3

I need to prototype a solution using Amazon VPC - what's the least expensive option available to create a VPC gateway on our side for the test lab?

I realize there are probably free VPN gateways (Vyatta comes to mind) but being that I'm not a VPN ninja, just looking for the easiest, nearly cut-n-paste way to get the connection set up, then just add the routing entries on our LAN to get started.

Brandon
  • 2,817
  • 1
  • 24
  • 28
  • Update: Since September 13th 2012 Amazon also supports IPsec VPNs with static routing, making it much easier to connect either with software of cheaper hardware. For example, the Cisco ASA which doesn't support BGP routing can now connect via IPsec VPN with static routing. See http://aws.amazon.com/about-aws/whats-new/2012/09/13/RDS-SQL-Server-IPsec-VPN-Route-Propagation-Support-for-Amazon-VPC/ – Martijn Heemels Dec 07 '12 at 14:43

4 Answers4

2

Open source IPSEC solutions like Open Swan running on any old linux machine will definitely do the trick. There have been several people on the Open Swan mailing list that have posted questions about doing this and eventually succeeded. Expect a complex setup process though and you'll need to be/become familiar with some lower-level network details (or pay a consultant) to be successful.

Alternatively I think this can be accomplished via a commercial product called VPN Cubed.

Wes Winham
  • 136
  • 2
1

What router do you have available in your test lab? Early in our evaluation of VPC I was wondering the same thing, and realised that our router (which is a Juniper, running ScreenOS) is on the Amazon approved list, so it was straight-forward; more-so that I would have thought, anyway. Failing that, you're back to Wes' answer above, i.e. software solutions like OpenSwan.

Geoff
  • 161
  • 6
1

Otherwise try getting a Mikrotik router to work. They can also handle the local routing nicely, as well as more compelx scenarios. I have 3 in use so far (office, data center, external project office) and will add nother 2 next month (another project office and a data center we build) and the prie / power combo is VERY hard to beat.

TomTom
  • 51,649
  • 7
  • 54
  • 136
0

An Amazon 'Virtual Private Cloud' (VPC) is simply a IPSec VPN between your EC2 network and your on-premise network. So you question basically is "What's the cheapest way to support IPSec VPNs?". IPSec is an open standard that's very widely supported.

The absolute cheapest:

The more conventional/better choice: Almost all currently shipping firewalls from vendors like Cisco, Juniper etc support IPSec.

Setting up IPSec VPNs can be tricky, because there are many implementation details to get lost in. Be careful about optimizing too much for equipment cost, and all of a sudden spending lots of man-hours instead.

My personal choice would be to hire a consultant who knows Cisco gear & VPNs, and use a low-cost device with the common Cisco command line, fx the Cisco ASA 5505 firewall.

  • 1
    The Cisco ASA doesn't support BGP, so it's not a suitable device for the Amazon VPC with hardware VPN. – crb May 04 '12 at 14:04
  • 1
    Update: Since September 13th 2012 Amazon also supports IPsec VPNs with static routing, making it much easier to connect either with software of cheaper hardware. For example, the Cisco ASA which doesn't support BGP routing can now connect via IPsec VPN with static routing. See http://aws.amazon.com/about-aws/whats-new/2012/09/13/RDS-SQL-Server-IPsec-VPN-Route-Propagation-Support-for-Amazon-VPC/ – Martijn Heemels Dec 07 '12 at 14:44