以前にYAMAHA RTX1200でAWSとサイト間VPNを構築する記事を書きましたがNEC IX2105でも同じようにVPN接続することがあったので備忘録のかねて記事にします。ヤマハもですが「NW機器＋AWSとVPN接続設定した」系の記事って、ネットで探してもあんまり出てこないですよね...ネットワークエンジニアの皆さんはあんまりブログやQiita的なやつでアウトプットはしないのか...はたまたメーカ公式ページがサンプルコンフィグ出してるからOKってことなのか...とりあえず誰かの役に立てればと思います。
以前書いたYAMAHAの記事 = YAMAHA RTX1200 でAWS サイト間VPN接続の構築
#今回のゴール
ルータのLAN側IPからVPN経由でAWS VPC内のEC2のプライベートIPとPingで疎通確認が取れるようになること。
【構成イメージ図】
#前提環境
- AWS側サブネットのNWセグメントは10.0.0.0/24でEC2は10.0.0.76/24
- IX2105のLan側IPは192.168.1.254/24を設定
- IX2105のWan側は固定グローバルIPを設定
- 今回Wan回線はフレッツを利用
#設定手順
①EC2をデプロイ
②AWS VPCのカスタマーゲートウェイを設定
③AWS VPCの仮想プライベートゲートウェイを設定
④AWSのセキュリティグループおよびルーティングを設定
⑤サイト間VPNを設定
⑥AWSから必要な設定情報をDLする
⑦IX2105に設定投入
#実際にやってみた
①については他に詳しい記事があるので割愛します。また②～⑤についても以前にYAMAHA RTX1200でサイト間VPNを設定したときと同じなので割愛します。以下を参考に設定してください。
以前書いたYAMAHAの記事 = YAMAHA RTX1200 でAWS サイト間VPN接続の構築
では⑥の設定情報のDLから始めます。VPN設定について、AWS側でいくつかのルータはサンプルコンフィグが用意されています。以前のYAMAHAはサンプルコンフィグがあったのですが、今回のIXシリーズは用意されていないので、「Generic」を選択します。
DLしたコンフィグはこんな感じです。
Amazon Web Services
Virtual Private Cloud
IPSec Tunnel #1
================================================================================
#1: Internet Key Exchange Configuration
Configure the IKE SA as follows:
Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2.
Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24.
NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
The address of the external interface for your customer gateway must be a static address.
Your customer gateway may reside behind a device performing network address translation (NAT).
To ensure that NAT traversal (NAT-T) can function, you must adjust your firewall !rules to unblock UDP port 4500.
| If not behind NAT, and you are not using an Accelerated VPN, we recommend disabling NAT-T. If you are using an Accelerated VPN, make sure that NAT-T is enabled.
- IKE version : IKEv1
- Authentication Method : Pre-Shared Key
- Pre-Shared Key : AAAAAAAAAAAAAAAAAAAAAAA
- Authentication Algorithm : sha1
- Encryption Algorithm : aes-128-cbc
- Lifetime : 28800 seconds
- Phase 1 Negotiation Mode : main
- Diffie-Hellman : Group 2
#2: IPSec Configuration
Configure the IPSec SA as follows:
Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
Please note, you may use these additionally supported IPSec parameters for encryption like AES256 and other DH groups like 2, 5, 14-18, 22, 23, and 24.
NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
- Protocol : esp
- Authentication Algorithm : hmac-sha1-96
- Encryption Algorithm : aes-128-cbc
- Lifetime : 3600 seconds
- Mode : tunnel
- Perfect Forward Secrecy : Diffie-Hellman Group 2
IPSec Dead Peer Detection (DPD) will be enabled on the AWS Endpoint. We
recommend configuring DPD on your endpoint as follows:
- DPD Interval : 10
- DPD Retries : 3
IPSec ESP (Encapsulating Security Payload) inserts additional
headers to transmit packets. These headers require additional space,
which reduces the amount of space available to transmit application data.
To limit the impact of this behavior, we recommend the following
configuration on your Customer Gateway:
- TCP MSS Adjustment : 1379 bytes
- Clear Don't Fragment Bit : enabled
- Fragmentation : Before encryption
#3: Tunnel Interface Configuration
Your Customer Gateway must be configured with a tunnel interface that is
associated with the IPSec tunnel. All traffic transmitted to the tunnel
interface is encrypted and transmitted to the Virtual Private Gateway.
The Customer Gateway and Virtual Private Gateway each have two addresses that relate
to this IPSec tunnel. Each contains an outside address, upon which encrypted
traffic is exchanged. Each also contain an inside address associated with
the tunnel interface.
The Customer Gateway outside IP address was provided when the Customer Gateway
was created. Changing the IP address requires the creation of a new
Customer Gateway.
The Customer Gateway inside IP address should be configured on your tunnel
interface.
