0

I need to connect the system I'm helping develop that's deployed on AWS to another system through a VPN. Looking at the remote system VPN configuration I saw that it is based on a linux machine running strongSWAN. The authentication is done through pre-shared keys. Both systems need to exchange information but I don't know exactly at which rate.

Given this scenario, would it make sense to use the AWS VPN managed solution? Unless I missed something, it seems I should be able to connect the two of them through static routing. But according to the AWS documentation, the communication needs to be started from the other system, as the VPG cannot open the connection by itself. Which leaves me to implement a ping mechanism that would always depend on the other system starting a new connection whenever the previous one is broken. And I don't have access to the other system so I cannot create this mechanism.

Would it make more sense in this case to go the same route as the other system and just deploy a software VPN on an EC2 instance (or on many for high availability), strongSWAN or another?

Improve this question

1 Answer 1

Reset to default
0

If you only need two machines to communicate it might be cheaper to put StrongSwan on the AWS instance. If you need whole AWS network connectivity, redundancy of the AWS VPN, or to future proof it then an AWS VPN would make more sense.

You can connect StrongSwan to AWS VPN using info on this Wiki.

Improve this answer
2
  • I think I'm going to need redundancy but that should normally be just a second AWS instance and an extra route in the routing table. I'm not sure what you mean by future proofing it though. Are you talking about any extra needs in terms of performance and/or reliability or something else? And what about the problem with starting the connection? To me that's the main reason to go the strongSWAN route as using the site-to-site hardware VPN from AWS seems more straightforward to configure really.
    – Juan Vega
    Jul 11, 2020 at 11:58
  • It's easier to configure the AWS VPN once than configure StrongSwan on each AWS instance, which is what I meant by redundancy / future proof. AWS VPN is dual tunnel, to account for AWS hardware maintenance, best set up both tunnels if you use it. AWS VPN has a cost obviously, so cheaper to put VPN software onto instance.
    – Tim
    Jul 11, 2020 at 22:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .