https://cloudii.jp/news/blog/Azure/Azureocivpn/
https://docs.oracle.com/ja-jp/iaas/Content/Network/Tasks/vpn_to_azure.htm
https://learn.microsoft.com/ja-jp/azure/vpn-gateway/create-routebased-vpn-gateway-cli
https://learn.microsoft.com/ja-jp/azure/vpn-gateway/vpn-gateway-howto-aws-bgp
https://learn.microsoft.com/ja-jp/azure/virtual-network/virtual-networks-udr-overview#optional-default-routes
独自のカスタム APIPA アドレスを設定することもできます。
AWS では、トンネルごとに APIPA 範囲 169.254.0.0/16 の /30 Inside IPv4 CIDR が必要です。
また、この CIDR は、AZURE で予約されている VPN 用の APIPA 範囲 (169.254.21.0 から 169.254.22.255) 内にある必要があります。
AWS は CIDR 内の /30 の最初の IP アドレスを使用し、Azure は 2 番目の IP アドレスを使用します。
つまり、AWS /30 CIDR 内に 2 つの IP アドレス用の領域を予約する必要があります。
たとえば、AWS Inside IPv4 CIDR を 169.254.21.0/30 に設定した場合、
AWS は BGP IP アドレス 169.254.21.1 を使用し、Azure は IP アドレス 169.254.21.2 を使用します。
前提:
基礎ネットワークとEC2インスタンスはTerraformで作成
その他はCLIで作成
macから実施
Azure側のASN: 64514
OCI側のASN: 31898
※OCI側のASNは固定値31898を使用する必要あり
IPSec tunnel使用本数: 1本
Azure側のサブネット: 10.0.0.0/24
Azure側のゲートウェイサブネット: 10.0.1.0/24
OCI側のサブネット: 10.1.0.0/24
-- 1. VPC、サブネット、VMインスタンス作成【Azure】
mkdir azure
cd azure
cat <<-'EOF' > main.tf
terraform{
required_providers{
azurerm={
source = "hashicorp/azurerm"
version = "=3.6.0"
}
}
}
# Configure the Microsoft Azure Provider
provider "azurerm" {
features {}
}
resource "azurerm_resource_group" "rg9999999" {
name = "rg9999999"
location = "Japan East"
}
resource "azurerm_virtual_network" "vnet01" {
name = "vnet01"
address_space = ["10.0.0.0/16"]
location = azurerm_resource_group.rg9999999.location
resource_group_name = azurerm_resource_group.rg9999999.name
}
resource "azurerm_subnet" "subnet01" {
name = "subnet01"
resource_group_name = azurerm_resource_group.rg9999999.name
virtual_network_name = azurerm_virtual_network.vnet01.name
address_prefixes = ["10.0.0.0/24"]
}
resource "azurerm_subnet" "GatewaySubnet" {
name = "GatewaySubnet"
resource_group_name = azurerm_resource_group.rg9999999.name
virtual_network_name = azurerm_virtual_network.vnet01.name
address_prefixes = ["10.0.1.0/24"]
}
resource "azurerm_public_ip" "pip01" {
name = "pip01"
location = azurerm_resource_group.rg9999999.location
resource_group_name = azurerm_resource_group.rg9999999.name
allocation_method = "Dynamic"
}
resource "azurerm_network_security_group" "nsg01" {
name = "nsg01"
location = azurerm_resource_group.rg9999999.location
resource_group_name = azurerm_resource_group.rg9999999.name
security_rule {
name = "SSH"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "22"
source_address_prefix = "*"
destination_address_prefix = "*"
}
security_rule {
name = "OCI"
priority = 110
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "*"
source_address_prefix = "10.1.0.0/24"
destination_address_prefix = "*"
}
}
resource "azurerm_network_interface" "nic01" {
name = "nic01"
location = azurerm_resource_group.rg9999999.location
resource_group_name = azurerm_resource_group.rg9999999.name
ip_configuration {
name = "internal"
subnet_id = azurerm_subnet.subnet01.id
private_ip_address_allocation = "Dynamic"
public_ip_address_id = azurerm_public_ip.pip01.id
}
}
resource "azurerm_network_interface_security_group_association" "nsg01_nic01" {
network_interface_id = azurerm_network_interface.nic01.id
network_security_group_id = azurerm_network_security_group.nsg01.id
}
resource "azurerm_linux_virtual_machine" "vm01"{
name = "vm01"
resource_group_name = azurerm_resource_group.rg9999999.name
location = azurerm_resource_group.rg9999999.location
size = "Standard_B1ls"
admin_username = "azureuser"
network_interface_ids = [
azurerm_network_interface.nic01.id,
]
admin_ssh_key {
username = "azureuser"
public_key = file("~/.ssh/id_rsa.pub")
}
os_disk{
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference{
publisher = "Canonical"
offer = "0001-com-ubuntu-server-focal"
sku = "20_04-lts"
version = "latest"
}
}
output "public_ip_address" {
value = azurerm_linux_virtual_machine.vm01.public_ip_address
}
EOF
terraform init
terraform fmt
terraform -version
terraform plan
terraform apply -auto-approve
# terraform destroy -auto-approve
cd ..
