AWS vpn documentation change
Summary
Added details about IPv6 subnet auto-selection and clarified IP address assignment for AWS/customer sides. Introduced 'Outside tunnel IP address type' configuration options including IPv6 support with requirements for customer gateway devices.
Security assessment
The changes document IPv6 feature enhancements and configuration requirements. While IPv6 support and IPsec requirements are mentioned, there is no evidence of addressing a specific security vulnerability. The updates focus on functionality rather than security remediation.
Diff
diff --git a/vpn/latest/s2svpn/VPNTunnels.md b/vpn/latest/s2svpn/VPNTunnels.md index 5135c17c2..f77895016 100644 --- a//vpn/latest/s2svpn/VPNTunnels.md +++ b//vpn/latest/s2svpn/VPNTunnels.md @@ -111 +111 @@ The type of storage for the pre-shared key: -(IPv6 VPN connections only) The range of inside (internal) IPv6 addresses for the VPN tunnel. You can specify a size /126 CIDR block from the local `fd00::/8` range. The CIDR block must be unique across all Site-to-Site VPN connections that use the same transit gateway. +(IPv6 VPN connections only) The range of inside (internal) IPv6 addresses for the VPN tunnel. You can specify a size /126 CIDR block from the local `fd00::/8` range. The CIDR block must be unique across all Site-to-Site VPN connections that use the same transit gateway. If you don't specify an IPv6 subnet, Amazon automatically selects a /128 subnet from this range. Regardless of whether you specify the subnet or Amazon selects it, Amazon uses the first usable IPv6 address in the subnet for its side of the connection, and your side uses the second usable IPv6 address. @@ -114,0 +115,18 @@ Default: A size /126 IPv6 CIDR block from the local `fd00::/8` range. +**Outside tunnel IP address type** + + +The IP address type for the outside (external) tunnel IP addresses. You can specify one of the following: + + * `PrivateIpv4`: Use private IPv4 address to deploy Site-to-Site VPN connections over Direct Connect. + + * `PublicIpv4`: (Default) Use IPv4 addresses for the outer tunnel IPs. + + * `Ipv6`: Use IPv6 addresses for the outer tunnel IPs. This option is only available for VPN connections on a transit gateway or Cloud WAN. + + + + +When you select `Ipv6`, AWS automatically configures the outside tunnel IPv6 addresses for the AWS side of the VPN tunnels. Your customer gateway device must support IPv6 addressing and be able to establish IPsec tunnels with IPv6 endpoints. + +Default: `PublicIpv4` +