their defaults.

    Create VPN connection form with gateway, routing and static prefix highlighted

  3. Expand Tunnel 1 options and choose Edit tunnel 1 options.

    Tunnel 1 options with Edit tunnel 1 options selected

  4. Set DPD timeout (seconds) to 60. Leave the other tunnel options at their defaults.

    DPD timeout set to 60 seconds

  5. Click Create VPN connection. Wait until the State changes to Available. This can take a few minutes.

Step 4: Download the configuration file

Vipilink reads this file and fills in the tunnel settings for you.

  1. Select the VPN connection (1) and click Download configuration (2).

    VPN connections list with Download configuration highlighted

  2. Choose these options and click Download:

    Field Value
    Vendor Generic
    Platform Generic
    Software Vendor Agnostic
    IKE version ikev2

    Download configuration dialog with Generic options selected

Keep the file private

The configuration file contains the tunnel pre-shared keys. Store it somewhere safe and delete it when you are done.

Tell the VPC to send traffic for the Vipilink network through the virtual private gateway.

  1. Go to Virtual private cloud → Route tables (1) and select the route table used by your VPC subnets (2).

  2. Open the Routes tab (3) and click Edit routes (4).

    Route tables page with the menu item, route table, Routes tab and Edit routes numbered

  3. Click Add route:

    • Destination: your Vipilink network subnet, for example 10.13.0.0/16
    • Target: Virtual Private Gateway, then choose vipilink-vgw
  4. Click Save changes.

Edit routes with the Vipilink subnet routed to the virtual private gateway

  1. In the Vipilink console, open your network. On the gateway card, click the ... menu and choose Add Tunnel.

    Gateway menu with Add Tunnel highlighted

  2. Choose IPsec Site-to-Site Tunnel (1) and click Continue. Then choose Single-Tunnel (2) and click Continue.

    Tunnel protocol and tunnel type selection

  3. Click Upload and select the configuration file from Step 4. Vipilink fills in Pre-Shared Key, Remote Public IP and Remote ID.

  4. Enter a Tunnel Name, for example AWSStatic. Use letters and numbers only.

  5. Keep Vipilink Side Subnets and Remote Side Subnets set to Any.

    IPsec tunnel form after the AWS file was uploaded

  6. Keep the Advanced Settings defaults. AWS accepts them:

    Setting Value
    IKE Version V2
    IKE Lifetime 8h
    Tunnel Lifetime 1h
    Dead Peer Detection Delay / Timeout 10s / 30s
    Encryption (Phase 1 and 2) aes256
    Integrity (Phase 1 and 2) sha256
    Diffie-Hellman Groups (Phase 1 and 2) 14

  7. Click Add Tunnel.

Tell Vipilink which subnets are behind the tunnel.

  1. On the network card, click the ... menu and choose Route Table.

    Network menu with Route Table highlighted

  2. Click Add Routes, choose your tunnel, enter the VPC CIDR (for example 10.50.0.0/16) and click Add Routes.

    Add Routes dialog with the VPC subnet entered

  3. The route appears in the table with the type Manual.

    Route Table with the AWS route

Step 8: Check the connection

  1. In the Vipilink console, the tunnel card shows Up.

    Tunnel card showing Up

  2. In the AWS console, select the VPN connection and open Tunnel details. Tunnel 1 shows Up.

    AWS tunnel details with Tunnel 1 up

    Tunnel 2 shows Down

    This is expected. AWS creates two tunnels for every VPN connection, and a single-tunnel setup uses one of them. AWS also shows a banner saying the connection is not using both tunnels. If you need redundancy, use AWS virtual private gateway with redundant tunnels.

  3. Connect a device to the network with the Vipilink agent and reach a resource in the VPC, for example with ping or SSH to a private IP.

    Terminal pinging a private AWS IP while connected to Vipilink

Troubleshooting

Problem What to check
Tunnel stays Down The customer gateway IP matches the Vipilink gateway public IP. The file you uploaded belongs to this VPN connection.
Tunnel is Up but nothing responds Routes exist on both sides (Step 5 and Step 7). Security groups and network ACLs in AWS allow traffic from the Vipilink network subnet. Vipilink firewall rules allow the traffic.