The GAME Plan

Setting up a secure VPN connection between Azure and AWS doesn’t have to be complicated. This guide demonstrates a straightforward method to establish a multicloud static VPN using only managed services. You can connect Azure VPN Gateway and AWS Virtual Private Gateway over IPsec tunnels without requiring BGP configuration. This method ensures secure communication between the two environments.

Step 1: Set Up Your Azure Environment

1.1 Create a Resource Group

1. Go to Azure Portal > Resource groups > Create.
2. Select your subscription and region, and name the resource group (e.g., RG-AzureAWSVPN).

1.2 Create a Virtual Network (VNet) and Subnet

1. In the Azure Portal, go to Virtual Networks > Create.
2. Name the VNet AzureVNet and specify an address space of 172.16.0.0/16.
3. Under Subnets, create:
   • A subnet named Subnet-AzureVPN with the address range 172.16.1.0/24.
   • A GatewaySubnet with a /27 address block (e.g., 172.16.0.224/27).

1.3 Set Up the Azure VPN Gateway

1. Go to +Create a resource, search for Virtual Network Gateway, and select Create.
2. Fill in the details:
   • Name: AzureVPNGateway
   • Gateway Type: VPN
   • SKU: VpnGw1 (or higher if needed)
   • Public IP Address: Create a new one and name it AzureVPNGatewayPublicIP
   • Active-Active Mode: Leave disabled unless high availability is required.
3. This process can take up to 30 minutes.

Step 2: Set Up Your AWS Environment

2.1 Create a VPC and Subnet

1. In the AWS Console, go to VPC > Create VPC.
2. Use an address space (e.g., 10.0.0.0/16) for the AWS-VPC.
3. Under Subnets, create a subnet named Subnet-AWSVPN with the address space 10.0.1.0/24.

2.2 Create an AWS Virtual Private Gateway (VGW)

1. In the AWS VPC Console, go to Virtual Private Gateway and create a new VGW named AWS-VPN-VGW.
2. Attach the VGW to the VPC.

2.3 Set Up a Customer Gateway (CGW)

1. In the AWS Console, go to Customer Gateway, and create a CGW using the public IP of the Azure VPN Gateway.
2. Name the gateway Azure-CGW.

2.4 Create the Site-to-Site VPN Connection

1. Go to Site-to-Site VPN Connections > Create VPN Connection.
2. Configure the VPN Connection:
   • Virtual Private Gateway: Select the VGW created earlier.
   • Customer Gateway: Select the CGW created earlier.
   • Routing: Set to Static and define the Azure VNet subnet (172.16.1.0/24).
3. Download the VPN Configuration File:
   • Select Generic for the platform and IKEv2 for the IKE version.

2.5 Enable Route Propagation

1. Go to Route Tables > Select the existing route table.
2. Edit Route Propagation and enable propagation for the VGW.

Step 3: Finish the Azure Side Configuration

3.1 Create the Local Network Gateway

1. In the Azure Portal, go to Local Network Gateway > Create.
2. Name it AWSLocalNetworkGateway, and enter the public IP of the AWS VPN tunnel.
3. Set the AWS VPC CIDR block (10.0.0.0/16) as the address space.

3.2 Create the VPN Connection

1. Go to Azure Portal > Virtual Network Gateway > Connections > + Add.
2. Configure the connection:
   • Name: AzureAWSVPNConnection
   • Connection Type: Site-to-site (IPsec)
   • Virtual Network Gateway: Select AzureVPNGateway
   • Local Network Gateway: Select AWSLocalNetworkGateway
   • Shared Key (PSK): Use the shared key from the AWS VPN configuration file.
   • IKE Protocol: Set to IKEv2.
3. Verify the connection after a few minutes to ensure it is established.

Step 4: Add Routes and Configure Security

4.1 Check the Route for Azure Subnets in AWS Route Table

1. In AWS Console, go to VPC > Route Tables.
2. Check if the route for the Azure VNet subnet (172.16.1.0/24) is automatically added.

4.2 Add an Internet Gateway (IGW)

1. In AWS Console, go to VPC > Internet Gateways and create an IGW named AWS-IGW.
2. Attach it to the AWS VPC.
3. Update the Route Table to add a route to 0.0.0.0/0 pointing to the IGW.

4.3 Set Security Group and NSG Rules

• AWS Security Group: Allow ICMP (ping) and protocols (e.g., SSH) from Azure.
• Azure NSG: Ensure inbound traffic from AWS is allowed.

Step 5: Test Connectivity Between Azure and AWS VMs

5.1 Deploy VMs

1. Deploy a VM in the appropriate subnet on each cloud provider (e.g., an EC2 instance on AWS and a VM on Azure).
2. Connect to each VM using their public IP addresses.

5.2 Test Connectivity with Ping

1. From the Azure VM, ping the AWS VM using its private IP.
2. From the AWS VM, ping the Azure VM using its private IP.

Troubleshooting Common Issues

1. Missing Static Route in AWS VPN: Ensure the static route for the Azure VNet subnet (172.16.1.0/24) is added.
2. No Inbound Traffic on Azure VPN Gateway: Verify the AWS route table and static route to Azure subnet.
3. Custom IPsec/IKE Policies: If default policies fail, apply custom policies (AES128, SHA1, DH Group 2).
4. Further Troubleshooting: Refer to Azure VPN diagnostics documentation for guidance.

By following this guide, you’ve successfully set up a VPN connection between Azure and AWS using managed services. Adding the route for Azure’s subnet to the AWS Route Table is crucial for communication. For advanced configurations, consult the Azure VPN Gateway documentation.