tunnel select 1 \r\nipsec ike encryption 1 aes-cbc\r\nipsec ike group 1 modp1024\r\nipsec ike hash 1 sha\r\nipsec ike pre-shared-key 1 text hogemogehohoho\u203bAWS VPN\u79d8\u5bc6\u9375\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba\r\nipsec tunnel 201\r\nipsec sa policy 201 1 esp aes-cbc sha-hmac\r\nipsec ike duration ipsec-sa 1 3600\r\nipsec ike pfs 1 on\r\nipsec tunnel outer df-bit clear\r\nipsec ike keepalive use 1 on dpd 10 3\r\nipsec ike local address 1 xxx.yyy.zzz.aaa\u203b\u30eb\u30fc\u30bf\u5074\u56fa\u5b9aIP\r\nipsec ike remote address 1 13.112.141.58\r\nip tunnel address 169.254.24.230\/30\r\nip tunnel remote address 169.254.24.229\r\nip tunnel tcp mss limit 1379\r\ntunnel enable 1\r\ntunnel select none\r\nipsec auto refresh on\r\nbgp use on\r\nbgp autonomous-system 65000\r\nbgp neighbor 1 10124 169.254.24.229 hold-time=30 local-address=169.254.24.230\r\nbgp import filter 1 equal 0.0.0.0\/0\r\nbgp import 10124 static filter 1\r\ntunnel select 2 \r\nipsec ike encryption 2 aes-cbc\r\nipsec ike group 2 modp1024\r\nipsec ike hash 2 sha\r\nipsec ike pre-shared-key 2 text hogemogehohoho\u203bAWS VPN\u79d8\u5bc6\u9375\u30d1\u30b9\u30d5\u30ec\u30fc\u30ba\r\nipsec tunnel 202\r\nipsec sa policy 202 2 esp aes-cbc sha-hmac\r\nipsec ike duration ipsec-sa 2 3600\r\nipsec ike pfs 2 on\r\nipsec tunnel outer df-bit clear\r\nipsec ike keepalive use 2 on dpd 10 3\r\nipsec ike local address 2 xxx.yyy.zzz.aaa \u203b\u30eb\u30fc\u30bf\u5074\u56fa\u5b9aIP\r\nipsec ike remote address 2 52.197.214.91\r\nip tunnel address 169.254.24.210\/30\r\nip tunnel remote address 169.254.24.209\r\nip tunnel tcp mss limit 1379\r\ntunnel enable 2\r\ntunnel select none\r\nipsec auto refresh on\r\nbgp use on\r\nbgp autonomous-system 65000\r\nbgp neighbor 2 10124 169.254.24.209 hold-time=30 local-address=169.254.24.210\r\nbgp import 10124 static filter 1\r\nbgp import filter 1 equal 192.168.10.0\/24\r\nbgp configure refresh\r\nnat descriptor type 1000 masquerade\r\nnat descriptor address outer 1000 ipcp\r\nnat descriptor address inner 1000 auto\r\nnat descriptor masquerade static 1 1 192.168.10.1 udp 500\r\nnat descriptor masquerade static 1 2 192.168.10.1 esp\r\nipsec auto refresh on\r\ndns server 8.8.8.8 8.8.4.4\r\ndns private address spoof on<\/pre>\n\u30c8\u30f3\u30cd\u30eb\u304c\uff12\u3064\u3042\u308b\u3051\u308c\u3069\u3001AWS VPN\u3068\u306e\u63a5\u7d9a\u306e\u5197\u9577\u5316\u306e\u70ba\u306e\u3082\u306e\u306a\u306e\u3067\u3001\u305f\u3060\u7e4b\u3052\u308b\u3060\u3051\u306a\u3089\uff11\u3064\u3067\u3082\u5927\u4e08\u592b\u3067\u3059\u3002<\/p>\n
RTX1100\uff5eRTX1210\u306f\u4e0a\u8a18\u3067\u52d5\u304f\u306f\u305a\u3001RTX1000\u3060\u3068\u5c11\u3057\u66f8\u304d\u63db\u3048\u304c\u5fc5\u8981\u304b\u306a\u3002<\/p>\n
bgp neighbor 1 10124 169.254.24.229 hold-time=30 local-address=169.254.24.230\r\n\u2193\r\nbgp neighbor 1 10124 169.254.24.229 hold-time=30\r\n<\/pre>\n <\/p>\n
AWS\u3068\u306eVPN\u63a5\u7d9a\u306e\u78ba\u8a8d<\/h4>\n
\u30c8\u30f3\u30cd\u30eb\u72b6\u614b\u306e\u78ba\u8a8d\u3092\u884c\u3044\u307e\u3059\u3002<\/p>\n
# show status tunnel 1\r\nTUNNEL[1]:\r\nDescription:\r\n Interface type: IPsec\r\n Current status is Online.\r\n from 1980\/01\/04 14:49:15.\r\n 13630 days 3 hours 27 minutes 29 seconds connection.\r\n Received: (IPv4) 75 packets [4852 octets]\r\n (IPv6) 0 packet [0 octet]\r\n Transmitted: (IPv4) 89 packets [5449 octets]\r\n (IPv6) 0 packet [0 octet]\r\n \r\n \r\n# show status tunnel 2\r\nTUNNEL[2]:\r\nDescription:\r\n Interface type: IPsec\r\n Current status is Online.\r\n from 1980\/01\/04 14:49:16.\r\n 13630 days 3 hours 27 minutes 33 seconds connection.\r\n Received: (IPv4) 76 packets [4904 octets]\r\n (IPv6) 0 packet [0 octet]\r\n Transmitted: (IPv4) 86 packets [5293 octets]\r\n (IPv6) 0 packet [0 octet]<\/pre>\n <\/p>\n
\u9375\u4ea4\u63db\u304c\u51fa\u6765\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d<\/p>\n
# show ipsec sa\r\n\r\nsa sgw connection dir life[s] remote-id\r\n--------------------------------------------------------------------------\r\n1 1 isakmp - 28390 13.112.141.58\r\n2 2 isakmp - 28390 52.197.214.91\r\n3 1 tun[001]esp send 3192 13.112.141.58\r\n4 1 tun[001]esp recv 3192 13.112.141.58\r\n5 2 tun[002]esp send 3193 52.197.214.91\r\n6 2 tun[002]esp recv 3193 52.197.214.91<\/pre>\n <\/p>\n
BGP\u306e\u78ba\u8a8d<\/p>\n
# show status bgp neighbor\r\n\r\nBGP neighbor is 169.254.24.229, remote AS 10124, local AS 65000, external link\r\n BGP version 4, remote router ID 169.254.24.229\r\n BGP state = Established, up for 00:06:33\r\n Last read 00:00:03, hold time is 30, keepalive interval is 10 seconds\r\n Received 41 messages, 0 notifications, 0 in queue\r\n Sent 45 messages, 1 notifications, 0 in queue\r\n Connection established 1; dropped 0\r\n Last reset never\r\nLocal host: 169.254.24.230, Local port: 1026\r\nForeign host: 169.254.24.229, Foreign port: 179\r\n\r\nBGP neighbor is 169.254.24.209, remote AS 10124, local AS 65000, external link\r\n BGP version 4, remote router ID 169.254.24.209\r\n BGP state = Established, up for 00:06:33\r\n Last read 00:00:03, hold time is 30, keepalive interval is 10 seconds\r\n Received 41 messages, 0 notifications, 0 in queue\r\n Sent 45 messages, 1 notifications, 0 in queue\r\n Connection established 1; dropped 0\r\n Last reset never\r\nLocal host: 169.254.24.210, Local port: 1027\r\nForeign host: 169.254.24.209, Foreign port: 179<\/pre>\nBGP State\u304cEstablished\u306b\u306a\u3063\u3066\u3044\u308c\u3070\u63a5\u7d9a\u3067\u304d\u3066\u3044\u307e\u3059\u3002<\/p>\n
<\/p>\n
<\/p>\n
BGP\u30cd\u30a4\u30d0\u30fc\u306e\u30eb\u30fc\u30c8\u78ba\u8a8d<\/p>\n
# show status bgp neighbor 169.254.24.229 received-routes\r\nTotal routes: 1\r\n*: valid route\r\n Network Next Hop Metric LocPrf Path\r\n* 10.0.0.0\/16 169.254.24.229 100 10124 IGP\r\n\r\n\r\n# show status bgp neighbor 169.254.24.209 received-routes\r\nTotal routes: 1\r\n*: valid route\r\n Network Next Hop Metric LocPrf Path\r\n 10.0.0.0\/16 169.254.24.209 200 10124 IGP\r\n<\/pre>\n# show status bgp neighbor 169.254.24.209 advertised-routes\r\nTotal routes: 1\r\n*: valid route\r\n Network Next Hop Metric LocPrf Path\r\n* 192.168.10.0\/24 192.168.10.1 0 IGP\r\n\r\n\r\n# show status bgp neighbor 169.254.24.229 advertised-routes\r\nTotal routes: 1\r\n*: valid route\r\n Network Next Hop Metric LocPrf Path\r\n* 192.168.10.0\/24 192.168.10.1 0 IGP<\/pre>\n\u78ba\u7acb\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
<\/p>\n
\u30eb\u30fc\u30c8\u78ba\u8a8d<\/p>\n
# show ip route\r\n\r\nDestination Gateway Interface Kind Additional Info.\r\ndefault 118.240.212.129 LAN2(DHCP) static\r\n10.0.0.0\/16 169.254.24.229 TUNNEL[1] BGP path=10124\r\n118.240.212.128\/25 xxx.yyy.zzz.aaa LAN2 implicit\r\n169.254.24.208\/30 - TUNNEL[2] implicit\r\n169.254.24.228\/30 - TUNNEL[1] implicit\r\n192.168.10.0\/24 192.168.10.1 LAN1 implicit<\/pre>\n <\/p>\n
AWS VPC VPN\u63a5\u7d9a\u304b\u3089\u306e\u78ba\u8a8d<\/h3>\n