-- 2. VPC、サブネット、コンピュートインスタンス作成【OCI】
mkdir oci
cd oci
cat <<-'EOF' > variables.tf
locals {
tenancy_ocid = "ocid1.tenancy.oc1..000000000000000000000000000000000000000000000000000000000000"
}
variable "compartment_name" {
description = "compartment_name"
type = string
default = "cmp01"
}
EOF
cat <<-'EOF' > main.tf
terraform {
required_version = ">= 1.0.0, < 2.0.0"
required_providers {
oci = {
source = "hashicorp/oci"
version = "= 5.23.0"
}
}
}
provider "oci" {
tenancy_ocid = local.tenancy_ocid
user_ocid = "ocid1.user.oc1..000000000000000000000000000000000000000000000000000000000000"
private_key_path = "~/.oci/oci_api_key.pem"
fingerprint = "45:ed:22:e6:cc:fd:63:97:12:9d:62:7a:90:12:65:7a"
region = "us-ashburn-1"
}
resource "oci_identity_compartment" "cmp01" {
# Required
compartment_id = local.tenancy_ocid
description = var.compartment_name
name = var.compartment_name
enable_delete = true
}
resource "oci_core_vcn" "vcn01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
#Optional
cidr_block = "10.1.0.0/16"
display_name = "vcn01"
dns_label = "vcn01"
}
resource "oci_core_internet_gateway" "igw01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id
#Optional
enabled = true
display_name = "igw01"
}
resource "oci_core_route_table" "rt01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id
#Optional
display_name = "rt01"
route_rules {
network_entity_id = oci_core_internet_gateway.igw01.id
destination = "0.0.0.0/0"
}
}
resource "oci_core_security_list" "sl01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id
#Optional
display_name = "sl01"
egress_security_rules {
protocol = "all"
destination = "0.0.0.0/0"
stateless = false
}
ingress_security_rules {
protocol = "6"
source = "0.0.0.0/0"
stateless = false
tcp_options {
max = 22
min = 22
}
}
ingress_security_rules {
protocol = "all"
source = "10.0.0.0/24"
stateless = false
}
}
resource "oci_core_subnet" "subnet01" {
#Required
cidr_block = "10.1.0.0/24"
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id
#Optional
display_name = "subnet01"
dns_label = "subnet01"
route_table_id = oci_core_route_table.rt01.id
security_list_ids = [oci_core_security_list.sl01.id]
}
data "oci_core_images" "ol9_latest" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
#Optional
operating_system = "Oracle Linux"
operating_system_version = "9"
shape = "VM.Standard.E2.1"
sort_by = "TIMECREATED"
sort_order = "DESC"
filter {
name = "display_name"
values = ["Oracle-Linux-9.2-2023.*"]
regex = true
}
}
resource "oci_core_instance" "vm01" {
#Required
availability_domain = "OEIw:US-ASHBURN-AD-1"
compartment_id = oci_identity_compartment.cmp01.id
shape = "VM.Standard.E2.1"
agent_config {
plugins_config {
desired_state = "ENABLED"
name = "OS Management Service Agent"
}
plugins_config {
desired_state = "ENABLED"
name = "Compute Instance Run Command"
}
plugins_config {
desired_state = "ENABLED"
name = "Compute Instance Monitoring"
}
}
create_vnic_details {
#Optional
assign_public_ip = true
subnet_id = oci_core_subnet.subnet01.id
}
display_name = "vm01"
fault_domain = "FAULT-DOMAIN-1"
metadata = {
ssh_authorized_keys = file("~/.ssh/id_rsa.pub")
}
source_details {
#Required
source_id = data.oci_core_images.ol9_latest.images[0].id
source_type = "image"
#Optional
boot_volume_size_in_gbs = 50
}
preserve_boot_volume = false
preemptible_instance_config {
preemption_action {
type = "TERMINATE"
preserve_boot_volume = false
}
}
}
EOF
cat <<-'EOF' > outputs.tf
output "cmp01_id" {
value = oci_identity_compartment.cmp01.id
description = "cmp01.id"
}
output "vcn01_id" {
value = oci_core_vcn.vcn01.id
description = "vcn01.id"
}
output "igw01_id" {
value = oci_core_internet_gateway.igw01.id
description = "igw01.id"
}
output "rt01_id" {
value = oci_core_route_table.rt01.id
description = "rt01.id"
}
output "sl01_id" {
value = oci_core_security_list.sl01.id
description = "sl01.id"
}
output "subnet01_id" {
value = oci_core_subnet.subnet01.id
description = "subnet01.id"
}
EOF
terraform init
terraform fmt
terraform -version
export TF_VAR_compartment_name=cmp01
terraform plan
terraform apply -auto-approve
# terraform destroy -auto-approve
cd ..
