Tutorial: Using AWS Transit Gateway with Access Server⁠

• An AWS account with VPCs and resources set up.

• Access Server deployed on an EC2 instance.

• Two VPCs set up in AWS (e.g., my-first-vpc and my-second-vpc).

• Ubuntu EC2 instance (ubuntu) in the second VPC.

Here is an example of the setup:

1. Sign in to your AWS portal and go to VPC.

2. Under Transig gateways, click Transit gateways.

3. Click Create transit gateway.

4. Enter a name for the transit gateway.

5. Leave the settings as default and click Create transit gateway.

1. Under Transit gateways, click Transit gateways attachments.

2. Click Create transit gateway attachment.

3. Enter a name for the attachment.

4. Under Transit gateway ID, select the transit gateway created in step 1.

5. Under Attachment type, select VPC.

6. Under VPC attachment - VPC ID, select my-first-vpc.

7. Click Create transit gateway attachment.

8. Repeat for my-second-vpc.

   • You should have two transit gateway attachments as seen in this screenshot:

     

1. Under Transit gateways, click Transit gateways route tables.

2. Click on the transit gateway route table.

3. Click Routes and Create static route.

4. Under CIDR, enter the client subnet for VPN clients in Access Server. We will use 203.0.113.0/20 for this example.

5. Under Choose attachment, select the my-first-vpc attachment.

6. Click Create static route.

7. Click on Create transit gateway attachment.

8. Repeat for the my-second-vpc attachment.

   • Here's an example routing table setup:

     

1. Navigate to your EC2 instance with Access Server installed.

2. Click Actions > Networking > Change source/destination check.

3. Set Stop and click Save to disable the check.

   • This prevents AWS from dropping traffic to or from VPN subnets that are not part of your defined infrastructure.

     

1. Sign in to the Admin Web UI.

2. Click Access Controls.

3. Click the Global Access Rules tab.

4. Click to enable Route and enter the subnets in the Subnets text fields.

   

5. Click Save and Restart.

1. After the configuration, test the connection by pinging the Ubuntu machine in my-second-vpc from a VPN client connected to Access Server:

   ping 198.51.100.188

   • Example output:

     Pinging 198.51.100.188 with 32 bytes of data:
     Reply from 198.51.100.188: bytes=32 time=30ms TTL=63
     Reply from 198.51.100.188: bytes=32 time=30ms TTL=63
     Reply from 198.51.100.188: bytes=32 time=29ms TTL=63
     Reply from 198.51.100.188: bytes=32 time=30ms TTL=63
     Ping statistics for 198.51.100.188:
     Packets: Sent = 5, Received = 5, Lost = 0 (0% loss)

2. A TCPdump on the Access Server should show the communication between the VPN client and the Ubuntu machine:

   tcpdump -eni any icmp

   • Output example:

     tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
     listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
     16:52:27.347551 as0t0 In ifindex 3 ethertype IPv4 (0x0800), length 80: 203.0.113.4 > 198.51.100.154: ICMP echo request, id 1, seq 54, length 40
     16:52:27.347564 ens5 Out ifindex 2 06:e5:c6:b5:4a:64 ethertype IPv4 (0x0800), length 80: 203.0.113.4 > 198.51.100.154: ICMP echo request, id 1, seq 54, length 40
     ...