! Amazon Web Services
! Virtual Private Cloud

! AWS utilizes unique identifiers to manipulate the configuration of 
! a VPN Connection. Each VPN Connection is assigned an identifier and is 
! associated with two other identifiers, namely the 
! Customer Gateway Identifier and Virtual Private Gateway Identifier.
!
! Your VPN Connection ID          : vpn-xxxxxxxxxxx
! Your Virtual Private Gateway ID         : vgw-xxxxxxxxxxx
! Your Customer Gateway ID        : cgw-xxxxxxxxxxx
!
!
! This configuration consists of two tunnels. Both tunnels must be 
! configured on your Customer Gateway.
!
! --------------------------------------------------------------------------------
! IPSec Tunnel #1
! --------------------------------------------------------------------------------
! #1: Internet Key Exchange (IKE) Configuration
!
! A policy is established for the supported ISAKMP encryption, 
! authentication, Diffie-Hellman, lifetime, and key parameters.
!
! Note that there are a global list of ISAKMP policies, each identified by 
! sequence number. This policy is defined as #200, which may conflict with
! an existing policy using the same number. If so, we recommend changing 
! the sequence number to avoid conflicts.
!
crypto isakmp policy 200
  encryption aes 128
  authentication pre-share
  group 2
  lifetime 28800
  hash sha
exit

! The ISAKMP keyring stores the Pre Shared Key used to authenticate the 
! tunnel endpoints.
!
crypto keyring keyring-vpn-xxxxxxxxxxx-0
  local-address <CiscoのプライベートIPアドレス>
  pre-shared-key address xxxxxxxxxxx key xxxxxxxxxxx
exit

! An ISAKMP profile is used to associate the keyring with the particular 
! endpoint.
!
crypto isakmp profile isakmp-vpn-xxxxxxxxxxx-0
  local-address <CiscoのプライベートIPアドレス>
  match identity address xxxxxxxxxxx
  keyring keyring-vpn-xxxxxxxxxxx-0
exit

! #2: IPSec Configuration
! 
! The IPSec transform set defines the encryption, authentication, and IPSec
! mode parameters.
!
crypto ipsec transform-set ipsec-prop-vpn-xxxxxxxxxxx-0 esp-aes 128 esp-sha-hmac 
  mode tunnel
exit

! The IPSec profile references the IPSec transform set and further defines
! the Diffie-Hellman group and security association lifetime.
!
crypto ipsec profile ipsec-vpn-xxxxxxxxxxx-0
  set pfs group2
  set security-association lifetime seconds 3600
  set transform-set ipsec-prop-vpn-xxxxxxxxxxx-0
exit

! Additional parameters of the IPSec configuration are set here. Note that 
! these parameters are global and therefore impact other IPSec 
! associations.
! This option instructs the router to clear the "Don't Fragment" 
! bit from packets that carry this bit and yet must be fragmented, enabling
! them to be fragmented.
!
crypto ipsec df-bit clear

! This option enables IPSec Dead Peer Detection, which causes periodic
! messages to be sent to ensure a Security Association remains operational.
!
crypto isakmp keepalive 10 10 on-demand

! This configures the gateway's window for accepting out of order
! IPSec packets. A larger window can be helpful if too many packets 
! are dropped due to reordering while in transit between gateways.
!
crypto ipsec security-association replay window-size 128

! This option instructs the router to fragment the unencrypted packets
! (prior to encryption).
!
crypto ipsec fragmentation before-encryption


! --------------------------------------------------------------------------------
! #3: Tunnel Interface Configuration
!  
! A tunnel interface is configured to be the logical interface associated  
! with the tunnel. All traffic routed to the tunnel interface will be 
! encrypted and transmitted to the VPC. Similarly, traffic from the VPC
! will be logically received on this interface.
!
! Association with the IPSec security association is done through the 
! "tunnel protection" command.
!
! The address of the interface is configured with the setup for your 
! Customer Gateway.  If the address changes, the Customer Gateway and VPN 
! Connection must be recreated with Amazon VPC.
!
interface Tunnel1
  ip address xxxxxxxxxxx 255.255.255.252
  ip virtual-reassembly
  tunnel source <CiscoのプライベートIPアドレス>
  tunnel destination xxxxxxxxxxx 
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile ipsec-vpn-xxxxxxxxxxx-0
  ! This option causes the router to reduce the Maximum Segment Size of
  ! TCP packets to prevent packet fragmentation.
  ip tcp adjust-mss 1387 
  no shutdown
exit

! ----------------------------------------------------------------------------
! #4 Static Route Configuration
!
! Your Customer Gateway needs to set a static route for the prefix corresponding to your 
! VPC to send traffic over the tunnel interface.
! An example for a VPC with the prefix 10.0.0.0/16 is provided below:
! ip route 10.0.0.0 255.255.0.0 Tunnel1 track 100 
!
! SLA Monitor is used to provide a failover between the two tunnels. If the primary tunnel fails, the redundant tunnel will automatically be used
! This sla is defined as #100, which may conflict with an existing sla using same number. 
! If so, we recommend changing the sequence number to avoid conflicts.
!
ip sla 100
   icmp-echo xxxxxxxxxxx source-interface Tunnel1
   timeout 1000
   frequency 5
exit
ip sla schedule 100  life forever start-time now
track 100 ip sla 100 reachability 
! --------------------------------------------------------------------------------
! --------------------------------------------------------------------------------
! IPSec Tunnel #2
! --------------------------------------------------------------------------------
! #1: Internet Key Exchange (IKE) Configuration
!
! A policy is established for the supported ISAKMP encryption, 
! authentication, Diffie-Hellman, lifetime, and key parameters.
!
! Note that there are a global list of ISAKMP policies, each identified by 
! sequence number. This policy is defined as #201, which may conflict with
! an existing policy using the same number. If so, we recommend changing 
! the sequence number to avoid conflicts.
!
crypto isakmp policy 201
  encryption aes 128
  authentication pre-share
  group 2
  lifetime 28800
  hash sha
exit

! The ISAKMP keyring stores the Pre Shared Key used to authenticate the 
! tunnel endpoints.
!
crypto keyring keyring-vpn-xxxxxxxxxxx-1
  local-address <CiscoのプライベートIPアドレス>
  pre-shared-key address xxxxxxxxxxx key xxxxxxxxxxx
exit

! An ISAKMP profile is used to associate the keyring with the particular 
! endpoint.
!
crypto isakmp profile isakmp-vpn-xxxxxxxxxxx-1
  local-address <CiscoのプライベートIPアドレス>
  match identity address xxxxxxxxxxx
  keyring keyring-vpn-xxxxxxxxxxx-1
exit

! #2: IPSec Configuration
! 
! The IPSec transform set defines the encryption, authentication, and IPSec
! mode parameters.
!
crypto ipsec transform-set ipsec-prop-vpn-xxxxxxxxxxx-1 esp-aes 128 esp-sha-hmac 
  mode tunnel
exit

! The IPSec profile references the IPSec transform set and further defines
! the Diffie-Hellman group and security association lifetime.
!
crypto ipsec profile ipsec-vpn-xxxxxxxxxxx-1
  set pfs group2
  set security-association lifetime seconds 3600
  set transform-set ipsec-prop-vpn-xxxxxxxxxxx-1
exit

! Additional parameters of the IPSec configuration are set here. Note that 
! these parameters are global and therefore impact other IPSec 
! associations.
! This option instructs the router to clear the "Don't Fragment" 
! bit from packets that carry this bit and yet must be fragmented, enabling
! them to be fragmented.
!
crypto ipsec df-bit clear

! This option enables IPSec Dead Peer Detection, which causes periodic
! messages to be sent to ensure a Security Association remains operational.
!
crypto isakmp keepalive 10 10 on-demand

! This configures the gateway's window for accepting out of order
! IPSec packets. A larger window can be helpful if too many packets 
! are dropped due to reordering while in transit between gateways.
!
crypto ipsec security-association replay window-size 128

! This option instructs the router to fragment the unencrypted packets
! (prior to encryption).
!
crypto ipsec fragmentation before-encryption


! --------------------------------------------------------------------------------
! #3: Tunnel Interface Configuration
!  
! A tunnel interface is configured to be the logical interface associated  
! with the tunnel. All traffic routed to the tunnel interface will be 
! encrypted and transmitted to the VPC. Similarly, traffic from the VPC
! will be logically received on this interface.
!
! Association with the IPSec security association is done through the 
! "tunnel protection" command.
!
! The address of the interface is configured with the setup for your 
! Customer Gateway.  If the address changes, the Customer Gateway and VPN 
! Connection must be recreated with Amazon VPC.
!
interface Tunnel2
  ip address xxxxxxxxxxx 255.255.255.252
  ip virtual-reassembly
  tunnel source <CiscoのプライベートIPアドレス>
  tunnel destination xxxxxxxxxxx
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile ipsec-vpn-xxxxxxxxxxx-1
  ! This option causes the router to reduce the Maximum Segment Size of
  ! TCP packets to prevent packet fragmentation.
  ip tcp adjust-mss 1387 
  no shutdown
exit

! ----------------------------------------------------------------------------
! #4 Static Route Configuration
!
! Your Customer Gateway needs to set a static route for the prefix corresponding to your 
! VPC to send traffic over the tunnel interface.
! An example for a VPC with the prefix 10.0.0.0/16 is provided below:
! ip route 10.0.0.0 255.255.0.0 Tunnel2 track 200 
!
! SLA Monitor is used to provide a failover between the two tunnels. If the primary tunnel fails, the redundant tunnel will automatically be used
! This sla is defined as #200, which may conflict with an existing sla using same number. 
! If so, we recommend changing the sequence number to avoid conflicts.
!
ip sla 200
   icmp-echo 169.254.25.21 source-interface Tunnel2
   timeout 1000
   frequency 5
exit
ip sla schedule 200  life forever start-time now
track 200 ip sla 200 reachability 
! --------------------------------------------------------------------------------


! Additional Notes and Questions
!  - Amazon Virtual Private Cloud Getting Started Guide: 
!       http://docs.amazonwebservices.com/AmazonVPC/latest/GettingStartedGuide
!  - Amazon Virtual Private Cloud Network Administrator Guide: 
!       http://docs.amazonwebservices.com/AmazonVPC/latest/NetworkAdminGuide
!  - XSL Version: 2009-07-15-1119716