-- 3. パブリックIPアドレスを作成する【Azure】
az network public-ip create \
--name pip21 \
--resource-group rg9999999 \
--allocation-method Static \
--location japaneast \
--sku Standard \
--tier Regional \
--version IPv4
az network public-ip list
az network public-ip show --resource-group rg9999999 --name pip21
-- 4. 仮想ネットワークゲートウェイを作成する【Azure】
az network vnet-gateway create \
--name vng21 \
--resource-group rg9999999 \
--vnet vnet01 \
--asn 64514 \
--bgp-peering-address 169.254.21.2 \
--client-protocol IkeV2 \
--gateway-type Vpn \
--location japaneast \
--public-ip-address pip21 \
--sku VpnGw1 \
--vpn-gateway-generation Generation1 \
--vpn-type RouteBased
約30分かかった
az network vnet-gateway list --resource-group rg9999999
az network vnet-gateway show --resource-group rg9999999 --name vng21
-- 5. 動的ルーティング・ゲートウェイ作成 【OCI】
oci network drg create \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000 \
--display-name drg01
oci network drg list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
VCNへのDRGのアタッチ
oci network drg-attachment create --generate-full-command-json-input
oci network drg-attachment create \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--display-name drg0101 \
--network-details '{
"id": "ocid1.vcn.oc1.iad.000000000000000000000000000000000000000000000000000000000000",
"route-table-id": null,
"type": "VCN",
"vcn-route-type": "SUBNET_CIDRS"
}'
-- 6. 顧客構内機器作成【OCI】
oci network cpe-device-shape list \
--query 'data.{"vendor":"cpe-device-info"."vendor","id":"id"}' \
--output table
oci network cpe create \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000 \
--ip-address 192.0.2.1 \
--display-name cpe01 \
--cpe-device-shape-id 0c14a129-ce70-43f3-bf07-e980a6784ae8
ip-addressはAzureの仮想プライベート・ゲートウェイの外部IPアドレス
oci network cpe list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
-- 7. サイト間VPN作成【OCI】
oci network ip-sec-connection create --generate-full-command-json-input
oci network ip-sec-connection create \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000 \
--cpe-id ocid1.cpe.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--static-routes '["10.0.0.0/24"]' \
--display-name vpn01 \
--tunnel-configuration '[
{
"associatedVirtualCircuits": ,
"bgpSessionConfig": {
"customerBgpAsn": "64514",
"customerInterfaceIp": "169.254.21.2/30",
"customerInterfaceIpv6": null,
"oracleInterfaceIp": "169.254.21.1/30",
"oracleInterfaceIpv6": null
},
"displayName": "tun01",
"dpdConfig": {
"dpdMode": "INITIATE_AND_RESPOND",
"dpdTimeoutInSec": "20"
},
"drgRouteTableId": null,
"encryptionDomainConfig": null,
"ikeVersion": "V2",
"natTranslationEnabled": "AUTO",
"oracleInitiation": "INITIATOR_OR_RESPONDER",
"oracleTunnelIp": null,
"phaseOneConfig": {
"authenticationAlgorithm": "SHA2_384",
"diffieHelmanGroup": "GROUP24",
"encryptionAlgorithm": "AES_256_CBC",
"isCustomPhaseOneConfig": true,
"lifetimeInSeconds": "28800"
},
"phaseTwoConfig": {
"authenticationAlgorithm": null,
"encryptionAlgorithm": "AES_256_GCM",
"isCustomPhaseTwoConfig": true,
"isPfsEnabled": true,
"lifetimeInSeconds": "3600",
"pfsDhGroup": "GROUP24"
},
"routing": "BGP",
"sharedSecret": "PreSharedKey1"
}
]'
oci network ip-sec-connection list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
oci network ip-sec-tunnel list \
--ipsc-id ocid1.ipsecconnection.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--all
-- 8. ローカル ネットワーク ゲートウェイを作成する【Azure】
az network local-gateway create \
--gateway-ip-address 192.0.2.1 \
--name lng21 \
--resource-group rg9999999 \
--asn 31898 \
--bgp-peering-address 169.254.21.1 \
--location japaneast
※gateway-ip-addressはOCI側Tunnel #1の外部IPアドレス
