Versions Compared

Old Version 3

changes.mady.by.user Unknown User (yasker)

Saved on

compared with

New Version 4

changes.mady.by.user Unknown User (yasker)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • The software we used to support site-to-site VPN is OpenSwan.
  • Use preshared key(PSK).
  • The VPN protocol would be IPsec.
    • SSL is easier to penetrate firewall, but not interoperable standard.
  • Support Phase 1(ISAKMP) and phase 2(ESP) encryption/hash:
    • AES128, AES192, AES256, 3DES
    • MD5, SHA1
    • Diffie-Hellman: Group 2, Group 5.
  • Tables:
    • s2s_vpn_connection table
    • s2s_vpn_gateways
    • s2s_customer_gateways.
  • Remote subnets are needed, and traffic target to remote subnets would be sent to VPN. No routing-based VPN supported.
  • VPN connection monitor:
    • For every router.check.interval(30s by default), mgmt server would check the status of VPN connection. And if it's down, it would send out alert.
    • Mgmt server would only check the connections which states are "Connected" or "Disconnected". It would only change the state of VPN connection to one of these two states. It would not check connection in "Pending" or "Error" state.
    • One VPC router would only be checked if there are any implemented networks inside the VPC

Notes about VPN Connection:

...