AWS IPSec Tunnel success?

[OMatlock]

Hello folks,

I am so close to a successful AWS IPSec tunnel to my on premise (test) PA200 7.1.15.

I've downloaded the configuration file and using it as a guide, IPs, etc.

But I've been using this article to configure.  Main difference is I created a specific AWS zone like I do for all my IPSec Tunnels.  

http://www.richardyau.com/?p=240

I am able to access my on premise environment from the AWS EC2 instance, but not from on premise to AWS EC2 172.31.24.69.

I can't ping it or connect to the EC2 via RDP.  I see the ping tries in traffic log, but nothing shows up in packet trace for the RDP attempts.  <UPDATE>  Resolved after correcting IPs for PBF and RDP connection from LAN.

AWS has two VPN connections for redundancy.  I have both configured and active.

NOTE:  My Azure IPSec tunnel works great!

Configured tunnel interfaces according to AWS text document.

Configured tunnel monitor profile.

Configured PBF like referenced in documentation. <Corrected>

Configured Static routes for both VPN connections (different metric).

Created security rules in and out for AWS zone, open.

No additional NAT rules.  Just basic outbound internet rule to Untrust.  <corrected>

A ping from a VM inside my LAN ages out.  Nothing shows up when I try to RDP, including a packet trace, not even a drop file.

[OMatlock · Accepted solution]

I've resolved this, able to communicate to AWS EC2 back and forth.  I've corrected my screenshots above.

My configuration errors:

- PBF destination IPs were incorrect.

- NAT rule not needed.

- Was using incorrect IP when attempting to RDP from LAN resource.  That's why was not showing up in my log.

- Ping was not working because was not enabled on AWS security group.

[Junaid-Khan]

Does the inbound from AWS to On-Prem(resource) work ?

Are you using multiple-vr's ?

[OMatlock]

Sorry for my delayed response.  Yes, I did get AWS to On-Premise working.  I did not create a separate or second Virtual Router.  Just used my default.  Please let me know if I can help or provide more notes.  I still have this running...

[Huddlebuy]

Hi OMatlock

We have a similar issue from or end, for some reason we can't enable both tunnels at the same time- as it creates asymmetric routing. For e.g if traffic is sent from one tunnel, the PAN will reject any traffic from the other tunnel.

I see you have configured both tunnel interfaces to be part of the same zone. But we have used different zone, not sure if this is an issue too?

- we had to enable ECMP- later knew its not supported by AWS

Kind Regards

Anu