az network local-gateway list --resource-group rg9999999
az network local-gateway show --resource-group rg9999999 --name lng21
-- 9. 接続を作成する【Azure】
az network vpn-connection create \
--name vpn21 \
--resource-group rg9999999 \
--vnet-gateway1 vng21 \
--enable-bgp \
--local-gateway2 lng21 \
--location japaneast \
--shared-key PreSharedKey1
az network vpn-connection list --resource-group rg9999999
az network vpn-connection show --resource-group rg9999999 --name vpn21
az network vpn-connection ipsec-policy add \
--connection-name vpn21 \
--dh-group DHGroup24 \
--ike-encryption AES256 \
--ike-integrity SHA384 \
--ipsec-encryption GCMAES256 \
--ipsec-integrity GCMAES256 \
--pfs-group PFS24 \
--resource-group rg9999999 \
--sa-lifetime 3600 \
--sa-max-size 28800
az network vpn-connection ipsec-policy list \
--connection-name vpn21 \
--resource-group rg9999999
-- 10. BGPステータス確認
【Azure】
az network vpn-connection show \
--name vpn21 \
--resource-group rg9999999
【OCI】
IPSecステータスとIPv4 BGPステータスが「稼働中」になるまで待つ
かなり待つ
-- 11. ルートテーブル修正
-- 11.1 OCI(10.1.0.0/24)への経路(ターゲットは仮想ネットワーク・ゲートウェイ)をサブネットのルートテーブルに追加【Azure】
自動で追加されるのため不要
-- 11.2 Azure側(10.0.0.0/24)への経路(ターゲットは動的ルーティング・ゲートウェイ)をサブネットのルートテーブルに追加【OCI】
resource "oci_core_route_table" "rt01" {
#Required
compartment_id = oci_identity_compartment.cmp01.id
vcn_id = oci_core_vcn.vcn01.id
#Optional
display_name = "rt01"
route_rules {
network_entity_id = oci_core_internet_gateway.igw01.id
destination = "0.0.0.0/0"
}
route_rules {
network_entity_id = "ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000"
destination = "10.0.0.0/24"
}
}
terraform apply -auto-approve
-- 12.pingで疎通確認【Azure】
ping 10.1.0.147
-- 13. pingで疎通確認【OCI】
ping 10.0.0.4
-- 14. クリーンアップ【Azure】
-- VPN接続削除
az network vpn-connection ipsec-policy list \
--connection-name vpn21 \
--resource-group rg9999999
az network vpn-connection ipsec-policy clear \
--connection-name vpn21 \
--resource-group rg9999999
az network vpn-connection list \
--resource-group rg9999999
az network vpn-connection delete \
--name vpn21 \
--resource-group rg9999999
-- ローカル ネットワーク ゲートウェイ削除
az network local-gateway list \
--resource-group rg9999999
az network local-gateway delete \
--name lng21 \
--resource-group rg9999999
-- 仮想ネットワークゲートウェイ削除
az network vnet-gateway list \
--resource-group rg9999999
az network vnet-gateway delete \
--name vng21 \
--resource-group rg9999999
-- パブリックIPアドレス削除
az network public-ip list \
--resource-group rg9999999
az network public-ip delete \
--name pip21 \
--resource-group rg9999999
cd azure
terraform destroy -auto-approve
cd ..
az group list
az group delete \
--name NetworkWatcherRG \
--yes
-- 15. クリーンアップ【OCI】
-- サイト間VPN削除
oci network ip-sec-connection list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
oci network ip-sec-connection delete \
--ipsc-id ocid1.ipsecconnection.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force
-- 顧客構内機器削除
oci network cpe list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
oci network cpe delete \
--cpe-id ocid1.cpe.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force
-- 動的ルーティング・ゲートウェイ削除(VCNからデタッチしてから)
oci network drg-attachment list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
oci network drg-attachment delete \
--drg-attachment-id ocid1.drgattachment.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force
oci network drg list \
--compartment-id ocid1.compartment.oc1..000000000000000000000000000000000000000000000000000000000000
oci network drg delete \
--drg-id ocid1.drg.oc1.iad.000000000000000000000000000000000000000000000000000000000000 \
--force
cd oci
terraform destroy -auto-approve
cd ..
