AWS vpn documentation change
Summary
Rewrote documentation to focus on creating Cloud WAN VPN connections via CLI/API instead of console. Added CLI command examples, API request/response formats, and clarified prerequisites (BGP requirement, unattached VPN connections). Removed console-specific steps and IPv6 tunnel configuration details.
Security assessment
The changes are procedural updates for creating VPN connections via CLI/API rather than the console. While BGP enforcement (StaticRoutesOnly=false) is mentioned as a requirement, this is a standard configuration requirement for Cloud WAN compatibility, not a direct response to a security vulnerability. No CVEs, vulnerabilities, or explicit security advisories are referenced.
Diff
diff --git a/vpn/latest/s2svpn/create-cwan-vpn-attachment.md b/vpn/latest/s2svpn/create-cwan-vpn-attachment.md index ade418b83..6afc8bf3d 100644 --- a//vpn/latest/s2svpn/create-cwan-vpn-attachment.md +++ b//vpn/latest/s2svpn/create-cwan-vpn-attachment.md @@ -5 +5 @@ -# Create an AWS Site-to-Site VPN attachment for AWS Cloud WAN +Create a VPN connection to Cloud WAN using the CLICreate a VPN Cloud WAN connection using the API @@ -7 +7 @@ -You can create an Site-to-Site VPN attachment for AWS Cloud WAN follow the procedure below. For more information about VPN attachments and Cloud WAN, see [Site-to-site VPN attachments in AWS Cloud WAN](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-s2s-vpn-attachment.html) in the _AWS Cloud WAN User Guide_. +# Create an AWS Site-to-Site VPN Cloud WAN connection using the CLI or API @@ -9 +9 @@ You can create an Site-to-Site VPN attachment for AWS Cloud WAN follow the proce -Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more information on using either of these protocols for a Cloud WAN VPN attachment, see [IPv4 and IPv6 traffic in AWS Site-to-Site VPN](./ipv4-ipv6.html). +You can create an Site-to-Site VPN connections between your on-premises and AWS Cloud WAN following the procedure below. For more information, see [ Site-to-site VPN attachments in AWS Cloud WAN ](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-s2s-vpn-attachment.html) in the _AWS Cloud WAN User Guide_. @@ -11 +11 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat -###### To create a VPN attachment for AWS Cloud WAN using the console +## Create a VPN connection to Cloud WAN using the CLI @@ -13 +13 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 1. Open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). +Use the [create-vpn-connection](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/create-vpn-connection.html) command to create a VPN connection that will later be attached to a Cloud WAN global network. This creates an unattached VPN connection that can subsequently be associated with Cloud WAN through the Network Manager console or API. @@ -15 +15 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 2. In the navigation pane, choose **Site-to-Site VPN connections**. +**Prerequisites** @@ -17 +17 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 3. Choose **Create VPN connection**. +Before creating a Cloud WAN VPN connection, ensure you have the following: @@ -19 +19 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 4. (Optional) For **Name tag** , enter a name for the connection. Doing so creates a tag with a key of `Name` and the value that you specify. + * `customer-gateway-id` \- An existing customer gateway resource (`cgw-xxxxxxxxx`) that represents your on-premises VPN device. @@ -21 +21 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 5. For **Target gateway type** , choose **Not associated**. + * **Cloud WAN Global Network** \- A Cloud WAN global network must be created and configured with appropriate network segments. @@ -23 +23 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 6. For **Customer gateway** , do one of the following: + * **BGP Configuration** \- Cloud WAN VPN connections require BGP routing; static routing is not supported. You must set `StaticRoutesOnly=false` in the options parameter @@ -25 +24,0 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - * To use an existing customer gateway, choose **Existing** , and then choose the **Customer gateway ID**. @@ -27 +25,0 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - * To create a new customer gateway, choose **New**. @@ -29 +26,0 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 1. For the **IP address** , enter a static **IPv4** or **IPv6** address. @@ -31 +28 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 2. (Optional) For **Certificate ARN** , choose the ARN of your private certificate (if using certificate-based authentication). +This command creates a VPN connection without specifying a target gateway. The connection will be in an unattached state and can later be associated with your Cloud WAN global