<html><body><div>Hi Amos.. i meant to reply to you last week when i saw your mail but for reasons i couldn't.</div><div><br data-mce-bogus="1"></div><div>I wanted to reply because I have recently done this but using a Linux based firewall/router called VyOS to specifically connect to a VPC using Amazon's VPN device ,using BGP routing</div><div><br data-mce-bogus="1"></div><div>Important things you have to do/need to know.</div><div><br data-mce-bogus="1"></div><div>1. the MSS must be clamped to 1436 bytes, otherwise nothing will work - the tunnel wont come up properly,</div><div>you wont be able to pass traffic between the two networks and your BGP wont work either.</div><div><br data-mce-bogus="1"></div><div>2. you dont say in your posts previously but can you ping each host (ie host to AWS openswan box using the 169.254.x.x ip's ? between your two VPC's)</div><div><br data-mce-bogus="1"></div><div>If you have the correct icmp security group rules and you've disabled 'check source address' in your networking adapter on the instances, you should be able to.</div><div><br data-mce-bogus="1"></div><div>once that's done, you should try initiating the BGP configuration again. Typically I have noticed it takes between 30 seconds and a minute or so before your remote peer (thats the 169.254.44.121 ) picks up anything - you should be able to query quagga directly by a ttysh and issue a 'show ip bgp summary' and 'show ip bgp routes'. Personally I used VyOS because everything is contained and setup in that and the config syntax is very JunOS/cisco like.</div><div><br data-mce-bogus="1"></div><div>I also noticed that your quagga daemon config you've not setup your router id, in the config, you need to do that or the BGP negotiation won't work... i.e. config it to be 169.254.44.122/30 .. Try restarting quagga and bgpd and it should pick up if the IPsec parts are good.</div><div><br data-mce-bogus="1"></div><div>if you run 'ip route show' on Linux natively you'll see the routes for your VPC and try checking your VPC network security rules/groups for basic IP/ICMP/UDP connectivity..</div><div><br data-mce-bogus="1"></div><div>try this link (found using a google of "connecting linux openswan bgp aws vpc"</div><div><a href="http://blog.akquinet.de/2011/11/11/connecting-to-amazon-vpc/">http://blog.akquinet.de/2011/11/11/connecting-to-amazon-vpc/</a></div><div><br data-mce-bogus="1"></div><div>good luck</div><div><br data-mce-bogus="1"></div><div><br>On Feb 19, 2016, at 02:12 AM, Amos Shapira <amos.shapira@gmail.com> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div dir="ltr">I forgot to include the output of <b>"ipsec auto --status"</b>, which should be useful:<div><br></div><div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 stats db_ops: {curr_cnt, total_cnt, maxsz} :context={0,0,0} trans={0,0,0} attrs={0,0,0}</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-1": <a href="http://10.20.50.0/24===10.20.50.15[52.4.101.228]...52.7.165.219" data-mce-href="http://10.20.50.0/24===10.20.50.15[52.4.101.228]...52.7.165.219">10.20.50.0/24===10.20.50.15[52.4.101.228]...52.7.165.219</a><52.7.165.219>===<a href="http://10.20.30.0/24" data-mce-href="http://10.20.30.0/24">10.20.30.0/24</a>; erouted; eroute owner: #10</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-1": myip=unset; hisip=unset;</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-1": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-1": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: eth0;</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-1": newest ISAKMP SA: #12; newest IPsec SA: #10;</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-1": IKE algorithm newest: AES_CBC_128-SHA1-MODP2048</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-2": <a href="http://10.20.50.0/24===10.20.50.15[52.4.101.228]---169.254.44.209...54.173.211.136" data-mce-href="http://10.20.50.0/24===10.20.50.15[52.4.101.228]---169.254.44.209...54.173.211.136">10.20.50.0/24===10.20.50.15[52.4.101.228]---169.254.44.209...54.173.211.136</a><54.173.211.136>===<a href="http://10.20.30.0/24" data-mce-href="http://10.20.30.0/24">10.20.30.0/24</a>; unrouted; eroute owner: #0</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-2": myip=169.254.44.210; hisip=unset;</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-2": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-2": policy: PSK+ENCRYPT+TUNNEL+PFS+UP+IKEv2ALLOW+SAREFTRACK+lKOD+rKOD; prio: 24,24; interface: eth0;</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-2": newest ISAKMP SA: #11; newest IPsec SA: #0;</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 "amos-spoke-c-amos-hub-2": IKE algorithm newest: AES_CBC_128-SHA1-MODP2048</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 #12: "amos-spoke-c-amos-hub-1":4500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2393s; newest ISAKMP; lastdpd=0s(seq in:0 out:0); idle; import:admin initiate</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 #10: "amos-spoke-c-amos-hub-1":4500 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 820s; newest IPSEC; eroute owner; isakmp#9; idle; import:admin initiate</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 #10: "amos-spoke-c-amos-hub-1" <a href="mailto:esp.481523e2@52.7.165.219" data-mce-href="mailto:esp.481523e2@52.7.165.219">esp.481523e2@52.7.165.219</a> <a href="mailto:esp.fdb3b3d8@10.20.50.15" data-mce-href="mailto:esp.fdb3b3d8@10.20.50.15">esp.fdb3b3d8@10.20.50.15</a> <a href="mailto:tun.0@52.7.165.219" data-mce-href="mailto:tun.0@52.7.165.219">tun.0@52.7.165.219</a> <a href="mailto:tun.0@10.20.50.15" data-mce-href="mailto:tun.0@10.20.50.15">tun.0@10.20.50.15</a> ref=0 refhim=4294901761</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 #9: "amos-spoke-c-amos-hub-1":4500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_EXPIRE in 454s; lastdpd=151s(seq in:0 out:0); idle; import:admin initiate</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 #11: "amos-spoke-c-amos-hub-2":4500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 2162s; newest ISAKMP; lastdpd=730s(seq in:0 out:0); idle; import:admin initiate</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">000 #8: "amos-spoke-c-amos-hub-2":4500 STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_EXPIRE in 3s; lastdpd=3587s(seq in:0 out:0); idle; import:admin initiate</span></b></div></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><span face="arial, helvetica, sans-serif" data-mce-style="font-family: arial, helvetica, sans-serif;" style="font-family: arial, helvetica, sans-serif;">I notice that the first tunnel (the one which comes up) has </span><b style="font-family: monospace , monospace;" data-mce-style="font-family: monospace , monospace;">"myip=unset; hisip=unset;"</b><span face="arial, helvetica, sans-serif" data-mce-style="font-family: arial, helvetica, sans-serif;" style="font-family: arial, helvetica, sans-serif;"> is this significant? The other tunnel probably has "myip" set because I set leftsourceip as part of my experiments.</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 19 February 2016 at 12:58, Amos Shapira <span dir="ltr"><<a href="mailto:amos.shapira@gmail.com" data-mce-href="mailto:amos.shapira@gmail.com">amos.shapira@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0 0 0 0.8ex; border-left: 1px #ccc solid; padding-left: 1ex;" data-mce-style="margin: 0 0 0 0.8ex; border-left: 1px #ccc solid; padding-left: 1ex;"><div dir="ltr">Hello,<div><br></div><div>I got OpenSwan talking to AWS Virtual Gateway just fine, and can now route directly between two VPC's using static routes.</div><div>But I have to switch to BGP routing in order to do smarter routing (e.g. have a Virtual Gateway act as a hub between multiple VPC's and non-VPC networks).</div><div><br></div><div>I tried configuring bgpd from Quagga but it fails to initiate the connection, and I suspect that it might be related to the IPSec tunnel not having routable end-points(?)</div><div>(I might be talking rubbish here, I'm a noob when it comes to ipsec).</div><div><br></div><div>Here is the configuration I have in a test network. It's a VPC running OpenSwan on Ubuntu 14.04 on EC2 with a subnet of 10.20.50/24 and connecting to a Virtual GW in another VPC (the test "Hub") which has a subnet of 10.20.30/24).</div><div><br></div><div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">version 2.0</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">config setup</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>dumpdir=/var/run/pluto/</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>nat_traversal=yes</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.20.50.0/24" data-mce-href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.20.50.0/24">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10,%v4:!10.20.50.0/24</a></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>oe=off</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>protostack=netkey</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>interfaces=%defaultroute</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">include /etc/ipsec.d/*.conf</span></b></div></div><div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">conn amos-spoke-c-amos-hub-1</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> type=tunnel</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> authby=secret</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> forceencaps=yes</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> auto=start</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> left=%defaultroute</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> leftid=52.4.101.228</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> leftnexthop=%defaultroute</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> leftsubnet=<a href="http://10.20.50.0/24" data-mce-href="http://10.20.50.0/24">10.20.50.0/24</a></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> right=52.7.165.219</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> rightid=52.7.165.219</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> rightsubnet=<a href="http://10.20.30.0/24" data-mce-href="http://10.20.30.0/24">10.20.30.0/24</a></span></b></div></div><div><br></div><div><br></div><div>bgpd.conf:</div><div><br></div><div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">!</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">! Zebra configuration saved from vty</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">! 2016/02/18 05:51:54</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">!</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">hostname ip-10-20-50-15</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">password zebra</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">log stdout</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">!</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">debug bgp events</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">debug bgp keepalives</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">debug bgp updates</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">debug bgp fsm</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">debug bgp filters</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">!</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">router bgp 65102</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> bgp router-id 0.0.0.0</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> neighbor 169.254.44.121 remote-as 7224</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> neighbor 169.254.44.121 timers 10 30</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> neighbor 169.254.44.121 timers connect 30</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> neighbor 169.254.44.121 soft-reconfiguration inbound</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">!</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">line vty</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">!</span></b></div></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div>The VirtualGateway configuration in generic format is below (I tried to keep only relevant parts). I suspect that the issue boils down to that my configuration doesn't mention any of the "<b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Inside IP Addresses</span></b>" from that file, but I don't know how am I supposed to do that.