// Module included in the following assemblies:
//
// * rosa_cluster_admin/cloud_infrastructure_access/dedicated-aws-vpn.adoc

:_mod-docs-content-type: PROCEDURE
[id="dedicated-aws-vpn-creating"]
= Creating a VPN connection

You can configure an Amazon Web Services (AWS) {product-title} cluster to use a customer's on-site hardware VPN device using the following procedures.

.Prerequisites

* Hardware VPN gateway device model and software version, for example Cisco ASA
running version 8.3. See the Amazon VPC
link:https://docs.aws.amazon.com/vpc/latest/adminguide/Introduction.html#DevicesTested[Network Administrator Guide]
to confirm whether your gateway device is supported by AWS.
* Public, static IP address for the VPN gateway device.
* BGP or static routing: if BGP, the ASN is required. If static routing, you must
configure at least one static route.
* *Optional*: IP and Port/Protocol of a reachable service to test the VPN connection.

[id="dedicated-aws-vpn-creating-configuring"]
== Configuring the VPN connection

.Procedure

. Log in to the {product-title} AWS Account Dashboard, and navigate to the VPC Dashboard.
. Under *Virtual private cloud* click on *Your VPCs* and identify the name and VPC ID for the VPC containing the {product-title} cluster.
. Under *Virtual private network (VPN)* click *Customer gateways*.
. Click *Create customer gateway* and give it a meaningful name.
. Enter the ASN of your customer gateway device in the *BGP ASN* field.
. Enter the IP address for your customer gateway devices’s external interface in the *IP address* field.
. Click *Create customer gateway*.
. If you do not already have a Virtual Private Gateway attached to the intended VPC:
.. From the VPC Dashboard, click on *Virtual Private Gateways*.
.. Click *Create virtual private gateway*, give it a meaningful name.
.. Click *Create virtual private gateway*, leaving the *Amazon default ASN*.
.. Select the newly created gateway.
.. Select *Actions* from the list and click *Attach to VPC*.
.. Select the newly created gateway under Available VPC's and click *Attach to VPC* to attach it to the cluster VPC you identified earlier.

[id="dedicated-aws-vpn-creating-establishing"]
== Establishing the VPN Connection

.Procedure

. From the VPC dashboard, under Virtual private network (VPN) click on *Site-to-Site VPN connections*.
. Click *Create VPN connection*.
.. Give it a meaningful name tag.
.. Select the Virtual private gateway created previously.
.. For Customer gateway, select *Existing*.
.. Select the Customer gateway id by name.
.. If the VPN will use BGP, select *Dynamic*, otherwise select *Static* and enter the
Static IP CIDRs. If there are multiple CIDRs, add each CIDR as *Another Rule*.
.. Click *Create VPN connection*.
.. Under *State* wait for the VPN status to change from *Pending* to *Available*, approximately 5 to 10 minutes.
. Select the VPN you just created and click *Download configuration*.
.. From the list, select the vendor, platform, and version of the customer
gateway device, then click *Download*.
.. The *Generic* vendor configuration is also available for retrieving information
in a plain text format.

[NOTE]
====
After the VPN connection has been established, be sure to set up Route
Propagation or the VPN may not function as expected.
====

[NOTE]
====
Note the VPC subnet information, which you must add to your configuration as the
remote network.
====

[id="dedicated-aws-vpn-creating-propagation"]
== Enabling VPN route propagation

After you have set up the VPN connection, you must ensure that route propagation
is enabled so that the necessary routes are added to the VPC's route table.

.Procedure

. From the VPC Dashboard, under Virtual private cloud, click on *Route tables*.
. Select the private Route table associated with the VPC that contains your
{product-title} cluster.
+
[NOTE]
====
On some clusters, there may be more than one route table for a particular VPC.
Select the private one that has a number of explicitly associated subnets.
====
. Click on the *Route Propagation* tab.
. In the table that appears, you should see the Virtual Private Gateway you
created previously. Check the value in the *Propagate* column.
.. If *Propagation* is set to *No*, click *Edit route propagation*, check the *Enable* checkbox in Propagation and click *Save*.

After you configure your VPN tunnel and AWS detects it as *Up*, your static or
BGP routes are automatically added to the route table.
