https://www.softbank.jp/biz/blog/cloud-technology/articles/202212/alibaba-aws-vpn/
前提:
基礎ネットワークとEC2インスタンスはTerraformで作成
その他はCLIで作成
Alibaba VPN Gateway作成画面でService-linked Role作成済み
IPSec tunnel使用本数: 1本
macから実施
設定の流れ:
1. Alibaba Cloud側での設定
2. AWS側での設定
仮想プライベートゲートウェイ作成
カスタマーゲートウェイ作成
サイト間 VPN接続作成
3. Alibaba Cloud側での設定
Customer Gateways作成
IPsec Connection作成
4. 動作確認
AWS:
東京リージョン
VPC : 10.0.0.0/16
サブネット : 10.0.1.0/24
Security Group : ICMP,SSH
ASN: 64512
Alibaba:
北京リージョン
VPC : 172.16.0.0/16
vSwitch : 172.16.1.0/24
Security Group : ICMP,SSH
ASN: 65000
-- 1. VPC、サブネット、EC2インスタンス作成【AWS】
cat <<-'EOF' > main.tf
provider "aws" {
region = "ap-northeast-1"
}
resource "aws_vpc" "vpc01" {
cidr_block = "10.0.0.0/16"
enable_dns_support = true
enable_dns_hostnames = true
tags = {
Name = "vpc01"
}
}
resource "aws_subnet" "subnet01" {
vpc_id = aws_vpc.vpc01.id
availability_zone = "ap-northeast-1a"
cidr_block = "10.0.1.0/24"
tags = {
Name = "subnet01"
}
}
resource "aws_internet_gateway" "igw01" {
vpc_id = aws_vpc.vpc01.id
tags = {
Name = "igw01"
}
}
resource "aws_route_table" "rt01" {
vpc_id = aws_vpc.vpc01.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw01.id
}
tags = {
Name = "rt01"
}
}
resource "aws_route_table_association" "rt01_subnet01" {
route_table_id = aws_route_table.rt01.id
subnet_id = aws_subnet.subnet01.id
}
resource "aws_security_group" "sg01" {
name ="sg01"
vpc_id = aws_vpc.vpc01.id
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["172.16.1.0/24"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_instance" "vm01"{
ami = "ami-0404778e217f54308"
instance_type = "t3.nano"
key_name = "key1"
tags = {
Name = "vm01"
}
subnet_id = aws_subnet.subnet01.id
instance_market_options {
market_type = "spot"
spot_options {
spot_instance_type = "one-time"
}
}
vpc_security_group_ids =[aws_security_group.sg01.id]
associate_public_ip_address = true
}
EOF
cat <<-'EOF' > outputs.tf
output "vpc01_id" {
value = aws_vpc.vpc01.id
description = "vpc01.id"
}
output "aws_subnet_id" {
value = aws_subnet.subnet01.id
description = "subnet01.id"
}
EOF
terraform init
terraform fmt
terraform -version
terraform plan
terraform apply -auto-approve
# terraform destroy -auto-approve
cd ..
-- 2. VPC、VSwitch、ECS作成【Alibaba】
mkdir alibaba
cd alibaba
cat <<-'EOF' > variables.tf
locals {
availability_zone1 = "cn-beijing-k"
availability_zone2 = "cn-beijing-l"
}
variable "instance_type" {
description = "instance_type"
type = string
default = "ecs.t6-c4m1.large"
}
variable "image_id" {
description = "image_id"
type = string
default = "aliyun_2_1903_x64_20G_alibase_20231221.vhd"
}
EOF
cat <<-'EOF' > main.tf
terraform {
required_version = ">= 1.0.0, < 2.0.0"
required_providers {
alicloud = {
source = "aliyun/alicloud"
version = "= 1.217.0"
}
}
}
provider "alicloud" {
region = "cn-beijing"
}
resource "alicloud_vpc" "vpc01" {
vpc_name = "vpc01"
description = "vpc01"
cidr_block = "172.16.0.0/16"
}
resource "alicloud_vswitch" "sw01" {
vswitch_name = "sw01"
description = "sw01"
vpc_id = alicloud_vpc.vpc01.id
cidr_block = "172.16.1.0/24"
zone_id = local.availability_zone1
}
resource "alicloud_vswitch" "sw02" {
vswitch_name = "sw02"
description = "sw02"