Outside IP Addresses:
- Customer Gateway : "固定グローバルIP"
- Virtual Private Gateway : "IPsec接続先アドレス#1"
Inside IP Addresses
- Customer Gateway : "BGPピアアドレス#1(ルータ側)"
- Virtual Private Gateway : "BGPピアアドレス#1(AWS側)"
Configure your tunnel to fragment at the optimal size:
- Tunnel interface MTU : 1436 bytes
#4: Border Gateway Protocol (BGP) Configuration:
The Border Gateway Protocol (BGPv4) is used within the tunnel, between the inside
IP addresses, to exchange routes from the VPC to your home network. Each
BGP router has an Autonomous System Number (ASN). Your ASN was provided
to AWS when the Customer Gateway was created.
BGP Configuration Options:
- Customer Gateway ASN : 65000
- Virtual Private Gateway ASN : 64512
- Neighbor IP Address : "BGPピアアドレス#1(AWS側)"
- Neighbor Hold Time : 30
Configure BGP to announce routes to the Virtual Private Gateway. The gateway
will announce prefixes to your customer gateway based upon the prefix you
assigned to the VPC at creation time.
IPSec Tunnel #2
================================================================================
#1: Internet Key Exchange Configuration
Configure the IKE SA as follows:
Please note, these sample configurations are for the minimum requirement of AES128, SHA1, and DH Group 2.
Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
You will need to modify these sample configuration files to take advantage of AES256, SHA256, or other DH groups like 2, 14-18, 22, 23, and 24.
NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
The address of the external interface for your customer gateway must be a static address.
Your customer gateway may reside behind a device performing network address translation (NAT).
To ensure that NAT traversal (NAT-T) can function, you must adjust your firewall !rules to unblock UDP port 4500.
| If not behind NAT, and you are not using an Accelerated VPN, we recommend disabling NAT-T. If you are using an Accelerated VPN, make sure that NAT-T is enabled.
- IKE version : IKEv1
- Authentication Method : Pre-Shared Key
- Pre-Shared Key : BBBBBBBBBBBBBBBBBBBBB
- Authentication Algorithm : sha1
- Encryption Algorithm : aes-128-cbc
- Lifetime : 28800 seconds
- Phase 1 Negotiation Mode : main
- Diffie-Hellman : Group 2
#2: IPSec Configuration
Configure the IPSec SA as follows:
Category "VPN" connections in the GovCloud region have a minimum requirement of AES128, SHA2, and DH Group 14.
Please note, you may use these additionally supported IPSec parameters for encryption like AES256 and other DH groups like 2, 5, 14-18, 22, 23, and 24.
NOTE: If you customized tunnel options when creating or modifying your VPN connection, you may need to modify these sample configurations to match the custom settings for your tunnels.
Higher parameters are only available for VPNs of category "VPN," and not for "VPN-Classic".
- Protocol : esp
- Authentication Algorithm : hmac-sha1-96
- Encryption Algorithm : aes-128-cbc
- Lifetime : 3600 seconds
- Mode : tunnel
- Perfect Forward Secrecy : Diffie-Hellman Group 2
IPSec Dead Peer Detection (DPD) will be enabled on the AWS Endpoint. We
recommend configuring DPD on your endpoint as follows:
- DPD Interval : 10
- DPD Retries : 3
IPSec ESP (Encapsulating Security Payload) inserts additional
headers to transmit packets. These headers require additional space,
which reduces the amount of space available to transmit application data.
To limit the impact of this behavior, we recommend the following
configuration on your Customer Gateway:
- TCP MSS Adjustment : 1379 bytes
- Clear Don't Fragment Bit : enabled
- Fragmentation : Before encryption
#3: Tunnel Interface Configuration
Your Customer Gateway must be configured with a tunnel interface that is
associated with the IPSec tunnel. All traffic transmitted to the tunnel
interface is encrypted and transmitted to the Virtual Private Gateway.
The Customer Gateway and Virtual Private Gateway each have two addresses that relate
to this IPSec tunnel. Each contains an outside address, upon which encrypted
traffic is exchanged. Each also contain an inside address associated with
the tunnel interface.
The Customer Gateway outside IP address was provided when the Customer Gateway
was created. Changing the IP address requires the creation of a new
Customer Gateway.
The Customer Gateway inside IP address should be configured on your tunnel
interface.
Outside IP Addresses:
- Customer Gateway : "固定グローバルIP"
- Virtual Private Gateway : "IPsec接続先アドレス#2"
Inside IP Addresses
- Customer Gateway : "BGPピアアドレス#2(ルータ側)"
- Virtual Private Gateway : "BGPピアアドレス#2(AWS側)"
Configure your tunnel to fragment at the optimal size:
- Tunnel interface MTU : 1436 bytes
#4: Border Gateway Protocol (BGP) Configuration:
The Border Gateway Protocol (BGPv4) is used within the tunnel, between the inside
IP addresses, to exchange routes from the VPC to your home network. Each
BGP router has an Autonomous System Number (ASN). Your ASN was provided
to AWS when the Customer Gateway was created.
