{VPN}Site-to-Site VPN(AWS <-> OCI) - HTN20190109の日記

https://cloudii.jp/news/blog/aws/awsocivpn/
https://docs.oracle.com/ja-jp/iaas/Content/Network/Tasks/vpn_to_aws.htm
https://docs.oracle.com/ja-jp/iaas/Content/Network/Tasks/APIforIPsec.htm

OCI → サイト間VPNは無償サービスで、ポート時間料金はかかりません

前提:
基礎ネットワークとEC2インスタンスはTerraformで作成
その他はCLIで作成

macから実施

AWS側のASN: 64512

OCI側のASN: 31898

※OCI側のASNは固定値31898を使用する必要あり

IPSec tunnel使用本数: 1本

AWS側のサブネット: 10.0.0.0/24
OCI側のサブネット: 10.1.0.0/24

-- 1. VPC、サブネット、EC2インスタンス作成【AWS】

mkdir aws
cd aws

cat <<-'EOF' > main.tf

provider "aws" {
region = "ap-northeast-1"
}

resource "aws_vpc" "vpc01" {
cidr_block = "10.0.0.0/16"
enable_dns_support = true
enable_dns_hostnames = true

tags = {
Name = "vpc01"
}
}

resource "aws_subnet" "subnet01" {
vpc_id = aws_vpc.vpc01.id
availability_zone = "ap-northeast-1a"
cidr_block = "10.0.0.0/24"

tags = {
Name = "subnet01"
}
}

resource "aws_internet_gateway" "igw01" {
vpc_id = aws_vpc.vpc01.id

tags = {
Name = "igw01"
}
}

resource "aws_route_table" "rt01" {
vpc_id = aws_vpc.vpc01.id

route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw01.id
}

tags = {
Name = "rt01"
}
}

resource "aws_route_table_association" "rt01_subnet01" {
route_table_id = aws_route_table.rt01.id
subnet_id = aws_subnet.subnet01.id
}

resource "aws_security_group" "sg01" {
name ="sg01"
vpc_id = aws_vpc.vpc01.id

ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["10.1.0.0/24"]
}


egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}

resource "aws_instance" "vm01"{
ami = "ami-0404778e217f54308"
instance_type = "t3.nano"
key_name = "key1"

tags = {
Name = "vm01"
}
subnet_id = aws_subnet.subnet01.id
instance_market_options {
market_type = "spot"
spot_options {
spot_instance_type = "one-time"
}
}
vpc_security_group_ids =[aws_security_group.sg01.id]
associate_public_ip_address = true
}

EOF

terraform init
terraform fmt
terraform -version

terraform plan

terraform apply -auto-approve

# terraform destroy -auto-approve

cd ..

-- 2. VPC、サブネット、コンピュートインスタンス作成【OCI】

mkdir oci
cd oci

cat <<-'EOF' > variables.tf

locals {
tenancy_ocid = "ocid1.tenancy.oc1..000000000000000000000000000000000000000000000000000000000000"

}

variable "compartment_name" {
description = "compartment_name"
type = string
default = "cmp01"
}

EOF

cat <<-'EOF' > main.tf

terraform {
required_version = ">= 1.0.0, < 2.0.0"
required_providers {
oci = {
source = "hashicorp/oci"
version = "= 5.23.0"
}
}
}

provider "oci" {
tenancy_ocid = local.tenancy_ocid
user_ocid = "ocid1.user.oc1..000000000000000000000000000000000000000000000000000000000000"
private_key_path = "~/.oci/oci_api_key.pem"
fingerprint = "45:ed:22:e6:cc:fd:63:97:12:9d:62:7a:90:12:65:7a"
region = "us-ashburn-1"
}

resource "oci_identity_compartment" "cmp01" {
# Required
compartment_id = local.tenancy_ocid
description = var.compartment_name
name = var.compartment_name

enable_delete = true
}

resource "oci_core_vcn" "vcn01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id

#Optional
cidr_block = "10.1.0.0/16"
display_name = "vcn01"
dns_label = "vcn01"

