AWS vpn documentation change
Summary
Added documentation about IPv6 VPN support including configuration details, limitations for virtual private gateways, and CLI examples for IPv6 customer gateways/VPN connections
Security assessment
The changes focus on feature enablement (IPv6 VPN support) and configuration guidance rather than addressing security vulnerabilities. While IPv6 implementation can have security implications, there is no evidence this change addresses a specific security flaw or weakness. The note about VGW limitations appears operational rather than security-related.
Diff
diff --git a/vpn/latest/s2svpn/how_it_works.md b/vpn/latest/s2svpn/how_it_works.md index ac8cb297c..907c7f5af 100644 --- a//vpn/latest/s2svpn/how_it_works.md +++ b//vpn/latest/s2svpn/how_it_works.md @@ -5 +5 @@ -Virtual private gatewayTransit gatewayCustomer gateway deviceCustomer gateway +Virtual private gatewayTransit gatewayCustomer gateway deviceCustomer gatewayIPv6 VPN connections @@ -33,0 +34,4 @@ When you create a virtual private gateway, you can specify the private Autonomou +###### Note + +Virtual private gateways do not support IPv6 for Site-to-Site VPN connections. If you need IPv6 support, use a transit gateway or Cloud WAN for your VPN connection. + @@ -42 +46 @@ The following diagram shows a VPN connection between multiple VPCs and your on-p -Your Site-to-Site VPN connection on a transit gateway can support either IPv4 traffic or IPv6 traffic inside the VPN tunnels. For more information, see [IPv4 and IPv6 traffic in AWS Site-to-Site VPN](./ipv4-ipv6.html). +Your Site-to-Site VPN connection on a transit gateway can support IPv4 or IPv6 traffic inside the VPN tunnels (inner IP addresses). Additionally, transit gateways support IPv6 addresses for the outer tunnel IP addresses. For more information, see [IPv4 and IPv6 traffic in AWS Site-to-Site VPN](./ipv4-ipv6.html). @@ -51,0 +56,2 @@ By default, your customer gateway device must bring up the tunnels for your Site +If you're using IPv6 for the outer tunnel IP addresses, your customer gateway device must support IPv6 addressing and be able to establish IPsec tunnels with IPv6 endpoints. + @@ -59,0 +66,35 @@ To use Amazon VPC with a Site-to-Site VPN connection, you or your network admini +### IPv6 customer gateway + +When creating a customer gateway for use with IPv6 outer tunnel IPs, you specify an IPv6 address instead of an IPv4 address. You can create an IPv6 customer gateway using the AWS Management Console or the AWS CLI. + +To create an IPv6 customer gateway using the AWS CLI, use the following command: + + + aws ec2 create-customer-gateway --Ipv6-address 2001:0db8:85a3:0000:0000:8a2e:0370:7334 --bgp-asn 65051 --type ipsec.1 --region us-west-1 + +The IPv6 address must be a valid, internet-routable IPv6 address for your customer gateway device. + +## IPv6 VPN connections + +Site-to-Site VPN VPN connections support the following IPv6 configurations: + + * _IPv4 outer tunnel with IPv4 inner packets_ \- The basic IPv4 VPN capability supported on Virtual Private Gateway (VGW), Transit Gateway (TGW), and Cloud WAN. + + * _IPv4 outer tunnel with IPv6 inner packets_ \- Allows IPv6 applications/transport within the VPN tunnel. Supported on TGW and Cloud WAN (not supported on VGW). + + * _IPv6 outer tunnel with IPv6 inner packets_ \- Allows full IPv6 migration with IPv6 addresses for both outer tunnel IPs and inner packet IPs. Supported on TGW and Cloud WAN. + + * _IPv6 outer tunnel with IPv4 inner packets_ \- Allows IPv6 outer tunnel addressing while supporting legacy IPv4 applications within the tunnel. Supported on TGW and Cloud WAN. + + + + +To create a VPN connection with IPv6 outer tunnel IPs, you specify `OutsideIPAddressType=Ipv6` when creating the VPN connection. AWS automatically configures the outside tunnel IPv6 addresses for the AWS side of the VPN tunnels. + +Example CLI command to create a VPN connection with IPv6 outer tunnel IPs and IPv6 inner tunnel IPs: + + + aws ec2 create-vpn-connection --type ipsec.1 --transit-gateway-id tgw-12312312312312312 --customer-gateway-id cgw-001122334455aabbc --options OutsideIPAddressType=Ipv6,TunnelInsideIpVersion=ipv6,TunnelOptions=[{StartupAction=start},{StartupAction=start}] + +You can view the IPv6 addresses assigned to your VPN connection using the `describe-vpn-connection` CLI command. +