AWS vpn documentation change
Summary
Added IPv6 support configuration options for customer gateways and VPN connections, including CLI examples for IPv6 setups
Security assessment
The changes introduce IPv6 configuration options and examples but do not address security vulnerabilities or weaknesses. The updates focus on feature expansion rather than security remediation or security feature documentation.
Diff
diff --git a/vpn/latest/s2svpn/SetUpVPNConnections.md b/vpn/latest/s2svpn/SetUpVPNConnections.md index f971595b4..7a30a5b09 100644 --- a//vpn/latest/s2svpn/SetUpVPNConnections.md +++ b//vpn/latest/s2svpn/SetUpVPNConnections.md @@ -88 +88 @@ You must specify either an IP address, or the Amazon Resource Name of the privat - 6. (Optional) For **IP address** , enter the static, internet-routable IP address for your customer gateway device. If your customer gateway device is behind a NAT device that's enabled for NAT-T, use the public IP address of the NAT device. + 6. For **IP address type** , select one of the following options: @@ -90 +90 @@ You must specify either an IP address, or the Amazon Resource Name of the privat - 7. (Optional) If you want to use a private certificate, for **Certificate ARN** , choose the Amazon Resource Name of the private certificate. + * **IPv4** \- (Default) Specify an IPv4 address for your customer gateway device. @@ -92 +92 @@ You must specify either an IP address, or the Amazon Resource Name of the privat - 8. (Optional) For **Device** , enter a name for the customer gateway device associated with this customer gateway. + * **IPv6** \- Specify an IPv6 address for your customer gateway device. This option is required when creating a VPN connection with IPv6 outer tunnel IPs. @@ -94 +94,7 @@ You must specify either an IP address, or the Amazon Resource Name of the privat - 9. Choose **Create customer gateway**. + 7. For **IP address** , enter the static, internet-routable IP address for your customer gateway device. If your customer gateway device is behind a NAT device that's enabled for NAT-T, use the public IP address of the NAT device. + + 8. (Optional) If you want to use a private certificate, for **Certificate ARN** , choose the Amazon Resource Name of the private certificate. + + 9. (Optional) For **Device** , enter a name for the customer gateway device associated with this customer gateway. + + 10. Choose **Create customer gateway**. @@ -104,0 +111,4 @@ You must specify either an IP address, or the Amazon Resource Name of the privat +Example for creating an IPv6 customer gateway: + + aws ec2 create-customer-gateway --ipv6-address 2001:0db8:85a3:0000:0000:8a2e:0370:7334 --bgp-asn 65051 --type ipsec.1 --region us-west-1 + @@ -303 +313,5 @@ If you specified **IPv6** for **Tunnel inside IP version** , you can optionally - 10. For **Outside IP address type** , keep the default option, **PublicIpv4**. + 10. For **Outside IP address type** , select one of the following options: + + * **PublicIpv4** \- (Default) Use IPv4 addresses for the outer tunnel IPs. + + * **IPv6** \- Use IPv6 addresses for the outer tunnel IPs. This option is only available for VPN connections on a transit gateway or Cloud WAN. @@ -325,0 +340,8 @@ If you specified **IPv6** for **Tunnel inside IP version** , you can optionally +Example for creating a VPN connection with IPv6 outer tunnel IPs and IPv6 inner tunnel IPs: + + aws ec2 create-vpn-connection --type ipsec.1 --transit-gateway-id tgw-12312312312312312 --customer-gateway-id cgw-001122334455aabbc --options OutsideIPAddressType=IPv6,TunnelInsideIpVersion=ipv6,TunnelOptions=[{StartupAction=start},{StartupAction=start}] + +Example for creating a VPN connection with IPv6 outer tunnel IPs and IPv4 inner tunnel IPs: + + aws ec2 create-vpn-connection --type ipsec.1 --transit-gateway-id tgw-12312312312312312 --customer-gateway-id cgw-001122334455aabbc --options OutsideIPAddressType=IPv6,TunnelInsideIpVersion=ipv4,TunnelOptions=[{StartupAction=start},{StartupAction=start}] +