vpc_id = alicloud_vpc.vpc01.id
cidr_block = "172.16.2.0/24"
zone_id = local.availability_zone2
}
resource "alicloud_security_group" "sg01" {
name = "sg01"
description = "sg01"
vpc_id = alicloud_vpc.vpc01.id
security_group_type = "normal"
}
resource "alicloud_security_group_rule" "sg0101" {
type = "ingress"
ip_protocol = "tcp"
port_range = "22/22"
security_group_id = alicloud_security_group.sg01.id
nic_type = "intranet"
policy = "accept"
priority = 10
cidr_ip = "0.0.0.0/0"
description = "sg0101"
}
resource "alicloud_security_group_rule" "sg0102" {
type = "ingress"
ip_protocol = "icmp"
port_range = "-1/-1"
security_group_id = alicloud_security_group.sg01.id
nic_type = "intranet"
policy = "accept"
priority = 10
cidr_ip = "10.0.1.0/24"
description = "sg0102"
}
resource "alicloud_vpc_ipv4_gateway" "gw01" {
ipv4_gateway_name = "gw01"
ipv4_gateway_description = "gw01"
vpc_id = alicloud_vpc.vpc01.id
enabled = true
}
# ルートテーブルへvSwitchの関連付け
resource "alicloud_route_table_attachment" "sw01_rt01" {
vswitch_id = alicloud_vswitch.sw01.id
route_table_id = alicloud_vpc.vpc01.route_table_id
}
# ルートテーブルへカスタムルート追加
resource "alicloud_route_entry" "rt0101" {
name = "rt0101"
route_table_id = alicloud_vpc.vpc01.route_table_id
destination_cidrblock = "0.0.0.0/0"
nexthop_type = "Ipv4Gateway"
nexthop_id = alicloud_vpc_ipv4_gateway.gw01.id
}
resource "alicloud_instance" "instance01" {
image_id = var.image_id
instance_type = var.instance_type
security_groups = [alicloud_security_group.sg01.id]
instance_name = "instance01"
system_disk_category = "cloud_essd"
system_disk_name = "instance01"
system_disk_size = 20
description = "instance01"
internet_charge_type = "PayByBandwidth"
internet_max_bandwidth_out = 0
host_name = "instance01"
vswitch_id = alicloud_vswitch.sw01.id
instance_charge_type = "PostPaid"
key_name = "alibabakey04"
deletion_protection = false
credit_specification = "Standard"
}
resource "alicloud_eip_address" "eip01" {
address_name = "eip01"
bandwidth = 1
deletion_protection = false
description = "eip01"
internet_charge_type = "PayByTraffic"
isp = "BGP"
payment_type = "PayAsYouGo"
netmode = "public"
}
# インスタンスとEIPの関連付け
resource "alicloud_eip_association" "instance01_eip01" {
instance_id = alicloud_instance.instance01.id
allocation_id = alicloud_eip_address.eip01.id
}
EOF
cat <<-'EOF' > outputs.tf
output "vpc01_id" {
value = alicloud_vpc.vpc01.id
description = "vpc01.id"
}
output "vpc01_route_table_id" {
value = alicloud_vpc.vpc01.route_table_id
description = "vpc01.route_table_id"
}
output "sw01_id" {
value = alicloud_vswitch.sw01.id
description = "sw01.id"
}
output "sw02_id" {
value = alicloud_vswitch.sw02.id
description = "sw02.id"
}
output "sg01_id" {
value = alicloud_security_group.sg01.id
description = "sg01.id"
}
output "gw01_id" {
value = alicloud_vpc_ipv4_gateway.gw01.id
description = "gw01.id"
}
output "instance01_id" {
value = alicloud_instance.instance01.id
description = "instance01.id"
}
output "eip01_id" {
value = alicloud_eip_address.eip01.id
description = "eip01.id"
}
EOF
terraform init
terraform fmt
terraform -version
terraform plan
terraform apply -auto-approve
# terraform destroy -auto-approve
cd ..
