#■ 目的
AWS の Transit Gateway(TGW)を使用すれば、複数の VPC および Direct Connect(DX) や IPSec VPNを使用してオンプレミスネットワークを相互接続できます。
ということで、Transit Gateway(TGW)経由で、On-Premises や他Cloudへ接続してみてみたいので、
まずは、Transit Gateway で On-Premises と２つの AWS VPCへ IPSec VPN 接続してみてみます。
#■ 構成
事前にVPCやEC2インスタンスを作成しておきます。
ここでは、Transit GatewayとIPSec VPN接続部分を設定します
#■ Transit Gateway作成
##● Trangit Gateway作成
(1) Trangit Gateway画面
[サービス] > [VPC] > [Trangit Gateway] をクリックし、[Create Transit Gateway]をクリック
(2) Create Transit Gateway設定画面
以下内容を設定し、[Create Transit Gateway]をクリック
・Amazon Side ASN: ここでは他と重複しないPrivate ASN 64512 を設定
・DNS support: チェックする
・VPN ECMP support: チェックする
・Default table associateion: チェックする
・Default route table propagation: チェックする
(3) Create Transit Gateway request succeeded
[Close]をクリック
(4) Transit Gateway作成完了
"state" が"avalable"になれば作成完了
#■ Transit Gateway接続
##● Transit Gateway - VPN接続
(1) Transit Gateway接続画面
左ペインから[Transit Gateway接続]をクリックし、[Create Transit Gateway Attach]をクリック
(2) Create Transit Gateway Attachment設定画面
以下内容を設定し、[Create Attachment]をクリック
・Transit Gateway ID: 作成したTransit Gateway を選択
・Attachment type: [VPN]を選択
・Customer Gateway: [New]を選択
・IP Address: On-Premises側CPE(YAMAHA ルーター)のPublic IPを設定
・BGP ASN: On-Premises側CPE(YAMAHA ルーター)のBGP ASN "65000" を設定
・Routing option: Dynamic (requires BGP)を選択
(3) Create Transit Gateway Attachment request succeeded
[Close]をクリック
(4) Transit Gateway接続完了
"state" が"avalable"になれば作成完了
##● Transit Gateway - VPC接続
今回、２つのVPC(172.31.0.0/16と172.32.0.0/16)を接続するので、以下手順を二回実施
(1) Transit Gateway接続画面
左ペインから[Transit Gateway接続]をクリックし、[Create Transit Gateway Attach]をクリック
(2) Create Transit Gateway Attachment設定画面
以下内容を設定し、[Create Attachment]をクリック
・Transit Gateway ID: 作成したTransit Gateway を選択
・Attachment type: [VPC]を選択
・DNS supported: [enable]
