I have a VPN connection which is configured on our Juniper SSG5 and I need to move it to a server (since I can't add my own firewall to Amazon EC2). But I have not really an idea on how to do it or what to use.

Connection details:

  • Remote VPN router: Cisco 3825 - IOS 12.4 (at
  • IKE:
    • Main mode
    • AES256 - SHA1
    • PSK
    • DH group 5 (1536 bit)
    • SA lifetime: 86400s
  • IPSec
    • ESP
    • AES256 - SHA1
    • PFS group: 5 (1536 bit modp)
    • SA lifetime: 3600 sec, lifesize: 4194303 KB
  • Tunnels:
    • (remote) - (local)
    • (remote) - (local)

Note: it doesn't matter what runs on our side (OS or software). I was thinking of StrongSWAN on Linux.

Edit: All our servers (left side) will only communicate to our gateway and the gateway will communicate with VPN config

  • OK, just so this is straight, you have a system set up on the "local" end that talks to a "remote" network, and you are moving the "local" side to an Amazon EC2 instance? Is the entire /29 being moved to Amazon, or will you just need one instance on Amazon's side to communicate with the "remote" servers? – DerfK Jan 20 '11 at 16:51
  • @DerfK the entire local side is already on EC2, except for the VPN (and a proxy server that talks to the servers on the remote end). So it's only 1 server in /29, but the src-nat requires a /29 (or else phase 2 of the VPN won't come up). – Gert Jan 20 '11 at 16:57
  • this sounds like what Amazon is selling Amazon VPC for... aws.amazon.com/vpc/faqs – DerfK Jan 21 '11 at 0:35
  • @DerfK when using Amazon VPC I can't communicate with servers that aren't in the VPC. – Gert Jan 21 '11 at 8:39

Have tou looked on FreeBSD? http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.