How do I download Site-to-Site VPN example configuration files?

Short description

Use the Download Configuration utility to download Site-to-Site VPN example configuration files for your customer gateway device. Use one of the following methods to access the Download Configuration utility:

• Amazon Virtual Private Cloud (Amazon VPC) console
• AWS Command Line Interface (AWS CLI)

For a list of available example configuration files, see Example configuration files.

Resolution

Prerequisite: Amazon VPC requires the following AWS Identity and Access Management (IAM) permissions to use the Download Configuration utility:

• ec2:GetVpnConnectionDeviceTypes
• ec2:GetVpnConnectionDeviceSampleConfiguration

If your IAM policy has an Amazon Elastic Compute Cloud (Amazon EC2) wildcard (*), then don't manually add these permissions.

Access the Download Configuration utility from the Amazon VPC console

1. Open the Amazon VPC console.
2. In the left navigation pane, under VIRTUAL PRIVATE NETWORK (VPN), choose Site-to-Site VPN Connections.
3. Choose the name of your VPN connection.
4. Choose Download Configuration.
5. For Vendor, select your Customer Gateway device vendor.
   -or-
   If your vendor isn't listed, then select Generic.
6. For Platform and Software, select your values.
7. For IKE Version, select your Internet Key Exchange (IKE) protocol version.
8. Choose Download.

Access the Download Configuration utility from the AWS CLI

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

To access the Download Configuration utility from the AWS CLI, complete the following steps:

1. Run the following get-vpn-connection-device-types command to list all available device configuration example files:

   aws ec2 get-vpn-connection-device-types --region aws-region

   Note: Replace aws-region with your AWS Region.

2. In the command output, make note of the VpnConnectionDeviceTypeId for your device. In the following example output, the VpnConnectionDeviceTypeId is 7125681a:

   .
   
   ...
   
   ....        
   
           },
   
           {
   
               "VpnConnectionDeviceTypeId": "7125681a",
   
               "Vendor": "Fortinet",
   
   
   
           "Platform": "Fortigate 40+ Series",
   
               "Software": "FortiOS 6.4.4+ (GUI)"
   
           },
   
           {
   
   
   
           "VpnConnectionDeviceTypeId": "9005b6c1",
   
               "Vendor": "Generic",
   
               "Platform": "Generic",
   
   
   
           "Software": "Vendor Agnostic"
   
           },
   
           {
   
               "VpnConnectionDeviceTypeId": "670add1b",
   
   
   
           "Vendor": "H3C",
   
               "Platform": "MSR800",
   
               "Software": "Version 5.20"
   
   
   
           },
   
           {
   
   ....
   
   ..
   
   .
   

3. Run the following get-vpn-connection-device-sample-configuration command to retrieve the example configuration files:

   aws ec2 get-vpn-connection-device-sample-configuration --vpn-connection-id vpn-id --vpn-connection-device-type-id device-type-id --internet-key-exchange-version ike-version --region aws-region --output text

   Note: Replace vpn-id with your VPN connection ID. Replace device-type-id with the Vendor:Platform:Software version that you noted in step 2. Replace device-type-id with your customer gateway device's type ID. Replace ike-version with your IKE version. Replace aws-region with your AWS Region.

Related information

How can I find the device specific VPN configuration file for my vendor?