・VPC ID: 接続するVPCを選択
・Subnet IDs: VPC-172.31.0.0/16内にあるSubnetを選択
(3) Create Transit Gateway Attachment request succeeded
[Close]をクリック
(4) Transit Gateway接続完了
"state" が "available"になれば作成完了
#■ VPN接続作成
(1) サイト間のVPN接続
左ペインから、[サイト間のVPN接続]をクリックし、[VPN接続の作成]をクリック
(2) VPN接続の作成
以下内容を設定し、[Create Attachment]をクリック
・Trangit Gateway Type: [Transit Gateway]を選択
・Trangit Gateway ID: 作成したTrangit Gatewayを選択
・カスタマーゲートウェイ: [既存]を選択
・Customer Gateway ID: Create Transit Gateway Attachmentで作成したustomer Gatewayを選択
・ルーテングオプション: [動的(BGPが必要)]を選択
・Tunnel Insede Ip Version: [IPv4]を選択
(3) 設定のダウンロード
[設定のダウンロード]をクリック
(4) 設定のダウンロード破面
以下内容を設定し、[ダウンロード]をクリック
・ベンダー: [Yamaha]を選択
・プラットフォーム: [RTX Router]を選択
・ソフトウェア: [Rev 10]以上を選択
(5) 設定ファイル確認
ダウンロードしたファイルを確認して、必要に応じて修正
# Amazon Web Services
# Virtual Private Cloud
# AWS utilizes unique identifiers to manage the configuration of
# a VPN Connection. Each VPN Connection is assigned an identifier and is
# associated with two other identifiers, namely the
# Customer Gateway Identifier and Virtual Private Gateway Identifier.
#
# Your VPN Connection ID : vpn-0235b882c3da03565
# Your Virtual Private Gateway ID :
# Your Customer Gateway ID : cgw-01dd21a44b2318a59
#
#
# This configuration consists of two tunnels. Both tunnels must be
# configured on your Customer Gateway.
#
# --------------------------------------------------------------------------------
# IPSec Tunnel #1
# --------------------------------------------------------------------------------
# #1: Internet Key Exchange (IKE) Configuration
#
# A policy is established for the supported ISAKMP encryption,
# authentication, Diffie-Hellman, lifetime, and key parameters.
#
# Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2.
# Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
# You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24.
# NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
#
# Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
# The address of the external interface for your customer gateway must be a static address.
# Your customer gateway may reside behind a device performing network address translation (NAT).
# To ensure that NAT traversal (NAT-T) can function, you must adjust your firewall !rules to unblock UDP port 4500. If not behind NAT, we recommend disabling NAT-T.
#
tunnel select 1
ipsec ike encryption 1 aes-cbc
ipsec ike group 1 modp1024
ipsec ike hash 1 sha
# This line stores the Pre Shared Key used to authenticate the
# tunnel endpoints.
#
ipsec ike pre-shared-key 1 text Password01
# #2: IPSec Configuration
# The IPSec policy defines the encryption, authentication, and IPSec
# mode parameters.
# Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
# Please note, you may use these additionally supported IPSec parameters for encryption like AES256 and other DH groups like 2, 5, 14-18, 22, 23, and 24.
# NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
#
# Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
#
# Note that there are a global list of IPSec policies, each identified by
# sequence number. This policy is defined as #201, which may conflict with
# an existing policy using the same number. If so, we recommend changing
# the sequence number to avoid conflicts.
#
ipsec tunnel 201
ipsec sa policy 201 1 esp aes-cbc sha-hmac
# The IPSec profile references the IPSec policy and further defines
# the Diffie-Hellman group and security association lifetime.
ipsec ike duration ipsec-sa 1 3600
ipsec ike pfs 1 on
# Additional parameters of the IPSec configuration are set here. Note that
# these parameters are global and therefore impact other IPSec
# associations.
# This option instructs the router to clear the "Don't Fragment"
# bit from packets that carry this bit and yet must be fragmented, enabling
# them to be fragmented.
#
ipsec tunnel outer df-bit clear
# This option enables IPSec Dead Peer Detection, which causes periodic
# messages to be sent to ensure a Security Association remains operational.
ipsec ike keepalive use 1 on dpd 10 3
# --------------------------------------------------------------------------------
# #3: Tunnel Interface Configuration
#
# A tunnel interface is configured to be the logical interface associated
# with the tunnel. All traffic routed to the tunnel interface will be
# encrypted and transmitted to the VPC. Similarly, traffic from the VPC
# will be logically received on this interface.
#
# The address of the interface is configured with the setup for your
# Customer Gateway. If the address changes, the Customer Gateway and VPN
# Connection must be recreated with Amazon VPC.
#
ipsec ike local address 1 100.100.100.101
# If you are using NAT(IP masquerade) on this device, then you should specify the private IP address for the argument:
# ipsec ike local address <CGW local IP address>
# Please specify the same local IP address for the 'nat descriptor masquerade' commands:
# nat descriptor address inner 1 <CGW local IP address range>
# nat descriptor masquerade static 1 1 <CGW local IP address> udp 500
# nat descriptor masquerade static 1 2 <CGW local IP address> esp *
#
# For more information, please refer: http://www.rtpro.yamaha.co.jp/RT/docs/ipsec/nat.html
#
ipsec ike remote address 1 200.200.200.201
ip tunnel address 169.254.154.138/30
ip tunnel remote address 169.254.154.137
ipsec ike local id 1 0.0.0.0/0
ipsec ike remote id 1 0.0.0.0/0
# This option causes the router to reduce the Maximum Segment Size of
# TCP packets to prevent packet fragmentation
ip tunnel tcp mss limit 1379
tunnel enable 1
tunnel select none
ipsec auto refresh on
# --------------------------------------------------------------------------------
# --------------------------------------------------------------------------------
# #4: Border Gateway Protocol (BGP) Configuration
#
# BGP is used within the tunnel to exchange prefixes between the
# Virtual Private Gateway and your Customer Gateway. The Virtual Private Gateway
# will announce the prefix corresponding to your VPC.
#
# The BGP timers are adjusted to provide more rapid detection of outages.
#
# The local BGP Autonomous System Number (ASN) (65000) is configured
# as part of your Customer Gateway. If the ASN must be changed, the
# Customer Gateway and VPN Connection will need to be recreated with AWS.
#
bgp use on
bgp autonomous-system 65000
bgp neighbor 1 64512 169.254.154.137 hold-time=30 local-address=169.254.154.138
# To advertise additional prefixes to Amazon VPC, copy the 'import filter' statement and
# identify the prefix you wish to advertise. Make sure the
# prefix is present in the routing table of the device with a valid next-hop.
# For example, the following two lines will advertise 192.168.0.0/16 and 10.0.0.0/16 to Amazon VPC
#
# bgp import filter 1 equal 10.0.0.0/16
# bgp import filter 1 equal 192.168.0.0/16
#
bgp import filter 1 equal 0.0.0.0/0
bgp import 64512 static filter 1
bgp configure refresh
# --------------------------------------------------------------------------------
# IPSec Tunnel #2
# --------------------------------------------------------------------------------
# #1: Internet Key Exchange (IKE) Configuration
#
# A policy is established for the supported ISAKMP encryption,
# authentication, Diffie-Hellman, lifetime, and key parameters.
#
# Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2.
# Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
# You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24.
# NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
#
# Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
# The address of the external interface for your customer gateway must be a static address.
# Your customer gateway may reside behind a device performing network address translation (NAT).
# To ensure that NAT traversal (NAT-T) can function, you must adjust your firewall !rules to unblock UDP port 4500. If not behind NAT, we recommend disabling NAT-T.
#
tunnel select 2
ipsec ike encryption 2 aes-cbc
ipsec ike group 2 modp1024
ipsec ike hash 2 sha
# This line stores the Pre Shared Key used to authenticate the
# tunnel endpoints.
#
ipsec ike pre-shared-key 2 text Password02
# #2: IPSec Configuration
# The IPSec policy defines the encryption, authentication, and IPSec
# mode parameters.
# Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
# Please note, you may use these additionally supported IPSec parameters for encryption like AES256 and other DH groups like 2, 5, 14-18, 22, 23, and 24.
# NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
#
# Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
#
# Note that there are a global list of IPSec policies, each identified by
# sequence number. This policy is defined as #202, which may conflict with
# an existing policy using the same number. If so, we recommend changing
# the sequence number to avoid conflicts.
#
ipsec tunnel 202
ipsec sa policy 202 2 esp aes-cbc sha-hmac
# The IPSec profile references the IPSec policy and further defines
# the Diffie-Hellman group and security association lifetime.
ipsec ike duration ipsec-sa 2 3600
ipsec ike pfs 2 on
# Additional parameters of the IPSec configuration are set here. Note that
# these parameters are global and therefore impact other IPSec
# associations.
# This option instructs the router to clear the "Don't Fragment"
# bit from packets that carry this bit and yet must be fragmented, enabling
# them to be fragmented.
#
ipsec tunnel outer df-bit clear
# This option enables IPSec Dead Peer Detection, which causes periodic
# messages to be sent to ensure a Security Association remains operational.
ipsec ike keepalive use 2 on dpd 10 3
# --------------------------------------------------------------------------------
# #3: Tunnel Interface Configuration
#
# A tunnel interface is configured to be the logical interface associated
# with the tunnel. All traffic routed to the tunnel interface will be
# encrypted and transmitted to the VPC. Similarly, traffic from the VPC
# will be logically received on this interface.
#
# The address of the interface is configured with the setup for your
# Customer Gateway. If the address changes, the Customer Gateway and VPN
# Connection must be recreated with Amazon VPC.
#
ipsec ike local address 2 100.100.100.101
# If you are using NAT(IP masquerade) on this device, then you should specify the private IP address for the argument:
# ipsec ike local address <CGW local IP address>
# Please specify the same local IP address for the 'nat descriptor masquerade' commands:
# nat descriptor address inner 1 <CGW local IP address range>
# nat descriptor masquerade static 1 1 <CGW local IP address> udp 500
# nat descriptor masquerade static 1 2 <CGW local IP address> esp *
#
# For more information, please refer: http://www.rtpro.yamaha.co.jp/RT/docs/ipsec/nat.html
#
ipsec ike remote address 2 200.200.200.202
ip tunnel address 169.254.141.154/30
ip tunnel remote address 169.254.141.153
ipsec ike local id 2 0.0.0.0/0
ipsec ike remote id 2 0.0.0.0/0
# This option causes the router to reduce the Maximum Segment Size of
# TCP packets to prevent packet fragmentation
ip tunnel tcp mss limit 1379
tunnel enable 2
tunnel select none
ipsec auto refresh on
# --------------------------------------------------------------------------------
# --------------------------------------------------------------------------------
# #4: Border Gateway Protocol (BGP) Configuration
#
# BGP is used within the tunnel to exchange prefixes between the
# Virtual Private Gateway and your Customer Gateway. The Virtual Private Gateway
# will announce the prefix corresponding to your VPC.
#
# The BGP timers are adjusted to provide more rapid detection of outages.
#
# The local BGP Autonomous System Number (ASN) (65000) is configured
# as part of your Customer Gateway. If the ASN must be changed, the
# Customer Gateway and VPN Connection will need to be recreated with AWS.
#
bgp use on
bgp autonomous-system 65000
bgp neighbor 2 64512 169.254.141.153 hold-time=30 local-address=169.254.141.154
# To advertise additional prefixes to Amazon VPC, copy the 'import filter' statement and
# identify the prefix you wish to advertise. Make sure the
# prefix is present in the routing table of the device with a valid next-hop.
# For example, the following two lines will advertise 192.168.0.0/16 and 10.0.0.0/16 to Amazon VPC
#
# bgp import filter 1 equal 10.0.0.0/16
# bgp import filter 1 equal 192.168.0.0/16
#
bgp import filter 1 equal 0.0.0.0/0
bgp import 64512 static filter 1
bgp configure refresh
# Additional Notes and Questions
# - Amazon Virtual Private Cloud Getting Started Guide:
# http://docs.amazonwebservices.com/AmazonVPC/latest/GettingStartedGuide
# - Amazon Virtual Private Cloud Network Administrator Guide:
# http://docs.amazonwebservices.com/AmazonVPC/latest/NetworkAdminGuide
# - Yamaha router's manual:
# http://www.rtpro.yamaha.co.jp/RT/docs/amazon-vpc/index.html
# - Yamaha router's NAT settings in IPsec:
# http://www.rtpro.yamaha.co.jp/RT/docs/ipsec/nat.html
# - XSL Version: 2009-07-15-1119716
#■ YAMAHA NVR700W 設定
##● 初期設定確認
YAMAHA NVR700WをInternet接続できるように事前設定しておきます
# show config
# NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
# MAC Address : 00:a0:de:b3:32, 00:a0:de:b3:33
# Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
# main: NVR700W ver=00 serial=TESTSERIAL
# Reporting Date: Aug 16 18:01:51 2020
console character en.ascii
ip route default gateway pdp wan1
ip lan1 address 192.168.0.1/24
ip wan1 address pdp
ip wan1 nat descriptor 31000
wan1 bind wwan 1
wwan select 1
description wwan Sim
wwan always-on on
wwan auth accept chap
wwan auth myname sim@pass sim
wwan auto connect on
wwan disconnect time off
wwan disconnect input time off
wwan disconnect output time off
wwan access-point name sim.jp
wwan access limit length off
wwan access limit time off
wwan enable 1
ip filter 500000 restrict * * * * *
nat descriptor type 31000 masquerade
nat descriptor address outer 31000 primary
telnetd host lan
dhcp service server
dhcp server rfc2131 compliant except remain-silent
dhcp scope 1 192.168.0.2-192.168.0.191/24
dns host lan1
dns server pdp wan1
dns server select 500401 pdp wan1 any .