aliyun vpc CreateVpnGateway \
--Name vgw01 \
--VpcId vpc-111111111111111111111 \
--InstanceChargeType POSTPAY \
--AutoPay false \
--Bandwidth 10 \
--EnableIpsec true \
--EnableSsl false \
--VSwitchId vsw-111111111111111111111 \
--VpnType Normal \
--NetworkType public \
--DisasterRecoveryVSwitchId vsw-111111111111111111111 \
--force
※ コマンドは正常終了するが、DescribeVpnGatewaysしてもリソースは確認できない
→ GUIから実施
作成後、画面から「Enable Automatic Route 」有効化も必要
aliyun vpc DescribeVpnGateways
aliyun vpc DescribeVpnGateway \
--VpnGatewayId vpn-111111111111111111111
-- 4. 仮想プライベートゲートウェイ(VGW)作成【AWS】
aws ec2 create-vpn-gateway \
--availability-zone ap-northeast-1a \
--type ipsec.1 \
--tag-specifications 'ResourceType=vpn-gateway,Tags=[{Key=Name,Value=vgw01}]' \
--amazon-side-asn 64512
aws ec2 attach-vpn-gateway \
--vpc-id vpc-11111111111111111 \
--vpn-gateway-id vgw-11111111111111111
-- 5. カスタマーゲートウェイ(CGW)作成【AWS】
aws ec2 describe-customer-gateways
aws ec2 create-customer-gateway \
--bgp-asn 65000 \
--type ipsec.1 \
--tag-specifications 'ResourceType=customer-gateway,Tags=[{Key=Name,Value=cgw01}]' \
--ip-address 192.0.2.1
※ip-addressはAlibaba Cloud VPN GatewayのIP#1
aws ec2 describe-customer-gateways
aws ec2 create-vpn-connection \
--customer-gateway-id cgw-11111111111111111 \
--type ipsec.1 \
--vpn-gateway-id vgw-11111111111111111 \
--tag-specifications 'ResourceType=vpn-connection,Tags=[{Key=Name,Value=vpn01}]' \
--options TunnelOptions='[{TunnelInsideCidr=169.254.201.40/30,PreSharedKey=PreSharedKey1},{TunnelInsideCidr=169.254.151.56/30,PreSharedKey=PreSharedKey1}]'
aws ec2 describe-vpn-connections
aws ec2 get-vpn-connection-device-types
aws ec2 get-vpn-connection-device-types | grep -C 5 "Generic"
aws ec2 get-vpn-connection-device-sample-configuration \
--vpn-connection-id vpn-11111111111111111 \
--vpn-connection-device-type-id 9005b6c1 \
--internet-key-exchange-version ikev2 \
--output text
IPSec Tunnel #1 #2 の下記をメモ
-- 7. カスタマーゲートウェイ作成【Alibaba】
aliyun vpc CreateCustomerGateway \
--IpAddress 192.0.2.2 \
--Name cgw01 \
--Asn 64512
※ IpAddressはAWS Tunnel #1 のパブリックIPアドレス
aliyun vpc DescribeCustomerGateways
aliyun vpc DescribeCustomerGateway \
--CustomerGatewayId cgw-111111111111111111111
-- 8. IPsec Connection作成【Alibaba】
aliyun vpc CreateVpnConnection \
--region cn-beijing \
--RegionId 'cn-beijing' \
--CustomerGatewayId 'cgw-111111111111111111111' \
--VpnGatewayId 'vpn-111111111111111111111' \
--Name vpn01 \
--LocalSubnet '0.0.0.0/0' \
--RemoteSubnet '0.0.0.0/0' \
--EffectImmediately true \
--TunnelOptionsSpecification.1.TunnelBgpConfig.LocalAsn 65000 \
--TunnelOptionsSpecification.1.TunnelBgpConfig.LocalBgpIp '169.254.201.42' \
--TunnelOptionsSpecification.1.TunnelBgpConfig.TunnelCidr '169.254.201.40/30' \
--TunnelOptionsSpecification.1.CustomerGatewayId 'cgw-111111111111111111111' \
--TunnelOptionsSpecification.1.EnableDpd true \
--TunnelOptionsSpecification.1.EnableNatTraversal true \
--TunnelOptionsSpecification.1.Role master \
--TunnelOptionsSpecification.1.TunnelIkeConfig.IkeAuthAlg sha1 \
--TunnelOptionsSpecification.1.TunnelIkeConfig.IkeEncAlg aes \
--TunnelOptionsSpecification.1.TunnelIkeConfig.IkeLifetime 86400 \
--TunnelOptionsSpecification.1.TunnelIkeConfig.IkeMode main \
--TunnelOptionsSpecification.1.TunnelIkeConfig.IkePfs group2 \
--TunnelOptionsSpecification.1.TunnelIkeConfig.IkeVersion ikev2 \
--TunnelOptionsSpecification.1.TunnelIkeConfig.LocalId '192.0.2.1' \
--TunnelOptionsSpecification.1.TunnelIkeConfig.Psk PreSharedKey1 \
--TunnelOptionsSpecification.1.TunnelIkeConfig.RemoteId '192.0.2.2' \
--TunnelOptionsSpecification.1.TunnelIpsecConfig.IpsecAuthAlg sha1 \
--TunnelOptionsSpecification.1.TunnelIpsecConfig.IpsecEncAlg aes \
--TunnelOptionsSpecification.1.TunnelIpsecConfig.IpsecLifetime 86400 \
