up vote 0 down vote favorite
share [g+] share [fb]

I have a VPN connection which is configured on our Juniper SSG5 and I need to move it to a server (since I can't add my own firewall to Amazon EC2). But I have not really an idea on how to do it or what to use.

Connection details:

  • Remote VPN router: Cisco 3825 - IOS 12.4 (at 10.1.0.1)
  • IKE:
    • Main mode
    • AES256 - SHA1
    • PSK
    • DH group 5 (1536 bit)
    • SA lifetime: 86400s
  • IPSec
    • ESP
    • AES256 - SHA1
    • PFS group: 5 (1536 bit modp)
    • SA lifetime: 3600 sec, lifesize: 4194303 KB
  • Tunnels:
    • 10.1.0.80 (remote) - 10.2.0.104/29 (local)
    • 10.1.0.81 (remote) - 10.2.0.104/29 (local)

Note: it doesn't matter what runs on our side (OS or software). I was thinking of StrongSWAN on Linux.

Edit: All our servers (left side) will only communicate to our gateway and the gateway will communicate with 10.1.10.80 VPN config

link|improve this question
OK, just so this is straight, you have a system set up on the "local" end that talks to a "remote" network, and you are moving the "local" side to an Amazon EC2 instance? Is the entire /29 being moved to Amazon, or will you just need one instance on Amazon's side to communicate with the "remote" servers? – DerfK Jan 20 '11 at 16:51
@DerfK the entire local side is already on EC2, except for the VPN (and a proxy server that talks to the servers on the remote end). So it's only 1 server in /29, but the src-nat requires a /29 (or else phase 2 of the VPN won't come up). – Gert Jan 20 '11 at 16:57
this sounds like what Amazon is selling Amazon VPC for... aws.amazon.com/vpc/faqs – DerfK Jan 21 '11 at 0:35
@DerfK when using Amazon VPC I can't communicate with servers that aren't in the VPC. – Gert Jan 21 '11 at 8:39
feedback

1 Answer

up vote 0 down vote

Have tou looked on FreeBSD? http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html

link|improve this answer
FreeBSD doesn't run on EC2 yet (or at least not production ready according to daemonology.net/freebsd-on-ec2) – Gert Jan 20 '11 at 16:46
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.