Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a VPN connection which is configured on our Juniper SSG5 and I need to move it to a server (since I can't add my own firewall to Amazon EC2). But I have not really an idea on how to do it or what to use.

Connection details:

  • Remote VPN router: Cisco 3825 - IOS 12.4 (at 10.1.0.1)
  • IKE:
    • Main mode
    • AES256 - SHA1
    • PSK
    • DH group 5 (1536 bit)
    • SA lifetime: 86400s
  • IPSec
    • ESP
    • AES256 - SHA1
    • PFS group: 5 (1536 bit modp)
    • SA lifetime: 3600 sec, lifesize: 4194303 KB
  • Tunnels:
    • 10.1.0.80 (remote) - 10.2.0.104/29 (local)
    • 10.1.0.81 (remote) - 10.2.0.104/29 (local)

Note: it doesn't matter what runs on our side (OS or software). I was thinking of StrongSWAN on Linux.

Edit: All our servers (left side) will only communicate to our gateway and the gateway will communicate with 10.1.10.80 VPN config

share|improve this question
    
OK, just so this is straight, you have a system set up on the "local" end that talks to a "remote" network, and you are moving the "local" side to an Amazon EC2 instance? Is the entire /29 being moved to Amazon, or will you just need one instance on Amazon's side to communicate with the "remote" servers? –  DerfK Jan 20 '11 at 16:51
    
@DerfK the entire local side is already on EC2, except for the VPN (and a proxy server that talks to the servers on the remote end). So it's only 1 server in /29, but the src-nat requires a /29 (or else phase 2 of the VPN won't come up). –  Gert Jan 20 '11 at 16:57
    
this sounds like what Amazon is selling Amazon VPC for... aws.amazon.com/vpc/faqs –  DerfK Jan 21 '11 at 0:35
    
@DerfK when using Amazon VPC I can't communicate with servers that aren't in the VPC. –  Gert Jan 21 '11 at 8:39
add comment

1 Answer

Have tou looked on FreeBSD? http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html

share|improve this answer
    
FreeBSD doesn't run on EC2 yet (or at least not production ready according to daemonology.net/freebsd-on-ec2) –  Gert Jan 20 '11 at 16:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.