--TunnelOptionsSpecification.1.TunnelIpsecConfig.IpsecPfs group2 \
--TunnelOptionsSpecification.2.CustomerGatewayId 'cgw-111111111111111111111' \
--TunnelOptionsSpecification.2.EnableDpd true \
--TunnelOptionsSpecification.2.EnableNatTraversal true \
--TunnelOptionsSpecification.2.Role slave \
--TunnelOptionsSpecification.2.TunnelBgpConfig.LocalAsn 65000 \
--TunnelOptionsSpecification.2.TunnelBgpConfig.LocalBgpIp '169.254.151.58' \
--TunnelOptionsSpecification.2.TunnelBgpConfig.TunnelCidr '169.254.151.56/30' \
--TunnelOptionsSpecification.2.TunnelIkeConfig.IkeAuthAlg sha1 \
--TunnelOptionsSpecification.2.TunnelIkeConfig.IkeEncAlg aes \
--TunnelOptionsSpecification.2.TunnelIkeConfig.IkeLifetime 86400 \
--TunnelOptionsSpecification.2.TunnelIkeConfig.IkeMode main \
--TunnelOptionsSpecification.2.TunnelIkeConfig.IkePfs group2 \
--TunnelOptionsSpecification.2.TunnelIkeConfig.IkeVersion ikev2 \
--TunnelOptionsSpecification.2.TunnelIkeConfig.LocalId '192.0.2.3' \
--TunnelOptionsSpecification.2.TunnelIkeConfig.Psk PreSharedKey1 \
--TunnelOptionsSpecification.2.TunnelIkeConfig.RemoteId '192.0.2.4' \
--TunnelOptionsSpecification.2.TunnelIpsecConfig.IpsecAuthAlg sha1 \
--TunnelOptionsSpecification.2.TunnelIpsecConfig.IpsecEncAlg aes \
--TunnelOptionsSpecification.2.TunnelIpsecConfig.IpsecLifetime 86400 \
--TunnelOptionsSpecification.2.TunnelIpsecConfig.IpsecPfs group2 \
--force \
--EnableTunnelsBgp true
aliyun vpc DescribeVpnConnections
aliyun vpc DescribeVpnConnection \
--VpnConnectionId vco-111111111111111111
-- 9. VPN GatewayのPolicy-based Routing設定【Alibaba】
aliyun vpc CreateVpnPbrRouteEntry \
--VpnGatewayId vpn-111111111111111111111 \
--RouteSource "172.16.1.0/24" \
--RouteDest "10.0.1.0/24" \
--NextHop vco-111111111111111111 \
--Weight 100 \
--PublishVpc true \
--Priority 10
aliyun vpc DescribeVpnPbrRouteEntries \
--VpnGatewayId vpn-111111111111111111111
-- 10. BGPステータス確認【AWS】
aws ec2 describe-vpn-connections
-- 11. ルートテーブル修正
-- 11.1 Alibaba(172.16.1.0/24)への経路(ターゲットはVGW)をサブネットのルートテーブルに追加【AWS】
resource "aws_route_table" "rt01" {
vpc_id = aws_vpc.vpc01.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.igw01.id
}
route {
cidr_block = "172.16.1.0/24"
gateway_id = "vgw-11111111111111111"
}
tags = {
Name = "rt01"
}
}
terraform apply -auto-approve
-- 11.2 AWS側(10.0.1.0/24)への経路(ターゲットはVPN Gateway)をサブネットのルートテーブルに追加【Alibaba】
自動反映された模様
ping 172.16.1.110
-- 13. pingで疎通確認【Alibaba】
ping 10.0.1.188
-- 14. クリーンアップ【AWS】
-- VPN接続削除
aws ec2 describe-vpn-connections
aws ec2 delete-vpn-connection \
--vpn-connection-id vpn-11111111111111111
-- 仮想プライベートゲートウェイ削除(VPCからデタッチしてから)
aws ec2 detach-vpn-gateway \
--vpc-id vpc-11111111111111111 \
--vpn-gateway-id vgw-11111111111111111
aws ec2 delete-vpn-gateway \
--vpn-gateway-id vgw-11111111111111111
-- カスタマーゲートウェイ削除
aws ec2 describe-customer-gateways
aws ec2 delete-customer-gateway \
--customer-gateway-id cgw-11111111111111111
cd aws
terraform destroy -auto-approve
cd ..
-- 15. クリーンアップ【Alibaba】
-- Policy-based Routing削除
aliyun vpc DescribeVpnPbrRouteEntries \
--VpnGatewayId vpn-111111111111111111111
aliyun vpc DeleteVpnPbrRouteEntry \
--VpnGatewayId vpn-111111111111111111111 \
--RouteSource "172.16.1.0/24" \
--RouteDest "10.0.1.0/24" \
--NextHop vco-111111111111111111 \
--Weight 100 \
--Priority 10
-- IPsec Connection削除
aliyun vpc DescribeVpnConnections
aliyun vpc DeleteVpnConnection \
--VpnConnectionId vco-111111111111111111
-- Customer Gateways削除
aliyun vpc DescribeCustomerGateways
aliyun vpc DeleteCustomerGateway \
--CustomerGatewayId cgw-111111111111111111111
aliyun vpc DescribeVpnGateways
aliyun vpc DeleteVpnGateway \
--VpnGatewayId vpn-111111111111111111111
cd alibaba
terraform destroy -auto-approve
cd ..