BGP Configuration Options:
- Customer Gateway ASN : 65000
- Virtual Private Gateway ASN : 64512
- Neighbor IP Address : "BGPピアアドレス#2(AWS側)"
- Neighbor Hold Time : 30
Configure BGP to announce routes to the Virtual Private Gateway. The gateway
will announce prefixes to your customer gateway based upon the prefix you
assigned to the VPC at creation time.
Additional Notes and Questions
================================================================================
最後にIX2105に設定投入をやっていきます。ルータにコンソール接続してConfigureモードにした状態から始めます。
#必要に応じて今の設定をルータの初期化
Router(config)# erase running-config
Router(config)# restart
あとは下記内容を投入してください。
hostname TestVPN-RT
timezone +09 00
logging buffered 131072
logging subsystem all warn
logging timestamp datetime
ip route default GigaEthernet0.1
ip dhcp enable
ip access-list sec-list permit ip src any dest any
!
!
!
ike proposal ike-prop encryption aes hash sha group 1024-bit
!
ike policy ike-policy1 peer "IPsec接続先アドレス#1" key AAAAAAAAAAAAAAAAAAA ike-prop
ike keepalive ike-policy1 10 3
!
ike policy ike-policy2 peer "IPsec接続先アドレス#2" key BBBBBBBBBBBBBBBBBBB ike-prop
ike keepalive ike-policy2 10 3
!
ipsec autokey-proposal ipsec-prop esp-aes esp-sha
!
ipsec autokey-map ipsec-map1 sec-list peer "IPsec接続先アドレス#1" ipsec-prop pfs 1024-bit
!
ipsec autokey-map ipsec-map2 sec-list peer "IPsec接続先アドレス#2" ipsec-prop pfs 1024-bit
!
!
!
!
!
!
!
proxy-dns ip enable
!
!
!
!
ppp profile ppp_profile
authentication myname XXXXXXXXXXXXXX.jp ←PPPoE接続のためのIPS接続アカウント
authentication password XXXXXXXXXXX.jp XXXXXXXX ←PPPoE接続のためのIPS接続アカウントとPW
!
ip dhcp profile lan1
dns-server 192.168.1.254
!
router bgp 65000
neighbor "BGPピアアドレス#1(AWS側)" remote-as 64512
neighbor "BGPピアアドレス#1(AWS側)" timers 10 30
neighbor "BGPピアアドレス#2(AWS側)" remote-as 64512
neighbor "BGPピアアドレス#2(AWS側)" timers 10 30
address-family ipv4 unicast
originate-default always
!
device GigaEthernet0
!
device GigaEthernet1
!
interface GigaEthernet0.0
no ip address
shutdown
!
interface GigaEthernet1.0
description == local net ==
ip address 192.168.1.254/24
ip dhcp binding lan1
no shutdown
!
interface GigaEthernet0.1
description == flets ==
encapsulation pppoe
auto-connect
ppp binding pppoe
ip address ipcp
ip tcp adjust-mss auto
ip napt enable
ip napt static GigaEthernet0.1 udp 500
ip napt static GigaEthernet0.1 50
no shutdown
!
interface Loopback0.0
no ip address
!
interface Null0.0
no ip address
!
interface Tunnel0.0
description == Tunnel 1 ==
tunnel mode ipsec
ip address "BGPピアアドレス#1(ルータ側)"
ip tcp adjust-mss auto
ipsec policy tunnel ipsec-map1 out
no shutdown
!
interface Tunnel1.0
description == Tunnel #2 ==
tunnel mode ipsec
ip address "BGPピアアドレス#2(ルータ側)"
ip tcp adjust-mss auto
ipsec policy tunnel ipsec-map2 out
no shutdown
ちゃんとIPsecのセッションが確立されると機器フロント面のVPNのランプが点灯します。
もし何かあってランプが点灯しない場合は[show ipsec sa]や[show interface tunnel0.0]などで切り分けして原因を特定しましょう。
またAWSコンソールでもIPsecのセッションが張れたか確認しましょう。
以下の画像のようにステータスが「アップ」になっていればOKです。
それではVPN接続もできたので、ルータのLan側IPからEC2のプライベートIPにPingを打ってみましょう。
応答がありますので、これにて目標達成です！
もしIPsecのセッションが張れているのにPingが通らない場合はセキュリティグループ、AWS VPCのルーティング情報、EC2のパーソナルFWが原因と思われますので設定を見直しましょう。
#おわりに
IX2105は2019年9月末で生産終了になっていますが、中古で安く売っていたりして、手に入りやすいわりに、そこそこのスペックなので検証機として重宝しています。YAMAHAと比べてコンフィグもシンプルな気がしますし、AWSとVPN接続する機器としてはオススメです。
#参考にしたサイト
NECのルータIX2105からVPCのVPNに接続する
https://jpn.nec.com/univerge/ix/Support/AWS/index.html