network through the Network Manager console or API. The `StaticRoutesOnly=false` option enables BGP routing, which is mandatory for Cloud WAN VPN attachments as static routing is not supported. @@ -33 +30 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 3. For **BGP ASN** , enter the Border Gateway Protocol (BGP) Autonomous System Number (ASN) of your customer gateway. For more information, see [Customer gateway options](./cgw-options.html). +The following example creates an unattached VPN connection for Cloud WAN: @@ -35 +31,0 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 7. For **Routing options** , choose **Dynamic (requires BGP)** or **Static**. @@ -37 +33,4 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 8. For **Pre-shared key storage** choose either **Standard** or **Secrets Manager**. The default selection is **Standard**. For more information about using AWS Secrets Manager, see [Security](./security.html). + aws ec2 create-vpn-connection \ + --type ipsec.1 \ + --customer-gateway-id cgw-0123456789abcdef0 \ + --options StaticRoutesOnly=false @@ -39 +38 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 9. For **Tunnel inside IP version** , choose **IPv4** or **IPv6**. +The response returns the following: @@ -41 +39,0 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat - 10. (Optional) For **Enable acceleration** , choose the check box to enable acceleration. For more information, see [Accelerated VPN connections](./accelerated-vpn.html). @@ -43 +41,13 @@ Cloud WAN VPN attachments support both IPv4 or IPv6 protocols. For more informat -If you enable acceleration, we create two accelerators that are used by your VPN connection. Additional charges apply. + { + "VpnConnection": { + "VpnConnectionId": "vpn-0abcdef1234567890", + "State": "pending", + "CustomerGatewayId": "cgw-0123456789abcdef0", + "Type": "ipsec.1", + "Category": "VPN", + "Routes": [], + "Options": { + "StaticRoutesOnly": false + } + } + } @@ -45 +55 @@ If you enable acceleration, we create two accelerators that are used by your VPN - 11. (Optional) Depending on which tunnel inside IP version you've chosen, do one of the following: +After creating the VPN connection, you can attach it to your Cloud WAN global network using the Network Manager console or the `create-site-to-site-vpn-attachment` API call. @@ -47 +57 @@ If you enable acceleration, we create two accelerators that are used by your VPN - * IPv4 — For **Local IPv4 network CIDR** , specify the IPv4 CIDR range on the customer gateway (on-premises) side that is allowed to communicate over the VPN tunnels. For **Remote IPv4 network CIDR** , choose the CIDR range on the AWS side that is allowed to communicate over VPN tunnels. The default value for both fields is `0.0.0.0/0`. +## Create a VPN Cloud WAN connection using the API @@ -49 +59 @@ If you enable acceleration, we create two accelerators that are used by your VPN - * IPv6 — For **Local IPv6 network CIDR** , specify the IPv6 CIDR range on the customer gateway (on-premises) side that is allowed to communicate over the VPN tunnels. For **Remote IPv6 network CIDR** , choose the CIDR range on the AWS side that is allowed to communicate over VPN tunnels. The default value for both fields is `::/0` +You can use the EC2 API to create a VPN connection for Cloud WAN integration. This involves making a `CreateVpnConnection` API call that creates an unattached VPN connection, which can then be associated with your Cloud WAN global network. @@ -51 +61 @@ If you enable acceleration, we create two accelerators that are used by your VPN - 12. For **Outside IP address type** , choose one of the following options: +The API request creates a VPN connection without specifying a target gateway, leaving it in an unattached state that's ready for Cloud WAN integration. The connection uses BGP routing, which is required for Cloud WAN VPN attachments. @@ -53 +63 @@ If you enable acceleration, we create two accelerators that are used by your VPN - * **Public IPv4** \- (Default) Use IPv4 addresses for the outer tunnel IPs. +The following example shows the HTTP request to create a Cloud WAN VPN connection: @@ -55 +64,0 @@ If you enable acceleration, we create two accelerators that are used by your VPN - * **Private IPv4** \- Use a private IPv4 address for use within private networks. @@ -57 +66,4 @@ If you enable acceleration, we create two accelerators that are used by your VPN - * **IPv6** \- Use IPv6 addresses for the outer tunnel IPs. This option requires that your customer gateway device supports IPv6 addressing. + POST / HTTP/1.1 + Host: ec2.us-east-1.amazonaws.com + Content-Type: application/x-www-form-urlencoded + Authorization: AWS4-HMAC-SHA256 Credential=... @@ -59 +71,5 @@ If you enable acceleration, we create two accelerators that are used by your VPN -###### Note + Action=CreateVpnConnection + &Type=ipsec.1 + &CustomerGatewayId=cgw-0123456789abcdef0 + &Options.StaticRoutesOnly=false + &Version=2016-11-15 @@ -61 +77 @@ If you enable acceleration, we create two accelerators that are used by your VPN -If you select **IPv6** for the outside IP address type, you must create a customer gateway with an IPv6 address +The API returns a successful response containing the VPN connection details. The connection will be in a `pending` state initially while AWS provisions the VPN tunnels, at which time the status changes to `available`. @@ -63 +78,0 @@ If you select **IPv6** for the outside IP address type, you must create a custom - 13. (Optional) For **Tunnel 1 options** , you can specify the following information for each tunnel: @@ -65 +80,16 @@ If you select **IPv6** for the outside IP address type, you must create a custom - * A size /30 IPv4 CIDR block from the `169.254.0.0/16` range for the inside tunnel IPv4 addresses. + <?xml version="1.0" encoding="UTF-8"?> + <CreateVpnConnectionResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/"> + <requestId>12345678-1234-1234-1234-123456789012</requestId> + <vpnConnection> + <vpnConnectionId>vpn-0abcdef1234567890</vpnConnectionId> + <state>pending</state> + <customerGatewayId>cgw-0123456789abcdef0</customerGatewayId> + <type>ipsec.1</type> + <category>VPN</category> + <options> + <staticRoutesOnly>false</staticRoutesOnly> + </options> + <vgwTelemetry/> + <routes/> + </vpnConnection> + </CreateVpnConnectionResponse> @@ -67 +97 @@ If you select **IPv6** for the outside IP address type, you must create a custom - * If you specified **IPv6** for **Tunnel inside IP version** , a /126 IPv6 CIDR block from the `fd00::/8` range for the inside tunnel IPv6 addresses. +**Response Details** @@ -69 +99 @@ If you select **IPv6** for the outside IP address type, you must create a custom - * The IKE pre-shared key (PSK). The following versions are supported: IKEv1 or IKEv2. +The API response provides the following key information: @@ -71 +101 @@ If you select **IPv6** for the outside IP address type, you must create a custom - * To edit the advanced options for your tunnel, choose **Edit tunnel options**. For more information, see [VPN tunnel options](./VPNTunnels.html). + * **vpnConnectionId** \- The unique identifier for your VPN connection (e.g., `vpn-0abcdef1234567890`) that you'll use to attach it to Cloud WAN @@ -73 +103 @@ If you select **IPv6** for the outside IP address type, you must create a custom - * (Optional) Choose **Enable** for the **Tunnel activity log** to capture log messages for IPsec activity and DPD protocol messages. + * **state** \- Initially "pending" while AWS provisions the VPN tunnels, then transitions to "available" when ready for attachment @@ -75 +105 @@ If you select **IPv6** for the outside IP address type, you must create a custom - * (Optional) Choose **Turn on** for **Tunnel endpoint lifecycle** to control the schedule for endpoint replacements. For more information about tunnel endpoint lifecycle, see [Tunnel endpoint lifecycle](./tunnel-endpoint-lifecycle.html). + * **category** \- Shows "VPN" indicating this is an unattached VPN connection suitable for Cloud WAN integration @@ -77 +107 @@ If you select **IPv6** for the outside IP address type, you must create a custom - 14. (Optional) Choose **Tunnel 2 options** and follow the previous steps to set up a second tunnel. + * **staticRoutesOnly** \- Set to "false" to enable BGP routing, which is required for Cloud WAN VPN attachments @@ -79,14 +108,0 @@ If you select **IPv6** for the outside IP address type, you must create a custom - 15. Choose **Create VPN connection**. - - - - -###### To create a Site-to-Site VPN connection using the command line or API - - * [CreateVpnConnection](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConnection.html) (Amazon EC2 Query API) - - * [create-vpn-connection](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpn-connection.html) (AWS CLI) - -Example for creating a VPN connection with IPv6 outer tunnel IPs and IPv6 inner tunnel IPs: - - aws ec2 create-vpn-connection --type ipsec.1 --customer-gateway-id cgw-001122334455aabbc --options OutsideIPAddressType=Ipv6,TunnelInsideIpVersion=pv6,TunnelOptions=[{StartupAction=start},{StartupAction=start}] @@ -95,0 +112 @@ Example for creating a VPN connection with IPv6 outer tunnel IPs and IPv6 inner +Once the VPN connection reaches the "available" state, you can attach it to your Cloud WAN global network using the Network Manager `CreateSiteToSiteVpnAttachment` API or through the AWS console. @@ -103 +120 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Work with Site-to-Site VPN +Create a VPN transit gateway connection using the CLI or API @@ -105 +122 @@ Work with Site-to-Site VPN -Create a transit gateway VPN attachment +Create a VPN Concentrator connection using the CLI or API