AWS sap documentation change
Summary
Expanded VPN preparation steps with explicit bullet points about firewall rules and gateway devices
Security assessment
Added explicit documentation about firewall configuration requirements and redundancy for VPN tunnels, which relates to security best practices but doesn't address a specific vulnerability
Diff
diff --git a/sap/latest/general/rise-connection-implementation-steps.md b/sap/latest/general/rise-connection-implementation-steps.md index 9b2e5ec0a..b6a4e9e47 100644 --- a//sap/latest/general/rise-connection-implementation-steps.md +++ b//sap/latest/general/rise-connection-implementation-steps.md @@ -60 +60 @@ In the questionnaire, provide the following details about your Direct Connect co - * The IP address ranges of your on-premises network (to allow for proper firewall configuration) Additionally, include information about your on-premises router, such as the make, model, and interface details. + * The IP address ranges of your on-premises network (to allow for proper firewall configuration) @@ -64,0 +65,2 @@ In the questionnaire, provide the following details about your Direct Connect co +Additionally, include information about your on-premises router, such as the make, model, and interface details. + @@ -118 +120,2 @@ The Site-to-Site VPN connection consists of three key components: - 3. The S2S VPN connection that binds the VGW and CGW together over two secure IPSec tunnels in an active/passive configuration For in-depth documentation on establishing the AWS Site-to-Site VPN connection, you can refer to the AWS documentation at https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html. + 3. The S2S VPN connection that binds the VGW and CGW together over two secure IPSec tunnels in an active/passive configuration + @@ -121,0 +125 @@ The Site-to-Site VPN connection consists of three key components: +For in-depth documentation on establishing the AWS Site-to-Site VPN connection, refer to [Getting started with AWS Site-to-Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html) in the AWS documentation. @@ -127 +131,10 @@ This approach builds on the steps outlined in the previous Option 1 for setting -While your Direct Connect connections are being provisioned, you can begin preparing your on-premises infrastructure for the VPN setup: * Review the AWS documentation on Site-to-Site VPN to understand the requirements and best practices. * Ensure your firewalls allow the necessary traffic for the VPN tunnels. * Confirm you have two customer gateway devices or a single device capable of managing multiple VPN tunnels. +While your Direct Connect connections are being provisioned, you can begin preparing your on-premises infrastructure for the VPN setup: + + * Review the AWS documentation on Site-to-Site VPN to understand the requirements and best practices. + + * Ensure your firewalls allow the necessary traffic for the VPN tunnels. + + * Confirm you have two customer gateway devices or a single device capable of managing multiple VPN tunnels. + + + @@ -155 +168,2 @@ In the AWS Connectivity Questionnaire, you’ll need to provide the following in - * Customer On-Premises Network IP ranges Submit the completed questionnaire to SAP. They will then create the VPN connection and provide you with the configuration details. + * Customer On-Premises Network IP ranges + @@ -158,0 +173 @@ In the AWS Connectivity Questionnaire, you’ll need to provide the following in +Submit the completed questionnaire to SAP. They will then create the VPN connection and provide you with the configuration details. @@ -162 +177,12 @@ In the AWS Connectivity Questionnaire, you’ll need to provide the following in -After you submit the completed questionnaire, SAP will handle the following tasks (the list below is illustrative only for this context): * Create the customer gateway (with your provided information like BGP ASN, IP address, and optional private certificate) * Create the AWS Site-to-Site VPN and attach it to the RISE with SAP Transit Gateway and your customer gateway * Provide the VPN configuration file for you to set up on your on-premises router * If you need SAP to provision Transit Gateway in RISE VPC, SAP will add the necessary route to the Transit Gateway route table and update the security groups +After you submit the completed questionnaire, SAP will handle the following tasks (the list below is illustrative only for this context): + + * Create the customer gateway (with your provided information like BGP ASN, IP address, and optional private certificate) + + * Create the AWS Site-to-Site VPN and attach it to the RISE with SAP Transit Gateway and your customer gateway + + * Provide the VPN configuration file for you to set up on your on-premises router + + * If you need SAP to provision Transit Gateway in RISE VPC, SAP will add the necessary route to the Transit Gateway route table and update the security groups + + +