Azure ↔ AWS Site-to-Site VPN Connectivity

This document outlines the procedure to establish secure, private connectivity between the Azure Cloud Environment and the AWS Cloud Environment. They must integrate via a Site-to-Site (S2S) IPsec VPN. This ensures reliable, encrypted access while keeping traffic within controlled network boundaries.

The IP range of the Azure environment.[AZURE_VNET_CIDR] The IP range of the AWS Server VPC.[AWS_SERVER_VPC_CIDR] Public IP of the Azure VPN Gateway.[AZURE_GW_PUBLIC_IP] Public IP of the AWS VPN Tunnel endpoint.[AWS_TUNNEL_IP] The shared secret for authentication.[PSK_SECRET]

Implementation Steps

Phase 1: Azure Preparation

Create Virtual Network Gateway (VNG) Navigate to the Azure Virtual Network Gateway service.

Action: Create a VNG with the correct SKU (e.g., VpnGw1 or VpnGw2) attached to the Gateway Subnet of [AZURE_VNET_CIDR].

Note: Record the Public IP Address assigned to this gateway, it is required for the AWS configuration.

Phase 2: AWS Configuration

1. Create Customer Gateway (CGW)

Navigate to the AWS VPC Console in the relevant region Create a Customer Gateway. IP Address: Input [AZURE_GW_PUBLIC_IP]. BGP ASN: Use default/existing (Static routing is used). Logical Link: This object serves as the “pointer” that tells AWS where the Azure network physically resides.

2. Create VPN Connection

Create a Site-to-Site VPN Connection attached to the Virtual Private Gateway (VGW) of the server from where you want the connection Target Gateway Type: Virtual Private Gateway. Customer Gateway: Select the CGW created in step1 Routing Options: Select Static. Static IP Prefixes: Add [AZURE_VNET_CIDR]created in phase 1 Action: Once created, download the Generic Configuration File, this file contains the [AWS_TUNNEL_IP] and [PSK_SECRET].

Phase 3: Azure Tunnel Configuration

Complete the handshake by configuring the Azure side to point to AWS.

1. Create Local Network Gateway (LNG)

Create a Local Network Gateway. IP Address: Input [AWS_TUNNEL_IP] (from the AWS config file). Address Space: Input [AWS_SERVER_VPC_CIDR].

Logical Link: This object tells the Azure VNet which IP ranges live “across the tunnel” in AWS.

2. Establish the Connection

Navigate to the main Azure Virtual Network Gateway. Select Connections > Add. Connection Type: Site-to-Site (IPsec). Local Network Gateway: Select the LNG created in phase3 step1. Shared Key (PSK): Input [PSK_SECRET] (from the AWS config file).

Outcome: Azure will initiate the IKEv2 handshake. The tunnel status in AWS should transition from DOWN to UP.

Network Diagram

Phase 4: Routing & Security

Objective: Allow traffic to flow through the now-active tunnel.

1. Update AWS Route Tables

Identify the Route Table associated with the target EC2 service subnets Action: Add a route entry: Destination: [AZURE_VNET_CIDR] Target: Virtual Private Gateway ID.

Check: Ensure no conflicting routes exist for this destination.

2. Update AWS Security Groups

Locate the Security Group attached to the target server Action: Add an Inbound Rule: Type: Custom TCP (or All Traffic for testing). Port: Relevant Service Ports on your EC2 (e.g. 443, 22). Source: [AZURE_VNET_CIDR].

Why: Even if the tunnel is UP, AWS firewalls drop traffic by default unless explicitly allowed.

Phase 5: Connectivity Validation

Perform the following tests to confirm stability:

1. Tunnel Status Check: Azure: Check the connection status is “Connected”. AWS: Check Site-to-Site VPN Tunnel 1/2 status is “UP”.
2. Ping/Telnet Test: ssh into a test instance inside the Azure [AZURE_VNET_CIDR]. Attempt to reach the internal IP of the AWS ec2 service telnet [TARGET_SERVICE_PRIVATE_IP] [PORT]