Client VPN availability question

0

The Client VPN examples at https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-client-vpn-to-scale-your-work-from-home-capacity/ use this as an example for a failover (?) setup between two AZs:

Enter image description here

Is that enough to ensure connectivity between "remote workers" and VPC B/C/D in case of a problem in AZ A or AZ B? Is there any way I could realistically simulate a failure of one AZ?

I have the recommended setup for TGW attachments in their own /28. My AZ A and AZ B in this case are not the subnets with the TGW attachment, because the CVPN endpoint doesn't allow association with a subnet smaller than /27 - would it be a better/worse idea or make any difference at all if I used /27 subnets for the TGW attachments so I could associate the CVPN endpoints with the same subnets?

Thanks, Marc

Marc
asked 15 days ago21 views
3 Answers
2
Accepted Answer

The way you have setup is correct, as long as you have TGW ENIs in 2 dedicated /28 subnets in 2 different Availability Zones will give you AZ level redundancy and thats what is mentioned in the TGW Best practice guidance.

Similarly as long as you associate 2 subnets from 2 different AZs to the ClientVPN endpoints the setup will give you AZ level redundancy.

CVPN endpoints and TGW ENIs don't need to be in the same subnet, it sounds like the way you have done the setup is correct.

profile picture
EXPERT
answered 15 days ago
profile picture
EXPERT
reviewed 15 days ago
1

hi The best practice is to use multiple Availability Zone.

https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/disaster-recovery-resiliency.html

Multiple target networks for high availability You associate a target network with a Client VPN endpoint to enable clients to establish VPN sessions. Target networks are subnets in your VPC. Each subnet that you associate with the Client VPN endpoint must belong to a different Availability Zone. You can associate multiple subnets with a Client VPN endpoint for high availability. While there is not a specific solution to simulate Client VPN failover the documentation below might provide some guidance on how to think about it

https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#disrupt-connectivity

https://www.wellarchitectedlabs.com/reliability/300_labs/300_testing_for_resiliency_of_ec2_rds_and_s3/7_failure_injection_az/

kaveerh
answered 15 days ago
0

Thank you both for your replies, much appreciated.

Marc
answered 15 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions