#説明
以下スライドの2で行う、directconnect接続の実演に使用するカンニングペーパーです。
http://www.slideshare.net/TomoakiHira/let-us-make-clear-the-aws-directconnect
#実演
##環境確認 (DirectConnect利用者側アカウント)
###VPCの確認
コマンド
aws ec2 describe-vpcs
レスポンス
{
"Vpcs": [
{
"VpcId": "vpc-9968****",
"InstanceTenancy": "default",
"State": "available",
"DhcpOptionsId": "dopt-622a****",
"CidrBlock": "172.31.0.0/16",
"IsDefault": true
}
]
}
###サブネットの確認
コマンド
aws ec2 describe-subnets
レスポンス
{
"Subnets": [
{
"VpcId": "vpc-9968****",
"CidrBlock": "172.31.0.0/20",
"MapPublicIpOnLaunch": true,
"DefaultForAz": true,
"State": "available",
"AvailabilityZone": "ap-northeast-1c",
"SubnetId": "subnet-b509****",
"AvailableIpAddressCount": 4091
},
{
"VpcId": "vpc-9968****",
"CidrBlock": "172.31.16.0/20",
"MapPublicIpOnLaunch": true,
"DefaultForAz": true,
"State": "available",
"AvailabilityZone": "ap-northeast-1a",
"SubnetId": "subnet-4aeb****",
"AvailableIpAddressCount": 4090
}
]
}
###VPNゲートウェイ(仮想ゲートウェイ)の確認
コマンド
aws ec2 describe-vpn-gateways
レスポンス
{
"VpnGateways": [
{
"State": "available",
"Tags": [
{
"Value": "test",
"Key": "Name"
}
],
"Type": "ipsec.1",
"VpnGatewayId": "vgw-abbd****",
"VpcAttachments": [
{
"State": "attached",
"VpcId": "vpc-9968****"
}
]
}
]
}
###ルートテーブルの確認
コマンド
aws ec2 describe-route-tables
レスポンス
{
"RouteTables": [
{
"Associations": [
{
"RouteTableAssociationId": "rtbassoc-02bf****",
"Main": true,
"RouteTableId": "rtb-4998****"
}
],
"RouteTableId": "rtb-4998****",
"VpcId": "vpc-9968****",
"PropagatingVgws": [],
"Tags": [],
"Routes": [
{
"GatewayId": "local",
"DestinationCidrBlock": "172.31.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
},
{
"GatewayId": "igw-aa9b****",
"DestinationCidrBlock": "0.0.0.0/0",
"State": "active",
"Origin": "CreateRoute"
}
]
}
]
}
##コネクションの確認 (DirectConnect管理者側アカウント)
コマンド
aws directconnect describe-connections
レスポンス
{
"connections": [
{
"ownerAccount": "1790********",
"connectionId": "dxcon-********",
"connectionState": "available",
"bandwidth": "10Gbps",
"location": "EqTY2",
"connectionName": "********",
"region": "ap-northeast-1"
},
{
"ownerAccount": "1790********",
"connectionId": "dxcon-********",
"connectionState": "available",
"bandwidth": "10Gbps",
"location": "EqTY2",
"connectionName": "********",
"region": "ap-northeast-1"
}
]
}
##ユーザアカウントにVirtualInterfaceを割当(DirectConnect管理者側アカウント)
コマンド
CONNECTION='dxcon-********'
VIFNAME='NWG-HIRA-BK'
ACCOUNTID='5651********'
VLANID='511'
ROUTERIP='169.254.15.213/30'
AMAZONIP='169.254.15.214/30'
BGPASN='65000'
BGPMD5='fr3gUCLDLS6MQsVLVBw9zgdt'
cat <<ETX
CONNECTION: $CONNECTION
VIFNAME : $VIFNAME
ACCOUNTID : $ACCOUNTID
VLANID : $VLANID
ROUTERIP : $ROUTERIP
AMAZONIP : $AMAZONIP
BGPASN : $BGPASN
BGPMD5 : $BGPMD5
ETX
aws directconnect allocate-private-virtual-interface --connection-id $CONNECTION --owner-account $ACCOUNTID --new-private-virtual-interface-allocation virtualInterfaceName=$VIFNAME,vlan=$VLANID,asn=$BGPASN,authKey=$BGPMD5,amazonAddress=$AMAZONIP,customerAddress=$ROUTERIP
レスポンス
{
"virtualInterfaceState": "confirming",
"asn": 65000,
"vlan": 511,
"customerAddress": "169.254.15.213/30",
"ownerAccount": "5651********",
"connectionId": "dxcon-********",
"virtualInterfaceId": "dxvif-********",
"authKey": "fr3gUCLDLS6MQsVLVBw9zgdt",
"routeFilterPrefixes": [],
"location": "EqTY2",
"customerRouterConfig": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<logical_connection id=\"dxvif-********\">\n <vlan>511</vlan>\n <customer_address>169.254.15.213/30</customer_address>\n <amazon_address>169.254.15.214/30</amazon_address>\n <bgp_asn>65000</bgp_asn>\n <bgp_auth_key>fr3gUCLDLS6MQsVLVBw9zgdt</bgp_auth_key>\n <amazon_bgp_asn>10124</amazon_bgp_asn>\n <connection_type>private</connection_type>\n</logical_connection>\n",
"amazonAddress": "169.254.15.214/30",
"virtualInterfaceType": "private",
"virtualInterfaceName": "NWG-HIRA-BK"
}
##VirtualInterfaceのConfirm (DirectConnectユーザ側アカウント)
コマンド
VGWID=`aws ec2 describe-vpn-gateways | jq .VpnGateways[0].VpnGatewayId | tr -d '\"'`
VIFID=`aws directconnect describe-virtual-interfaces | jq .virtualInterfaces[0].virtualInterfaceId | tr -d '\"'`
cat <<ETX
VGWID: $VGWID
VIFID: $VIFID
ETX
aws directconnect confirm-private-virtual-interface --virtual-interface-id $VIFID --virtual-gateway-id $VGWID
レスポンス
{
"virtualInterfaceState": "pending"
}
追加確認コマンド
watch -n 10 "aws directconnect describe-virtual-interfaces"
レスポンス
{
"virtualInterfaces": [
{
"virtualInterfaceState": "available",
"asn": 65000,
"vlan": 511,
"customerAddress": "169.254.15.213/30",
"ownerAccount": "5651********",
"connectionId": "dxcon-********",
"virtualGatewayId": "vgw-abbd****",
"virtualInterfaceId": "dxvif-********",
"routeFilterPrefixes": [],
"location": "EqTY2",
"amazonAddress": "169.254.15.214/30",
"virtualInterfaceType": "private",
"virtualInterfaceName": "NWG-HIRA-BK"
}
]
}
##その他の設定/確認 (DirectConnectユーザ側アカウント)
###セキュリティグループにてDataCenterNetworkからの着信接続が許可されているか確認
コマンド
aws ec2 describe-security-groups | jq .SecurityGroups[2].IpPermissions[1]
レスポンス
{
"IpProtocol": "-1",
"IpRanges": [
{
"CidrIp": "172.30.100.0/24"
}
],
"UserIdGroupPairs": [],
"PrefixListIds": []
}
###ルートテーブルにてRoutePropagateを有効化
コマンド
RTID=`aws ec2 describe-route-tables | jq .RouteTables[0].RouteTableId | tr -d '\"'`
VGWID=`aws ec2 describe-vpn-gateways | jq .VpnGateways[0].VpnGatewayId | tr -d '\"'`
cat <<ETX
RTID : $RTID
VGWID: $VGWID
ETX
aws ec2 enable-vgw-route-propagation --route-table-id $RTID --gateway-id $VGWID
レスポンス
なし
追加確認コマンド
aws ec2 describe-route-tables
レスポンス
{
"RouteTables": [
{
"Associations": [
{
"RouteTableAssociationId": "rtbassoc-02bf****",
"Main": true,
"RouteTableId": "rtb-4998****"
}
],
"RouteTableId": "rtb-4998****",
"VpcId": "vpc-9968****",
"PropagatingVgws": [
{
"GatewayId": "vgw-abbd****"
}
],
"Tags": [],
"Routes": [
{
"GatewayId": "local",
"DestinationCidrBlock": "172.31.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
},
{
"GatewayId": "igw-aa9b****",
"DestinationCidrBlock": "0.0.0.0/0",
"State": "active",
"Origin": "CreateRoute"
},
{
"GatewayId": "vgw-abbd****",
"DestinationCidrBlock": "172.30.100.0/24",
"State": "active",
"Origin": "EnableVgwRoutePropagation"
}
]
}
]
}
##VirtualInterfaceの削除 (DirectConnectユーザ側アカウント)
コマンド
VIFID=`aws directconnect describe-virtual-interfaces | jq .virtualInterfaces[0].virtualInterfaceId | tr -d '\"'`
cat <<ETX
VIFID: $VIFID
ETX
aws directconnect delete-virtual-interface --virtual-interface-id $VIFID
レスポンス
{
"virtualInterfaceState": "deleting"
}
追加確認コマンド
aws directconnect describe-virtual-interfaces
レスポンス
{
"virtualInterfaces": [
{
"virtualInterfaceState": "deleted",
"asn": 65000,
"vlan": 511,
"customerAddress": "169.254.15.213/30",
"ownerAccount": "5651********",
"connectionId": "dxcon-********",
"virtualGatewayId": "vgw-abbd****",
"virtualInterfaceId": "dxvif-********",
"routeFilterPrefixes": [],
"location": "EqTY2",
"amazonAddress": "169.254.15.214/30",
"virtualInterfaceType": "private",
"virtualInterfaceName": "NWG-HIRA-BK"
}
]
}