Translated from 日本語 • View original Good morning. This is Infra Miyashita.
It is common to connect an AWS VPC and office with a VPN, but depending on the configuration, the downloaded config may not work well. In this article, I would like to summarize the settings that had to be changed in the following environment.
1) AWS Connected Environment
[shell]Region: Singapore Router: YAMAHA RTX 1200 Routing: Static[/shell]
2) Check VPN config
After creating VPN Connections, if you download the config, there are four configuration items: IKE, IPSec, Tunnel Interface, and Static Route, so check the contents of each.
・IKE
[shell] tunnel select 1 ipsec ike encryption 1 aes-cbc ipsec ike group 1 modp1024 ipsec ike hash 1 sha ipsec ike pre-shared-key 1 text y7Nn93e7fJHWQrUaabbccdd112233[/shell]
For IKE, there is no problem with diverting config as it is. The key is different for each individual, so please make it the correct key. If you already use "1", please use a different number for the tunnel number. (Don't forget to change the ID notation after that.)
・IPSec
[shell] ipsec tunnel 201 ipsec sa policy 201 1 esp aes-cbc sha-hmac ipsec ike duration ipsec-sa 1 3600 ipsec ike pfs 1 on ipsec tunnel outer df-bit clear ipsec ike keepalive use 1 on dpd 10 3[/shell]
There are no required items to change. Depending on the environment, Keepalive may drop frequently if it is DPD, so I don't think there is any problem in changing it to ICMP in such a case. Some people seem to turn off the keepalive setting. When changing Keepalive to ICMP, configure the following settings.
[shell]ipsec ike keepalive use 1 on icmp-echo 169.xxx.xx.xxx (IP on the AWS side)[/shell]
Configuring the IKE Keep-Alive Feature IPsec DPD
If the ipsec tunnel ID is also used, use a different ID.
・Tunnel Interface
[shell] ipsec ike local address 1 aaa.xxx.yyy.xxx (office IP) ipsec ike remote address 1 aaa.xxx.yyy.xxx(AWSIP) ip tunnel address 169.254.yy.xz/30 ip tunnel remote address 169.254.yy.xx ip tunnel tcp mss limit 1387 tunnel enable 1 tunnel select none ipsec auto refresh on[/shell]
When I connected to a VPN between Tokyo and Singapore by RTX1200, I logged in to my AWS instance and ran the "ps" or "ls" command, and there was no response in the middle.
Office Server → AWS Instance Unresponsive Office Server → AWS Instance→ AWS Instance Responsive Office Server → AWS Region Instance Responsive Office Server → AWS Instance (Separate ZONE) Unresponsive
From the symptoms, it is expected that there is something wrong with the communication between the office and the VPC. When I pinged the AWS instance from the office as a partition, it was still strange.
[shell] ping -f -l 1387 (MTU size) -n 1 Destination IP (office to AWS instance) Packet fragmentation is required, but DF is configured. [/shell]
I tried downloading config in various environments and regions, but all of them had a fixed value of 1387 with MSS settings. I see, I had to modify it to suit my environment.
The way to find the optimal value of MTU/MSS is to steadily add or subtract the MTU size with Ping to find the upper limit.
[shell] ping -f -l Change this value (maximum non-fragmentation) -n 1 Destination IP (from office to AWS instance)
Once you know the optimal value, match it with the following formula.
MTU→ Optimum +8 (ICMP Header) +20 (IP Header) MSS→MTU-40 (TCP/IP Header)
Calculate the MTU/MSS value that should be set on the router and add that value to the config.
[shell] tunnel select 1 ip tunnel mtu MTU value to set ip tunnel tcp mss limit MSS value [/shell]
I think it is displayed properly when you connect remotely again and execute the command in the same way. (Don't forget to save at the end)
I was very helpful. MTU and MSS Settings in AWS VPC File Sharing Communication Between VPNs with Low MTUs Prevents Communication