AWS

This guide will show you how to connect your AWS cloud to the GoodAccess Gateway via a site-to-site connection using the IPsec protocol.

Cloud Limitation: Multiple Phase 2 Subnets (Security Associations)

Due to the architecture of public cloud VPN gateways, connections are generally restricted to a single Security Association (SA) per tunnel. If you configure a single Phase 1 connection with multiple Phase 2 subnets (creating multiple SAs), it will cause routing conflicts where usually only the most recently connected subnet remains active.

Recommendation: To ensure connection stability and comply with cloud provider requirements, set up a single, larger subnet that encompasses all your required subnets. Afterwards, configure Branch Segments on the GoodAccess side to properly manage and separate your traffic.

Step 1 - Creating a new cloud connection

Log in to the GoodAccess Control Panel, and go to Network > Clouds & Branches.

Click + Add new, enter a Name (e.g., AWS Production), select the required Gateway, and define the Subnets of your AWS VPC (using CIDR notation).

Choose IPSec Protocol, and click Continue.

Fill out the configuration form (Public IP, Pre-Shared Key, etc.). These parameters must match the configuration you will set in your AWS environment in the next steps.

Click Submit to finish, or Continue to define optional Branch Segments for finer access control.

You may return to the configuration via the Edit button of your Cloud at any time.

Example of configuration (Default preset):

• Shared Secret - Create a new strong password

• Public IP - IP of the tunnel of your AWS VPN connection

• IKE Lifetime (Phase 1) - 8 hours (28800 seconds)

• Tunnel Lifetime (Phase 2) - 1 hour (3600 seconds)

• Dead Peer Detection Delay - 30 seconds

• Encryption (Phase 1) - aes256

• Encryption (Phase 2) - aes256

• Integrity (Phase 1) - sha256

• Integrity (Phase 2) - sha256

• Diffie-Hellman Groups (Phase 1) - 16 - modp4096

• Diffie-Hellman Groups (Phase 2) - 16 - modp4096

Step 2 - Opening the VPC service

Log in to the AWS, and go to Services > VPC (you can use the searchbar).

Locating the VPC application

Step 3 - Creating a new customer gateway

Go to Virtual Private Network (VPN) > Customer Gateways and click Create customer gateway.

Give the customer gateway a name and set the configuration as follows:

• BGP ASN - 65000

• IP address - IP of your GoodAccess Gateway

Click Create customer gateway to confirm your settings.

Menu of VPC > VPN

Creating a customer gateway

Step 4 - Creating a new virtual private gateway

If you already have a virtual private gateway attached to your VPC, skip this section and continue with Step 5 - Creating a new VPN connection.

Go to Virtual Private Network (VPN) > Virtual Private Gateways and click Create virtual private gateway.

Give the virtual private gateway a name, and choose Amazon default ASN.

Click Create virtual private gateway to confirm your settings.

Select the newly created virtual private gateway and click Attach to VPC.

Creating a virtual private gateway

Attaching the virtual private gateway to VPC

Step 5 - Creating a new VPN connection

Go to Virtual Private Network (VPN) > Site-to-Site VPN Connections and click Create VPN connection.

Give the VPN connection a name and set the configuration as follows:

• Target gateway type - Virtual private gateway

• Customer gateway - Existing

• Routing options - Static

• Static IP prefixes - Subnet of your GoodAccess Gateway

Open Tunnel 1 options:

• Pre-Shared key for Tunnel 1 - Shared Secret (Step 1)

• Select Edit tunnel 1 options

• Phase I & II - Must match configuration from GoodAccess (Step 1)

Click Create VPN connection to confirm your settings.

Creating a VPN connection

Setting up the Phase 1 & 2 configuration

Step 6 - Adding new routes

If your AWS subnet is associated with multiple route tables, make sure to add the required routes to each of those route tables.

Go to Virtual Private Cloud (VPC) > Route Tables. Click Edit routes and Add the following routes:

Destination	Target
Subnet of VPC	Local (default)
0.0.0.0/0	Local Gateway (default)
Subnet of your GoodAccess Gateway	Virtual Private Gateway

Don't forget to Save changes.

Editing the routes

Adding new routes

You have now successfully connected your AWS cloud to GoodAccess.

Firewall rules

Make sure you allow connections from your GoodAccess Gateway private subnet to the resources in your VPC (e.g., virtual machines, databases, etc.).

Depending on your AWS security setup, you may need to allow this communication in:

• Security Groups

• Network ACLs

• AWS Network Firewall

You may check the status of the connection in:

• GoodAccess: Go to Control Panel > Network > Clouds & Branches to view the tunnel status. Use the Test Connection button to validate the IPsec tunnel itself, or optionally to test a specific system (target must have ICMP enabled).

• AWS: Go to Virtual Private Network (VPN) > Site-to-Site VPN Connections.