![\"\"](\"https:\/\/sys-guard.com\/contents\/wp-content\/uploads\/2017\/04\/aws_20170429_81.png\")
<\/p>\n
\u3010\u30b5\u30fc\u30d3\u30b9\u3011>> \u3010VPC\u3011>> \u3010VPN\u63a5\u7d9a\u3011>> \u3010\u30c8\u30f3\u30cd\u30eb\u8a73\u7d30\u3011\u3092\u9078\u629e\u3057\u307e\u3059\u3002<\/p>\n
\u30b9\u30c6\u30fc\u30bf\u30b9\u304cUP\u306b\u306a\u3063\u3066\u3044\u308c\u3070\u826f\u3044\u3067\u3059\uff01<\/p>\n
<\/p>\n
AWS\u4e0a\u306eEC2\u306b\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u63a5\u7d9a\u3057\u3088\u3046<\/h4>\n
![\"AWS](\"https:\/\/sys-guard.com\/contents\/wp-content\/uploads\/2017\/04\/aws_11.png\")
<\/p>\n
![\"\"](\"https:\/\/sys-guard.com\/contents\/wp-content\/uploads\/2017\/04\/aws_12_2.png\")
<\/p>\n
EC2\u30b5\u30fc\u30d0\u306b\u30d7\u30e9\u30a4\u30d9\u30fc\u30c8\u30a2\u30c9\u30ec\u30b9\u3067\u63a5\u7d9a\u3059\u308b\u3053\u3068\u3067\u3001\u62e0\u70b9\u9593VPN\u63a5\u7d9a\u304c\u3067\u304d\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u306d\uff5e\u3002<\/p>\n
\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u304c\u7e4b\u304c\u308b\u611f\u899a\u306f\u3068\u3066\u3082\u6c17\u6301\u3061\u304c\u826f\u3044\uff01\u62f3\u3092\u3050\u3063\u3068\u3059\u308b\u9054\u6210\u611f\u3092\u5473\u308f\u3048\u307e\u3059\u3002<\/p>\n
\u4eca\u56de\u306fIPsec\u306b\u3088\u308b\u4eee\u60f3\u9589\u57df\u7db2\u69cb\u6210\u3067\u306e\u3054\u7d39\u4ecb\u3067\u3057\u305f\u304c\u3001\u5c02\u7528\u7dda\u74b0\u5883\u306e\u5834\u5408\u306f\u3001AWS Direct Connect\u3067\u3088\u308a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u9ad8\u3044\u9589\u57df\u7db2\u69cb\u6210\u304c\u4f5c\u308c\u307e\u3059\u3002\u307e\u305f\u3001\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u306f\u74b0\u5883\u306b\u5408\u308f\u305b\u3066\u8a2d\u5b9a\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n
\u304a\u75b2\u308c\u69d8\u3067\u3059\u3002<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u82e5\u8005\u306eRTX1200\u96e2\u308c\u3002 \u305d\u306e\u5bfe\u7b56\u3068\u3057\u3066\u767a\u58f2\u3055\u308c\u305f\uff1fRTX1210\u304c\u4e2d\u5c0f\u30aa\u30d5\u30a3\u30b9\u306e\u8907\u6570\u62e0\u70b9\u9593VPN\u63a5\u7d9a\u6848\u4ef6\u3067\u5927\u6d3b\u8e8d\u3057\u3066\u3044\u307e\u3059\u3002 \u305d\u3093\u306a\u4eca\u56de\u306fAWS\u306b\u62e0\u70b9\u9593VPN\u63a5\u7d9a\u3059\u308bRTX1100\u30eb\u30fc\u30bf\u306e\u8a2d\u5b9a\u3092\u3054\u7d39\u4ecb\u3002RTX1210\u306f70,000\u5186 […]<\/p>\n","protected":false},"author":3,"featured_media":14048,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,66],"tags":[168],"_links":{"self":[{"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/posts\/14044"}],"collection":[{"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/comments?post=14044"}],"version-history":[{"count":0,"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/posts\/14044\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/media\/14048"}],"wp:attachment":[{"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/media?parent=14044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/categories?post=14044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sys-guard.com\/wp-json\/wp\/v2\/tags?post=14044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/sys-guard.com\/contents\/wp-content\/uploads\/2017\/04\/VPN_Basic_Diagram.png\")
<\/p>\n![\"\"](\"https:\/\/sys-guard.com\/contents\/wp-content\/uploads\/2017\/04\/Branch_Offices_diagram.png\")
<\/p>\n![\"AWS](\"https:\/\/sys-guard.com\/contents\/wp-content\/uploads\/2017\/04\/aws_40.png\")
<\/p>\n