Amazon Virtual Private Cloud (Amazon VPC) とVPN接続する｜クラウド接続の設定｜設定例｜ルータ・ネットワーク機器

Amazon Virtual Private Cloud(Amazon VPC)とVPN接続するための設定例です。

Amazon Virtual Private Cloud（Amazon VPC）では、Amazon Web Services（AWS）のプライベートで孤立したセクションを作成することができます。詳細は下記Webサイトをご参照ください。

Amazon Virtual Private Cloud（AWSサイト）

補足・注意点

AWSコンソール手順書にしたがって、Amazon VPCおよびAmazon EC2（Amazon Elastic Compute Cloud）の設定を行えば、構成図のようにAmazon VPCとVPN接続して、インスタンスを利用することが可能です。

AWSコンソール手順書：VPCの設定

設定例
Amazon Virtual Private Cloud (Amazon VPC) とVPN接続する

<pre>
access-list 100 permit udp host ##Tunnel#1_Outside_IP(Virtual_Private_Gateway)## eq 500 any eq 500
access-list 100 permit udp host ##Tunnel#2_Outside_IP(Virtual_Private_Gateway)## eq 500 any eq 500
access-list 100 permit 50 host ##Tunnel#1_Outside_IP(Virtual_Private_Gateway)## any
access-list 100 permit 50 host ##Tunnel#2_Outside_IP(Virtual_Private_Gateway)## any
access-list 111 deny udp any eq 135 any
access-list 111 deny udp any any eq 135
access-list 111 deny tcp any eq 135 any
access-list 111 deny tcp any any eq 135
access-list 111 deny udp any range 137 139 any
access-list 111 deny udp any any range 137 139
access-list 111 deny tcp any range 137 139 any
access-list 111 deny tcp any any range 137 139
access-list 111 deny udp any eq 445 any
access-list 111 deny udp any any eq 445
access-list 111 deny tcp any eq 445 any
access-list 111 deny tcp any any eq 445
access-list 112 deny ip 192.168.0.0 0.0.0.255 any
access-list 112 permit icmp any 192.168.0.0 0.0.0.255
access-list 113 spi tcp any any eq ftp
access-list 113 spi tcp any any eq ftp-data
access-list 113 spi tcp any any eq www
access-list 113 spi udp any any eq domain
access-list 113 spi tcp any any eq smtp
access-list 113 spi tcp any any eq pop3
access-list 113 spi tcp any any eq 587
access-list 113 spi tcp any any
access-list 113 spi udp any any
access-list 114 permit ip any any
access-list 115 deny ip any any
!
ip route 0.0.0.0 0.0.0.0 tunnel 3
ip nat list 1 192.168.100.0 0.0.0.255
!
logging buffer level informational
!
aaa authentication login default local
aaa authorization exec default local
!
username guest password guest-secret
!
hostname FITELnet
!
crypto ipsec policy IPSECPOL_001
 set pfs group14
 set security-association always-up
 set security-association rekey always
 set security-association lifetime seconds 3600
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
exit
!
crypto ipsec policy IPSECPOL_002
 set pfs group14
 set security-association always-up
 set security-association rekey always
 set security-association lifetime seconds 3600
 set security-association transform-keysize aes 256 256 256
 set security-association transform esp-aes esp-sha256-hmac
 set mtu 1454
exit
!
crypto ipsec selector SELECTOR_1
 src 1 ipv4 any
 dst 1 ipv4 any
exit
!
crypto isakmp log sa
crypto isakmp log session
crypto isakmp log negotiation-fail
crypto isakmp negotiation retry timer 10 limit 3 timer-max 30 guard-time 0
crypto isakmp negotiation always-up-params interval 1000 max-initiate 10 max-pending 10 delay 1
!
crypto isakmp policy ISAPOL_001
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 28800
 hash sha-256
 initiate-mode main
exit
!
crypto isakmp policy ISAPOL_002
 authentication pre-share
 encryption aes
 encryption-keysize aes 256 256 256
 group 14
 lifetime 28800
 hash sha-256
 initiate-mode main
exit
!
crypto isakmp profile ISAPROF_001
 match identity address ##Tunnel#1_Outside_IP(Virtual_Private_Gateway)##
 keepalive interval 10
 set isakmp-policy ISAPOL_001
 set ipsec-policy IPSECPOL_001
 set peer ##Tunnel#1_Outside_IP(Virtual_Private_Gateway)##
 ike-version 1
 local-key ascii ##Tunnel#1_Pre-Shared_Key##
exit
!
crypto isakmp profile ISAPROF_002
 match identity address ##Tunnel#2_Outside_IP(Virtual_Private_Gateway)##
 keepalive interval 10
 set isakmp-policy ISAPOL_002
 set ipsec-policy IPSECPOL_002
 set peer ##Tunnel#2_Outside_IP(Virtual_Private_Gateway)##
 ike-version 1
 local-key ascii ##Tunnel#2_Pre-Shared_Key##
exit
!
crypto map MAP1 ipsec-isakmp
 match address SELECTOR_1
 set isakmp-profile ISAPROF_001
exit
!
crypto map MAP2 ipsec-isakmp
 match address SELECTOR_1
 set isakmp-profile ISAPROF_002
exit
!
interface GigaEthernet 1/1
 vlan-id 1
 bridge-group 1
 channel-group 1
exit
!
interface GigaEthernet 2/1
 vlan-id 2
 bridge-group 2
 pppoe enable
exit
!
interface Port-channel 1
 ip address 192.168.100.1 255.255.255.0
 mss 1350
exit
!
interface Tunnel 1
 ip address ##Tunnel#1_Inside IP(Customer_Gateway)##
 tunnel mode ipsec map MAP1
 link-state sync-sa
exit
!
interface Tunnel 2
 ip address ##Tunnel#2_Inside_IP(Customer_Gateway)##
 tunnel mode ipsec map MAP2
 link-state sync-sa
exit
!
interface Tunnel 3
 ip access-group 100 in
 ip access-group 111 out
 ip access-group 112 in
 ip access-group 113 out
 ip access-group 114 out
 ip access-group 115 in
 ip access-group spi ftp-data enable
 ip nat inside source list 1 interface
 tunnel mode pppoe profile PPPOE_PROF0001
 pppoe interface gigaethernet 2/1
exit
!
router bgp 65000
 bgp router-id 192.168.100.1
 bgp log-neighbor-changes
 neighbor ##Tunnel#1_Inside_IP(Virtual_Private_Gateway)## remote-as 64512
 neighbor ##Tunnel#1_Inside_IP(Virtual_Private_Gateway)## timers 10 30
 neighbor ##Tunnel#2_Inside_IP(Virtual_Private_Gateway)## remote-as 64512
 neighbor ##Tunnel#2_Inside_IP(Virtual_Private_Gateway)## timers 10 30
 !
 address-family ipv4 unicast
  neighbor ##Tunnel#1_Inside_IP(Virtual_Private_Gateway)## activate
  neighbor ##Tunnel#2_Inside_IP(Virtual_Private_Gateway)## activate
  network 192.168.100.0 255.255.255.0
 exit
 !
exit
!
pppoe profile PPPOE_PROF0001
 account user@xxxx.ne.jp secret
exit
!
end
</pre>

ページの先頭へ

Amazon Virtual Private Cloud (Amazon VPC) とVPN接続する対象装置：F70/F71/F220/F221/F220 EX/F221 EX

補足・注意点