dns private address spoof on
dns private name setup.netvolante.jp
analog supplementary-service pseudo call-waiting
analog extension dial prefix sip prefix="9#"
statistics traffic on
wwan-module use on
##● IPSec VPN設定
ダウンロードしたファイルから、以下情報をYAMAHA NVR700Wへ設定
(1) Tunnel1設定
tunnel select 1
ipsec ike encryption 1 aes-cbc
ipsec ike group 1 modp1024
ipsec ike hash 1 sha
ipsec ike pre-shared-key 1 text Password01
ipsec tunnel 201
ipsec sa policy 201 1 esp aes-cbc sha-hmac
ipsec ike duration ipsec-sa 1 3600
ipsec ike pfs 1 on
ipsec tunnel outer df-bit clear
ipsec ike keepalive use 1 on dpd 10 3
ipsec ike local address 1 100.100.100.101
ipsec ike remote address 1 200.200.200.201
ip tunnel address 169.254.154.138/30
ip tunnel remote address 169.254.154.137
ipsec ike local id 1 0.0.0.0/0
ipsec ike remote id 1 0.0.0.0/0
ip tunnel tcp mss limit 1379
tunnel enable 1
tunnel select none
ipsec auto refresh on
(2) Tunnel2設定
tunnel select 2
ipsec ike encryption 2 aes-cbc
ipsec ike group 2 modp1024
ipsec ike hash 2 sha
ipsec ike pre-shared-key 2 text PassoPasswordwrd02
ipsec tunnel 202
ipsec sa policy 202 2 esp aes-cbc sha-hmac
ipsec ike duration ipsec-sa 2 3600
ipsec ike pfs 2 on
ipsec tunnel outer df-bit clear
ipsec ike keepalive use 2 on dpd 10 3
ipsec ike local address 2 100.100.100.101
ipsec ike remote address 2 200.200.200.202
ip tunnel address 169.254.141.154/30
ip tunnel remote address 169.254.141.153
ipsec ike local id 2 0.0.0.0/0
ipsec ike remote id 2 0.0.0.0/0
ip tunnel tcp mss limit 1379
tunnel enable 2
tunnel select none
ipsec auto refresh on
(3) BGP設定
bgp use on
bgp autonomous-system 65000
bgp neighbor 1 64512 169.254.154.137 hold-time=30 local-address=169.254.154.138
bgp neighbor 2 64512 169.254.141.153 hold-time=30 local-address=169.254.141.154
bgp import filter 1 equal 0.0.0.0/0
bgp import 64512 static filter 1
bgp configure refresh
##● IPSec設定反映
# ipsec auto refresh on
# show ipsec sa
Total: isakmp:2 send:2 recv:2
sa sgw isakmp connection dir life[s] remote-id
----------------------------------------------------------------------------
1 1 - isakmp - 28736 200.200.200.201
2 1 1 tun[0001]esp send 3538 200.200.200.201
3 1 1 tun[0001]esp recv 3538 200.200.200.201
4 2 - isakmp - 28762 200.200.200.202
5 2 4 tun[0002]esp send 3564 200.200.200.202
6 2 4 tun[0002]esp recv 3564 200.200.200.202
##● BGP設定反映
# bgp configure refresh
##● BGP伝搬確認
AWS側CIDRが受信されていることを確認
# show ip route
Destination Gateway Interface Kind Additional Info.
