RHEL High Availability and Site to Site VPN using RHEL HA

Question

I have a customer looking to do RHEL High Availability and wants to create a router/VPN concentrator with native Red Hat packages? and also wants to implement a site to site VPN using RHEL HA....can someone provide some guidance, directions on it?

re:Post Agent · Accepted Answer

While AWS Site-to-Site VPN is typically used with dedicated network appliances or cloud-native solutions, it's possible to implement a site-to-site VPN using Red Hat Enterprise Linux (RHEL) High Availability. However, this approach is not a standard AWS-recommended solution and may require additional configuration and management.

To implement this setup:

1. Set up RHEL instances in your VPC to act as VPN endpoints. Configure these instances with high availability using RHEL's built-in HA tools like Pacemaker and Corosync.

2. Install and configure a VPN software package on these RHEL instances. You could use native Linux tools like strongSwan or OpenVPN for this purpose.

3. Create a customer gateway in AWS that represents your on-premises VPN device (in this case, your RHEL HA setup).

4. Set up a virtual private gateway (VGW) or transit gateway (TGW) in your AWS VPC.

5. Create an AWS Site-to-Site VPN connection, specifying the customer gateway you created and either the VGW or TGW.

6. Configure your RHEL HA setup to establish and maintain the VPN connection with AWS.

7. Set up redundancy by creating multiple VPN connections and configuring your RHEL HA cluster to manage failover.

It's important to note that this setup will be more complex to manage and may not provide the same level of performance or integration as purpose-built VPN appliances or AWS-managed solutions. You'll need to handle aspects like key rotation, tunnel management, and failover logic within your RHEL HA configuration.

For production environments, it's generally recommended to use dedicated VPN appliances or AWS-managed VPN solutions for better reliability, performance, and easier management. If the customer insists on using RHEL, they should be aware of the additional complexity and potential limitations of this approach.  
**Sources**  
[Getting started with hybrid connectivity using Site-to-Site VPN - Hybrid Networking Lens](https://docs.aws.amazon.com/wellarchitected/latest/hybrid-networking-lens/site-to-site-vpn.html)  
[Site 2 site VPN | AWS re:Post](https://repost.aws/questions/QUm8HjrbEpRiyjciVTFhk-DA/site-2-site-vpn)  
[Configure an AWS site-to-site VPN | AWS re:Post](https://repost.aws/knowledge-center/vpn-configure-site-to-site)  
[Redundant AWS Site-to-Site VPN connections for failover - AWS Site-to-Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.html)

MikeLim · Answer

Adding to agent reply

S2S VPN uses IPSEC, and you can use RHEL's Libreswan packages to configure this.
Details in RHEL 9 documentation [Chapter 7. Setting up an IPsec VPN](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_and_managing_networking/configuring-a-vpn-connection_configuring-and-managing-networking)

A single S2S VPN connection consists of 2 IPSEC tunnels.  It is important to configure both tunnels for redundancy. When one tunnel becomes unavailable (for example, down for maintenance), network traffic is automatically routed to the available tunnel for that specific Site-to-Site VPN connection. This provides HA on AWS end of the tunnel.
Details at [Tunnel options for your AWS Site-to-Site VPN connection](https://docs.aws.amazon.com/vpn/latest/s2svpn//VPNTunnels.html).

For HA on RHEL (customer gateway) end, you can establish multiple VPN connections. Refer to [Multiple Site-toSite VPN connections](https://docs.aws.amazon.com/vpn/latest/s2svpn//Examples.html#MultipleVPN) for architectural scenarios.  You will need to configure RHEL HA accordingly.

RHEL High Availability and Site to Site VPN using RHEL HA

Add your answer

Relevant content