Policy based VPN in AWS

Question

A customer wants to establish policy based VPN connectivity from AWS to their data center.  I  looked at various documentation and still cannot determine whether we can support this or not.  Here are the links I’ve reviewed so far:
 
http://www.mycodingpains.com/establish-policy-based-vpn-connection-aws-hardware-vpn/
https://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/GenericConfigNoBGP.html#DetailedViewCustomerGateway6
 
questions are:
 
Can we do this with AWS   
What configuration setting makes the VPN setup policy based?  Route based?
 
Thank you

Michal B · Accepted Answer

AWS Supports both Route based and Policy Based VPN (IPSec).
If a customer wants to create Policy Based - that's perfectly fine, but there are some limitations.

We support 1 Security Association, customer needs to initiate the traffic (we are responder only),
only one tunnel will be UP in Policy-Based.

Here you can find all the requirement:
https://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Introduction.html#CGRequirements

> you are limited to 1 unique Security Association (SA) pair per tunnel (1 inbound and 1 outbound), and therefore 2 unique SA pairs in total for 2 tunnels (4 SAs). Some devices use policy-based VPN and will create as many SAs as ACL entries. Therefore, you may need to consolidate your rules and then filter so you don't permit unwanted traffic.

What is the device that customer is using on a customer site?

Here is sample config for Policy-based VPN for Cisco ASA:
https://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Cisco_ASA.html

Lorenzo · Answer

Is the above answer still valid? On the documentation I am finding conflicting information:

https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html

**Local IPv4 Network CIDR**

(IPv4 VPN connection only) The CIDR range used during IKE phase 2 negotiation for the customer (on-premises) side of the VPN tunnel. This range is used to propose routes but does not enforce traffic restrictions since AWS uses route-based VPNs exclusively.** Policy-based VPNs are not supported** as they would limit AWS' ability to support dynamic routing protocols and multi-region architectures.

**Remote IPv4 Network CIDR**

(IPv4 VPN connection only) The CIDR range used during IKE phase 2 negotiation for the AWS side of the VPN tunnel. This range is used to propose routes but does not enforce traffic restrictions since AWS uses route-based VPNs exclusively. **AWS does not support policy-based VPNs** because they lack the flexibility required for complex routing scenarios and are incompatible with features like transit gateways and VPN

Thanks

Kyle Li · Answer

I tested with strongSwan, got support from AWS support, and think the accepted answer can be updated a little bit.
1. Only one subnet can be in remote_ipv4_network_cidr / local_ipv4_network_cidr. They shall align the traffic selector in policy-based side.
2. AWS VPN can be the initiator (start action = start), but if it's "Acceleration enabled", then AWS must be the responder - see the last section of https://docs.aws.amazon.com/vpn/latest/s2svpn/accelerated-vpn.html#accelerated-vpn-rules

Policy based VPN in AWS

Add your answer

Relevant content