default 100.100.100.100 WAN1(PDP) static
169.254.141.152/30 - TUNNEL[2] implicit
169.254.154.136/30 - TUNNEL[1] implicit
172.31.0.0/16 169.254.141.153 TUNNEL[2] BGP path=64512
172.32.0.0/16 169.254.141.153 TUNNEL[2] BGP path=64512
192.168.0.0/24 192.168.0.1 LAN1 implicit
100.0.0.0/8 100.100.100.101 WAN1 implicit
#■ IPSec 接続ステータス確認
##● YAMAHA NVR700W画面
接続状態が、UPしていることを確認
#■ AWS Route Table 設定
VPCからTransitGWを経由して外部へ通信できるようにRoute Tableを設定
##● VPC-172.31.0.0 Route設定
以下のように、OnPremises(192.168.0.0/24), 他VPC-172.32.0.0等へ通信がTransitGWを経由して通るようにRouteを設定
##● VPC-172.32.0.0 Route設定
以下のように、OnPremises(192.168.0.0/24), 他VPC-172.31.0.0等へ通信がTransitGWを経由して通るようにRouteを設定
#■ 接続確認
##● On-Premises --> AWS Instance01
###・ping疎通確認
[onp@MacBook:~] $ ping 172.31 -c 3
PING 172.31.0.11 (172.31.0.11) 56(84) bytes of data.
64 bytes from 172.31.0.11: icmp_seq=1 ttl=61 time=218 ms
64 bytes from 172.31.0.11: icmp_seq=2 ttl=61 time=218 ms
64 bytes from 172.31.0.11: icmp_seq=3 ttl=61 time=217 ms
--- 172.31.0.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 217.963/218.257/218.808/0.665 ms
###・traceroute経路確認
[onp@MacBook:~] $ sudo traceroute -I 172.31.0.11
traceroute to 172.31.0.11 (172.31.0.11), 30 hops max, 60 byte packets
1 setup.netvolante.jp (192.168.0.1) 0.261 ms 0.285 ms 0.225 ms
2 * * *
3 172.31.0.11 (172.31.0.11) 253.438 ms 253.383 ms 257.427 ms
###・ssh接続確認
[onp@MacBook:~] $ ssh -i AWS_EC2.pem ec2-user@172.31.0.11 hostname
ip-172-31-0-11.ec2.internal
##● On-Premises --> AWS Instance02
###・ping疎通確認
[onp@MacBook:~] $ ping 172.32.0.22 -c 3
PING 172.32.0.22 (172.32.0.22) 56(84) bytes of data.