</div><div><br></div><div>Could you please explain to me what should I change?</div><div><br></div><div>Thanks.</div><div><br></div><div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Amazon Web Services</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Virtual Private Cloud</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">IPSec Tunnel #1</span></b><br></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">================================================================================</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">#1: Internet Key Exchange Configuration</span></b></div><div><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> </span></b></span><br></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">...</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">The Customer Gateway and Virtual Private Gateway each have two addresses that relate</span></b><br></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">to this IPSec tunnel. Each contains an outside address, upon which encrypted</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">traffic is exchanged. Each also contain an inside address associated with</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">the tunnel interface.</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">The Customer Gateway outside IP address was provided when the Customer Gateway</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">was created. Changing the IP address requires the creation of a new</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Customer Gateway.</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">The Customer Gateway inside IP address should be configured on your tunnel</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">interface. </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Outside IP Addresses:</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Customer Gateway <span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span> : 52.4.101.228 </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Virtual Private Gateway<span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span> : 52.7.165.219</span></b></div><div><span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> </span></b></span><br></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Inside IP Addresses</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Customer Gateway <span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span>: <a href="http://169.254.44.122/30" data-mce-href="http://169.254.44.122/30">169.254.44.122/30</a></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Virtual Private Gateway : <a href="http://169.254.44.121/30" data-mce-href="http://169.254.44.121/30">169.254.44.121/30</a></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Configure your tunnel to fragment at the optimal size:</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Tunnel interface MTU : 1436 bytes</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">#4: Border Gateway Protocol (BGP) Configuration:</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">The Border Gateway Protocol (BGPv4) is used within the tunnel, between the inside</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">IP addresses, to exchange routes from the VPC to your home network. Each</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">BGP router has an Autonomous System Number (ASN). Your ASN was provided </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">to AWS when the Customer Gateway was created.</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">BGP Configuration Options:</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Customer Gateway ASN<span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span> : 65102 </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Virtual Private Gateway ASN : 7224</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Neighbor IP Address <span style="white-space: pre-wrap;" data-mce-style="white-space: pre-wrap;"> </span> : 169.254.44.121</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"> - Neighbor Hold Time : 30</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">Configure BGP to announce routes to the Virtual Private Gateway. The gateway</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">will announce prefixes to your customer gateway based upon the prefix you </span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">assigned to the VPC at creation time.</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;"><br></span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">...</span></b></div><div><b><span face="monospace, monospace" data-mce-style="font-family: monospace, monospace;" style="font-family: monospace, monospace;">(Tunnel 2 configuration removed)</span></b></div><div><br></div></div><div><div><br></div></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><a href="http://au.linkedin.com/in/gliderflyer" data-mce-href="http://au.linkedin.com/in/gliderflyer"><img src="https://static.licdn.com/scds/common/u/img/webpromo/btn_viewmy_160x25.png" data-mce-src="https://static.licdn.com/scds/common/u/img/webpromo/btn_viewmy_160x25.png"></a><br></div></div></div><div class="_stretch"><span class="body-text-content">_______________________________________________<br><a href="mailto:Users@lists.openswan.org" data-mce-href="mailto:Users@lists.openswan.org">Users@lists.openswan.org</a><br><a href="https://lists.openswan.org/mailman/listinfo/users" data-mce-href="https://lists.openswan.org/mailman/listinfo/users">https://lists.openswan.org/mailman/listinfo/users</a><br>Micropayments: <a href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy" data-mce-href="https://flattr.com/thing/38387/IPsec-for-Linux-made-easy">https://flattr.com/thing/38387/IPsec-for-Linux-made-easy</a><br>Building and Integrating Virtual Private Networks with Openswan:<br><a href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155" data-mce-href="http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155">http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155</a></span></div></div></blockquote></div></body></html>