}

resource "oci_core_internet_gateway" "igw01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id

#Optional
enabled = true
display_name = "igw01"
}

resource "oci_core_route_table" "rt01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id

#Optional
display_name = "rt01"
route_rules {
network_entity_id = oci_core_internet_gateway.igw01.id
destination = "0.0.0.0/0"
}

}

resource "oci_core_security_list" "sl01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id

#Optional
display_name = "sl01"

egress_security_rules {
protocol = "all"
destination = "0.0.0.0/0"
stateless = false
}

ingress_security_rules {
protocol = "6"
source = "0.0.0.0/0"
stateless = false
tcp_options {
max = 22
min = 22
}
}
ingress_security_rules {
protocol = "all"
source = "10.0.0.0/24"
stateless = false
}

}

resource "oci_core_subnet" "subnet01" {
#Required
cidr_block = "10.1.0.0/24"
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id

#Optional

display_name = "subnet01"
dns_label = "subnet01"
route_table_id = oci_core_route_table.rt01.id
security_list_ids = [oci_core_security_list.sl01.id]
}

data "oci_core_images" "ol9_latest" {
#Required
compartment_id = oci_identity_compartment.cmp01.id

#Optional
operating_system = "Oracle Linux"
operating_system_version = "9"
shape = "VM.Standard.E2.1"
sort_by = "TIMECREATED"
sort_order = "DESC"

filter {
name = "display_name"
values = ["Oracle-Linux-9.2-2023.*"]
regex = true
}

}

resource "oci_core_instance" "vm01" {
#Required
availability_domain = "OEIw:US-ASHBURN-AD-1"
compartment_id = oci_identity_compartment.cmp01.id
shape = "VM.Standard.E2.1"

agent_config {
plugins_config {
desired_state = "ENABLED"
name = "OS Management Service Agent"
}
plugins_config {
desired_state = "ENABLED"
name = "Compute Instance Run Command"
}
plugins_config {
desired_state = "ENABLED"
name = "Compute Instance Monitoring"
}

}

create_vnic_details {
#Optional
assign_public_ip = true
subnet_id = oci_core_subnet.subnet01.id
}

display_name = "vm01"
fault_domain = "FAULT-DOMAIN-1"

metadata = {
ssh_authorized_keys = file("~/.ssh/id_rsa.pub")
}

source_details {
#Required
source_id = data.oci_core_images.ol9_latest.images[0].id
source_type = "image"

#Optional
boot_volume_size_in_gbs = 50
}
preserve_boot_volume = false
}

EOF

cat <<-'EOF' > outputs.tf

output "cmp01_id" {
value = oci_identity_compartment.cmp01.id
description = "cmp01.id"
}

output "vcn01_id" {
value = oci_core_vcn.vcn01.id
description = "vcn01.id"
}

output "igw01_id" {
value = oci_core_internet_gateway.igw01.id
description = "igw01.id"
}
output "rt01_id" {
value = oci_core_route_table.rt01.id
description = "rt01.id"
}

output "sl01_id" {
value = oci_core_security_list.sl01.id
description = "sl01.id"
}

output "subnet01_id" {
value = oci_core_subnet.subnet01.id
description = "subnet01.id"
}

EOF

terraform init
terraform fmt
terraform -version

export TF_VAR_compartment_name=cmp01

terraform plan

terraform apply -auto-approve

# terraform destroy -auto-approve

cd ..

-- 3. ダミーのカスタマーゲートウェイ(CGW)作成【AWS】

aws ec2 create-customer-gateway \
--bgp-asn 31898 \
--type ipsec.1 \
--tag-specifications 'ResourceType=customer-gateway,Tags=[{Key=Name,Value=dummy}]' \
--ip-address 1.1.1.1

aws ec2 describe-customer-gateways

-- 4. 仮想プライベートゲートウェイ(VGW)作成【AWS】

aws ec2 create-vpn-gateway \
--availability-zone ap-northeast-1a \
--type ipsec.1 \
--tag-specifications 'ResourceType=vpn-gateway,Tags=[{Key=Name,Value=vgw01}]' \
--amazon-side-asn 64512

aws ec2 describe-vpn-gateways

aws ec2 attach-vpn-gateway \
--vpc-id vpc-11111111111111111 \
--vpn-gateway-id vgw-11111111111111111

-- 5. VPN接続の作成【AWS】

aws ec2 create-vpn-connection \
--customer-gateway-id cgw-11111111111111111 \
--type ipsec.1 \
--vpn-gateway-id vgw-11111111111111111 \
--tag-specifications 'ResourceType=vpn-connection,Tags=[{Key=Name,Value=vpn01}]'

aws ec2 describe-vpn-connections

aws ec2 get-vpn-connection-device-types
aws ec2 get-vpn-connection-device-types | grep -C 5 "Generic"

aws ec2 get-vpn-connection-device-sample-configuration \
--vpn-connection-id vpn-11111111111111111 \
--vpn-connection-device-type-id 9005b6c1 \
--internet-key-exchange-version ikev2 \
--output text

IPSec Tunnel #1の下記をメモ

Pre-Shared Key
仮想プライベート・ゲートウェイのパブリックIPアドレス
仮想プライベート・ゲートウェイのプライベートIPアドレス
カスタマー・ゲートウェイのプライベートIPアドレス
仮想プライベート・ゲートウェイのBGP ASN

-- 6.動的ルーティング・ゲートウェイ作成【OCI】

oci network drg create \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000 \
--display-name drg01

oci network drg list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

VCNへのDRGのアタッチ

oci network drg-attachment create --generate-full-command-json-input

oci network drg-attachment create \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--display-name drg0101 \
--network-details '{
"id": "ocid1.vcn.oc1.iad.000000000000000000000000000000000000000000000000000000000000",
"route-table-id": null,
"type": "VCN",
"vcn-route-type": "SUBNET_CIDRS"
}'

oci network drg-attachment list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

oci network drg-attachment get \
--drg-attachment-id ocid1.drgattachment.oc1.iad.000000000000000000000000000000000000000000000000000000000000

oci network drg get-all-drg-attachments \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000

oci network drg-route-table list \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000

-- 7. 顧客構内機器作成【OCI】

oci network cpe-device-shape list \
--query 'data.{"vendor":"cpe-device-info"."vendor","id":"id"}' \
--output table

oci network cpe create \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000 \
--ip-address 192.0.2.1 \
--display-name cpe01 \
--cpe-device-shape-id 0c14a129-ce70-43f3-bf07-e980a6784ae8

ip-addressはVGWの外部IPアドレス

oci network cpe list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

-- 8. サイト間VPN作成【OCI】

oci network ip-sec-connection create --generate-full-command-json-input

oci network ip-sec-connection create \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000 \
--cpe-id ocid1.cpe.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--static-routes '["10.0.0.0/24"]' \
--display-name vpn01 \
--tunnel-configuration '[
{
"associatedVirtualCircuits": ,
"bgpSessionConfig": {
"customerBgpAsn": "64512",
"customerInterfaceIp": "169.254.162.89/30",
"customerInterfaceIpv6": null,
"oracleInterfaceIp": "169.254.162.90/30",
"oracleInterfaceIpv6": null
},
"displayName": "tun01",
"dpdConfig": {
"dpdMode": "INITIATE_AND_RESPOND",
"dpdTimeoutInSec": "20"
},
"drgRouteTableId": null,
"encryptionDomainConfig": null,
"ikeVersion": "V2",
"natTranslationEnabled": "AUTO",
"oracleInitiation": "INITIATOR_OR_RESPONDER",
"oracleTunnelIp": null,
"phaseOneConfig": {
"authenticationAlgorithm": null,
"diffieHelmanGroup": null,
"encryptionAlgorithm": null,
"isCustomPhaseOneConfig": false,
"lifetimeInSeconds": "28800"
},
"phaseTwoConfig": {
"authenticationAlgorithm": null,
"encryptionAlgorithm": null,
"isCustomPhaseTwoConfig": false,
"isPfsEnabled": true,
"lifetimeInSeconds": "3600",
"pfsDhGroup": "GROUP5"
},
"routing": "BGP",
"sharedSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
]'

oci network ip-sec-connection list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

oci network ip-sec-tunnel list \
--ipsc-id ocid1.ipsecconnection.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--all

-- 9. カスタマーゲートウェイ(CGW)作成【AWS】
aws ec2 describe-customer-gateways

aws ec2 create-customer-gateway \
--bgp-asn 31898 \
--type ipsec.1 \
--tag-specifications 'ResourceType=customer-gateway,Tags=[{Key=Name,Value=cgw01}]' \
--ip-address 192.0.2.1

※ip-addressはOCIトンネル1のOracle VPN IPアドレス

aws ec2 describe-customer-gateways

-- 10. カスタマーゲートウェイ(CGW)の置き換え【AWS】

aws ec2 modify-vpn-connection \
--vpn-connection-id vpn-11111111111111111 \
--customer-gateway-id cgw-11111111111111111

置き換え後ダミーは削除

aws ec2 delete-customer-gateway \
--customer-gateway-id cgw-11111111111111111

-- 11. BGPステータス確認【AWS】

aws ec2 describe-vpn-connections

-- 12. ルートテーブル修正

-- 12.1 OCI(10.1.0.0/24)への経路(ターゲットはVGW)をサブネットのルートテーブルに追加【AWS】

resource "aws_route_table" "rt01" {
vpc_id = aws_vpc.vpc01.id

route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw01.id
}
route {
cidr_block = "10.1.0.0/24"
gateway_id = "vgw-11111111111111111"
}

tags = {
Name = "rt01"
}
}

terraform apply -auto-approve

-- 12.2 AWS側(10.0.0.0/24)への経路(ターゲットは動的ルーティング・ゲートウェイ)をサブネットのルートテーブルに追加【OCI】

resource "oci_core_route_table" "rt01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id

#Optional
display_name = "rt01"
route_rules {
network_entity_id = oci_core_internet_gateway.igw01.id
destination = "0.0.0.0/0"
}
route_rules {
network_entity_id = "ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000"
destination = "10.0.0.0/24"
}
}

terraform apply -auto-approve

-- 13.pingで疎通確認【AWS】

ping 10.1.0.241

-- 14. pingで疎通確認【OCI】

ping 10.0.0.39

-- 15. クリーンアップ【AWS】

-- VPN接続削除

aws ec2 describe-vpn-connections

aws ec2 delete-vpn-connection \
--vpn-connection-id vpn-11111111111111111

-- 仮想プライベートゲートウェイ削除(VPCからデタッチしてから)

aws ec2 describe-vpn-gateways

aws ec2 detach-vpn-gateway \
--vpc-id vpc-11111111111111111 \
--vpn-gateway-id vgw-11111111111111111

aws ec2 delete-vpn-gateway \
--vpn-gateway-id vgw-11111111111111111

-- カスタマーゲートウェイ削除

aws ec2 describe-customer-gateways

aws ec2 delete-customer-gateway \
--customer-gateway-id cgw-11111111111111111

cd aws

terraform destroy -auto-approve

cd ..

-- 16. クリーンアップ【OCI】

-- サイト間VPN削除

oci network ip-sec-connection list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

oci network ip-sec-connection delete \
--ipsc-id ocid1.ipsecconnection.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force

-- 顧客構内機器削除

oci network cpe list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

oci network cpe delete \
--cpe-id ocid1.cpe.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force

-- 動的ルーティング・ゲートウェイ削除(VCNからデタッチしてから)

oci network drg-attachment list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

oci network drg-attachment delete \
--drg-attachment-id ocid1.drgattachment.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force

oci network drg list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000

oci network drg delete \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force

cd oci

terraform destroy -auto-approve

cd ..