64 bytes from 172.32.0.22: icmp_seq=1 ttl=252 time=230 ms
64 bytes from 172.32.0.22: icmp_seq=2 ttl=252 time=219 ms
64 bytes from 172.32.0.22: icmp_seq=3 ttl=252 time=219 ms
--- 172.32.0.22 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 219.414/223.145/230.588/5.276 ms
###・traceroute経路確認
[onp@MacBook:~] $ sudo traceroute -I 172.32.0.22
traceroute to 172.32.0.22 (172.32.0.22), 30 hops max, 60 byte packets
1 setup.netvolante.jp (192.168.0.1) 0.398 ms 0.273 ms 0.241 ms
2 * * *
3 172.32.0.22 (172.32.0.22) 242.235 ms 242.222 ms 248.701 ms
###・ssh接続確認
[onp@MacBook:~] $ ssh -i AWS_EC2.pem ec2-user@172.32.0.22 hostname
ip-172-32-0-22.ec2.internal
#■ Yamaha NVR700W最終config
# show config
# NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
# MAC Address : 00:a0:de:b3:32, 00:a0:de:b3:33
# Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
# main: NVR700W ver=00 serial=TESTSERIAL
# Reporting Date: Aug 20 22:01:02 2020
console character en.ascii
ip route default gateway pdp wan1
ip lan1 address 192.168.0.1/24
ip wan1 address pdp
ip wan1 nat descriptor 31000
wan1 bind wwan 1
wwan select 1
description wwan Sim
wwan always-on on
wwan auth accept chap
wwan auth myname sim@pass sim
wwan auto connect on
wwan disconnect time off
wwan disconnect input time off
wwan disconnect output time off
wwan access-point name sim.jp
wwan access limit length off
wwan access limit time off
wwan enable 1
tunnel select 1
ipsec tunnel 201
ipsec sa policy 201 1 esp aes-cbc sha-hmac
ipsec ike duration ipsec-sa 1 3600
ipsec ike encryption 1 aes-cbc
ipsec ike group 1 modp1024
ipsec ike hash 1 sha
ipsec ike keepalive use 1 on dpd 10 3
ipsec ike local address 1 100.100.100.101
ipsec ike local id 1 0.0.0.0/0
ipsec ike pfs 1 on
ipsec ike pre-shared-key 1 text Password01
ipsec ike remote address 1 200.200.200.201
ipsec ike remote id 1 0.0.0.0/0
ipsec tunnel outer df-bit clear
ip tunnel address 169.254.154.138/30
ip tunnel remote address 169.254.154.137
ip tunnel tcp mss limit 1379
tunnel enable 1
tunnel select 2
ipsec tunnel 202
ipsec sa policy 202 2 esp aes-cbc sha-hmac
ipsec ike duration ipsec-sa 2 3600
ipsec ike encryption 2 aes-cbc
ipsec ike group 2 modp1024
ipsec ike hash 2 sha
ipsec ike keepalive use 2 on dpd 10 3
ipsec ike local address 2 100.100.100.101
ipsec ike local id 2 0.0.0.0/0
ipsec ike pfs 2 on
ipsec ike pre-shared-key 2 text Password02
ipsec ike remote address 2 200.200.200.202
ipsec ike remote id 2 0.0.0.0/0
ipsec tunnel outer df-bit clear
ip tunnel address 169.254.141.154/30
ip tunnel remote address 169.254.141.153
ip tunnel tcp mss limit 1379
tunnel enable 2
ip filter 500000 restrict * * * * *
nat descriptor type 31000 masquerade
nat descriptor address outer 31000 primary
bgp use on
bgp autonomous-system 65000
bgp neighbor 1 64512 169.254.154.137 hold-time=30 local-address=169.254.154.138
bgp neighbor 2 64512 169.254.141.153 hold-time=30 local-address=169.254.141.154
bgp import filter 1 equal 0.0.0.0/0
bgp import 64512 static filter 1
ipsec auto refresh on
telnetd host lan
dhcp service server
dhcp server rfc2131 compliant except remain-silent
dhcp scope 1 192.168.0.2-192.168.0.191/24
dns host lan1
dns server pdp wan1
dns server select 500401 pdp wan1 any .
dns private address spoof on
dns private name setup.netvolante.jp
analog supplementary-service pseudo call-waiting
analog extension dial prefix sip prefix="9#"
statistics traffic on
wwan-module use on
■ Transit GatewayとOCI接続
TGWから足を一本出して、他Network,他Cloudへ接続できるので、Oracle Cloud(OCI)へ接続してみてみます。
・手順: AWS Transit Gateway経由でオンプレミスとOracle Cloudを接続してみてみた
#■ 参考
・“共有型”AWS DirectConnectでも使えるAWS Transit Gateway
・AWS Transit Gateway - Awsstatic