Dynamic BGP based Site-to-Site VPN demo

https://github.com/acantril/learn-cantrill-io-labs/tree/master/aws-hybrid-bgpvpn

Participating in this demonstration enhanced my understanding of networking. Although it was time-consuming due to missing components in the lab environment, troubleshooting helped me become more proficient in using Linux commands and familiar with directory structures.

The initial phase of the demonstration involved setting up simulated OnPrem servers and AWS resources. StrongSwan was utilized to mimic OnPrem routers, followed by configuring Customer gateways and Transit gateways on the AWS console. Subsequently, AWS VPN endpoints were established, and VPC and VPN attachments were made to the Transit gateway. Upon completing the attachments, I downloaded a configuration file for each connection.

The configuration files contain certain values that need to be utilized for setting up the IPsec tunnels on the router instance. For each VGW to CGW connection, two IPsec tunnels are established and require configuration.

During this process, I faced challenges because the configuration and setup files such as ipsec.conf, ipsec-vti.sh, and ipsec.secrets were not included in the instance as recommended in the demo guide. I later discovered that the user data associated with the instances was linked to an outdated GitHub URL where these files were originally stored.

The url's in the user-data were missing 'tree' github.com/acantril/learn-cantrill-io-labs/tree/master/aws-hybrid-bgppn/OnPremRouter1

Below is the user data for router instance1

#!/bin/bash -xe apt-get update && apt-get install -y strongswan wget mkdir /home/ubuntu/demo_assets cd /home/ubuntu/demo_assets wget https://raw.githubusercontent.com/acantril/learn-cantrill-io-labs/master/aws-hybrid-bgpvpn/OnPremRouter1/ipsec-vti.sh 
wget https://raw.githubusercontent.com/acantril/learn-cantrill-io-labs/master/aws-hybrid-bgpvpn/OnPremRouter1/ipsec.conf 
wget https://raw.githubusercontent.com/acantril/learn-cantrill-io-labs/master/aws-hybrid-bgpvpn/OnPremRouter1/ipsec.secrets 
wget https://raw.githubusercontent.com/acantril/learn-cantrill-io-labs/master/aws-hybrid-bgpvpn/OnPremRouter1/51-eth1.yaml 
wget https://raw.githubusercontent.com/acantril/learn-cantrill-io-labs/master/aws-hybrid-bgpvpn/OnPremRouter1/ffrouting-install.sh chown ubuntu:ubuntu /home/ubuntu/demo_assets -R 
cp /home/ubuntu/demo_assets/51-eth1.yaml /etc/netplan 
netplan --debug apply

After correctly filling out the configuration files with the necessary values, I installed FRR on routers to enable BGP capability for exchanging routes and facilitating data flow between AWS and OnPrem instances.

Upon successful execution of the FRR script, I proceeded to manually configure BGP routing.

vtysh
conf t
frr defaults traditional
router bgp 65016
neighbor CONN2_TUNNEL1_AWS_BGP_IP remote-as 64512
neighbor CONN2_TUNNEL2_AWS_BGP_IP remote-as 64512
no bgp ebgp-requires-policy
address-family ipv4 unicast
redistribute connected
exit-address-family
exit
exit
wr
exit

Following this, I successfully pinged the OnPrem instance from the AWS server via VPN and vice versa.

AWS server pinging OnPrem Server

OnPrem pinging AWS server

This was hands-on and impressive, despite encountering a few challenges that were a bit frustrating. However, it was incredibly satisfying to see it working in the end!