Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When connecting a customer gateway to a VPC VPN, what hardware or software is providing the service on Amazon's side?

share|improve this question

closed as off topic by RobM, joeqwerty, Smudge, sysadmin1138 Feb 9 '12 at 19:12

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Have you tried asking Amazon? – gekkz Feb 8 '12 at 11:39
A ticket is open with them. – xddsg Feb 8 '12 at 13:43
Yeah - unless someone on this site 1) works for Amazon and 2) is willing to tell you, none of us can know. Additionally, if they answer "FooBlaz 2000", they could switch that out next week and the answer will then be wrong. – mfinni Feb 8 '12 at 14:33
up vote 2 down vote accepted

That should be none of your concerns actually ;)

I'm not trying to be mean here, but in a proper Service-oriented Architecture (SOA) you should only need to know respective contracts/interfaces/protocols to obey, alongside some Service-level Agreement (SLA) eventually.

In addition, Amazon is notoriously secretive about the actual hardware in use, e.g. many have speculated about this regarding the Amazon Elastic Compute Cloud (Amazon EC2) and they have never specified it in other than comparative terms, e.g. their EC2 Compute Unit (ECU) is defined as:

EC2 Compute Unit (ECU) – One EC2 Compute Unit (ECU) provides the equivalent CPU capacity of a 1.0-1.2 GHz 2007 Opteron or 2007 Xeon processor.

You might try to deduce the Amazon Virtual Private Cloud (VPC) hardware accordingly via the information in Customer Gateway Devices We've Tested and the respective Requirements for Your Customer Gateway, which is the closest indication available I think. Further, you might want to have a look at A Detailed View of the Customer Gateway and an Example Configuration, which includes an architecture diagram.

Most notably, Amazon VPC requires support for establishing Border Gateway Protocol (BGP) peerings:

BGP is used to exchange routes between the customer gateway and virtual private gateway. All BGP traffic is encrypted and transmitted via the IPsec Security Association. BGP is required for both gateways to exchange the IP prefixes reachable via the IPsec SA.

Unfortunately BGP is not implemented in many consumer-level VPN devices, thus requires respective professional hardware or software VPN appliances.


AWS has just dropped the requirement to establish Border Gateway Protocol (BGP) peerings in order to use the built in VPN connectivity to an Amazon Virtual Private Cloud (VPC), see Amazon VPC - Additional VPN Features:

You can now create Hardware VPN connections to your VPC using static routing. This means that you can establish connectivity using VPN devices that do not support BGP such as Cisco ASA and Microsoft Windows Server 2008 R2. You can also use Linux to establish a Hardware VPN connection to your VPC. In fact, any IPSec VPN implementation should work. [emphasis mine]

The outlined reason for this change specifically highlights BGP as a previous barrier to adoption of this otherwise very appealing VPN connectivity to a VPC:

First, BGP can be difficult to set up and to manage, [...]. Second, some firewalls and entry-level routers support IPSec but not BGP. These devices are very popular in corporate branch offices. As I mentioned above, this change dramatically increases the number of VPN devices that can be used to connect to a VPC. [...]

I couldn't agree more, accordingly I'm looking forward to facilitate this built in VPN connectivity in a lot more commonly encountered scenarios.

share|improve this answer
"That should be none of your concerns actually" > The intent of the OP's question might be pure curiosity, in which case it is a concern :) – talonx Sep 13 '13 at 13:06

I asked in a premium support ticket.

Their response was that the policy was not to disclose the information and, regardless, that the support department was not privy to all of the technical details - the VPC knowledge is kept by the VPC team.

Anecdotally, they suggested it was currently (as of Q1 2012) high-end branded gear/software rather than anything bespoke.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.