AWS vpn documentation change
Summary
Added detailed documentation about IP address type configurations (IPv4-only, IPv6-only, dual-stack) for Client VPN endpoints and traffic routing. Updated troubleshooting section title to reference IPv6 route enforcement.
Security assessment
The changes document IPv6 support and configuration options but do not reference any security vulnerabilities or patches. Mentions of security tools optimization are part of general configuration guidance rather than addressing specific security flaws.
Diff
diff --git a/vpn/latest/clientvpn-admin/cvpn-working-endpoints.md b/vpn/latest/clientvpn-admin/cvpn-working-endpoints.md index 398088f1c..cde152e38 100644 --- a//vpn/latest/clientvpn-admin/cvpn-working-endpoints.md +++ b//vpn/latest/clientvpn-admin/cvpn-working-endpoints.md @@ -5 +5 @@ -Requirements for creating Client VPN endpointsEndpoint modification +Requirements for creating Client VPN endpointsIP address typesEndpoint modification @@ -25,0 +26,61 @@ Before you begin, ensure that you do the following: +## IP address types + +AWS Client VPN supports IPv4-only, IPv6-only, and dual-stack configurations for both endpoint connectivity and traffic routing. The following guidance helps you select the appropriate IP address type based on your client device capabilities, network infrastructure, and application requirements. + +### Endpoint address type + +The endpoint address type determines which IP protocols your Client VPN endpoint supports for client connections. This setting cannot be changed after endpoint creation. + +**Choose IPv4-only when:** + + * Your client devices only support IPv4 VPN connections + + * Your security tools are optimized for IPv4 traffic inspection + + + + +**Choose IPv6-only when:** + + * All client devices fully support IPv6 connections + + * You're in networks where IPv4 addresses are depleted + + + + +**Choose dual-stack when:** + + * You have a mix of client devices with varying IP capabilities + + * You're gradually transitioning from IPv4 to IPv6 + + + + +### Traffic IP address type + +The traffic IP address type controls how Client VPN routes traffic between clients and your VPC resources, independent of the endpoint's supported protocols. + +**Route traffic as IPv4 when:** + + * Target applications in your VPC only support IPv4 + + * You have complex IPv4 security groups and network ACLs + + * You're connecting to legacy systems + + + + +**Route traffic as IPv6 when:** + + * Your VPC infrastructure is primarily IPv6 + + * You want to future-proof your network architecture + + * You have modern applications built for IPv6 + + + + @@ -109 +170 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Deactivate Client Route Enforcement +Troubleshoot IPv6 Client Route Enforcement