使用Amazon Web Services的站點到站點VPN

下載選項

  • PDF     (1.1 MB)
    在多種裝置上使用 Adobe Reader 檢視
  • ePub     (1.0 MB)
    在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上的各種應用程式中檢視
  • Mobi (Kindle)     (1.6 MB)
    在 Kindle 裝置或多部裝置的 Kindle 應用程式上檢視
已更新: 2020 年 8 月 13 日
文件 ID:1597272321864307

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

目標

本文的目的是指導您在Cisco RV系列路由器和Amazon Web Services之間設定站點到站點VPN。

適用裝置 |軟體版本

簡介

站點到站點VPN允許連線到兩個或多個網路，這使企業和一般使用者能夠連線到不同的網路。Amazon Web Services(AWS)提供許多按需雲端計算平台，包括站點到站點VPN，使您能夠訪問您的AWS平台。本指南將幫助您將RV16X、RV26X、RV34X路由器上的站點到站點VPN配置到Amazon Web Services。

這兩個部分如下：

在Amazon Web Services上設定站點到站點VPN

在RV16X/RV26X、RV34X路由器上設定站點到站點VPN


在Amazon Web Services上設定站點到站點VPN

步驟1

建立一個新的VPC，定義一個IPv4 CIDR塊，之後我們將在該塊中定義用作我們的AWS LAN的LAN。選擇建立。

A screen shot of the Create VPC page with Name Tag as step one and IPV4 CIDR Block as step two.

步驟2

建立子網時，請確保您已選擇先前創建的VPC。在先前建立的現有/16網路中定義子網。本示例使用172.16.10.0/24。

A screen shot of the Create Subnet with VPC as step one and IPV4 CIDR Block as step two.

步驟3

建立客戶網關，將IP地址定義為Cisco RV路由器的公共IP地址。

Screen shot of Create Customer Gateway with Name highlighted as step one and IP address as step 2.

步驟4

建立虛擬專用網關 — 建立Name標籤以幫助稍後識別。

Screen Shot of Virtual Private Gateway with Name tag as step 1 and highlighted in green.

步驟5

將虛擬專用網關連線到先前建立的VPC。

Screen shot of attach to VPC page. VPC field is in a green box and is marked as step 1.

步驟6

建立新的VPN連線，選擇目標網關型別虛擬專用網關。將VPN連線與先前建立的虛擬專用網關相關聯。

Create VPN connection page, Target Gateway Type, which is step one, is highlighted in a green box with Virtual Private Gateway selected. Virtual Private Gateway is step 2 and shows the VPC that had been created in prior steps.

第7步

選擇Existing Customer Gateway。選擇之前建立的客戶網關。

Customer Gateway is Highlighted in a green box with the option of Existing highlighted and outlined as step one. Customer Gateway is outlined as step two and depicts the customer gateway that was created in previous steps.

步驟8

對於路由選項，請確保選擇Static。輸入任何IP字首，包括您預計通過VPN的任何遠端網路的CIDR表示法。[這些網路存在於您的Cisco路由器上。]

Routing Options is highlighted in a green box with static selected. Static IP prefixes is chosen as step two.

步驟9

我們不會在本指南中介紹任何Tunnel Options — 選擇Create VPN Connection。

This is a screenshot of the tunnel options of which remain untouched and with the default configurations. The Create VPN Connection button is highlighted to bring to action to go ahead and continue.

步驟10

建立路由表並關聯先前建立的VPC。按Create。

Screen Shot of Create Route Table page with Name Tag as step 1 and VPC as step 2.

步驟11

選擇先前建立的路由表。在Subnet Associations頁籤中選擇Edit subnet associations。

Screen shot of the select route part of the page. The route that has to be selected is highlighted in a green box and outlined as step one. Edit Subnet associations button is highlighted as step 2 and depicted in a green box.

步驟12

在編輯子網關聯頁中，選擇以前建立的子網。選擇先前建立的路由表。然後選擇save。

Screenshot of the Edit Subnet Associations. Subnet ID is higlighted in a greenbox and is marked as step one. Save button is highlighted in a green box.

步驟13

在Route Propagation頁籤中，選擇Edit route propagation。

Route table ID are is highlighted in a green box and marked as step one. The Rout Propagation tab below is highlighted of which is followed by the Edit Route Propagation button, of which is marked as step two.

步驟14

選擇之前建立的虛擬專用網關。

Screen Shot of the Edit Route propagation section. Next to the area marked a route propagation, under Virtual Private Gateway (VPG), the VPG created prior to this step is higlighted and marked as step one. The save button is highlighted in a green box.

步驟15

在VPC > Security Groups中，確保已建立策略以允許所需的流量。

附註：在本例中，我們使用源10.0.10.0/24，該源與示例RV路由器上使用的子網相對應。

Screen Shot of the Edit inbound Rules page. The traffic type is higlighted in a green box. Marked as step one is the field where the user would enter the desired traffic IP and subnet they would like to allow.

步驟16

選擇您之前建立的VPN連線，然後選擇Download Configuration。

Screen shot of area where VPN connection that was created can be found. The VPN connection created is highlighted in a green box and the Download configuration button is also in a green box.

在RV16X/RV26X、RV34X路由器上設定站點到站點

步驟1

使用有效憑證登入到路由器。

Router Login Page, with Userame, Password and Login highlighted. Numbered steps included to follow the format of which details would be entered.

步驟2

導航到VPN > Ipsec Profiles。這會將您帶到Ipsec配置檔案頁面，按新增圖示(+)。

The IPSEC Profile Page with the Menu options visible. VPN is step one, with IPSEC Profiles option highlighted as step two. The small plus button on the upper left side of the IPSEC Profiles table is highlighted and marked as step 3.

步驟3

我們現在建立我們的IPSEC配置檔案。在小型企業路由器上建立IPsec Profile時，請確保為階段1選擇DH Group 2。

附註：AWS將支援較低級別的加密和身份驗證 — 在本示例中，使用了AES-256和SHA2-256。

Screen shot of the Add/Edit a New IPSec Profile page, with the profile name and options highlighted in green boxes.

步驟4

確保您的第二階段選項與第一階段中提供的選項匹配。對於AWS DH組2，必須使用。

Screen shot of the Phase II options on the Add/Edit a New IPSec Profile page, options highlighted in green boxes.

步驟5

按Apply後，您將導航到IPSEC頁面，一定要再次按Apply。

Screen shot of the IPSEC profiles page with the apply button highlighted in green

步驟6

導航到VPN< Client to site，然後在客戶端到站點頁面上按加號圖示(+)。

The Site to Site Page with the Menu options visible. VPN is step one, with Site to Site option highlighted as step two. The small plus button on the upper left side of the Site to site Profiles table is highlighted and marked as step 3.

第7步

建立IPsec站點到站點連線時，請確保選擇在上面的步驟中建立的IPsec配置檔案。使用Static IP的Remote Endpoint型別，並輸入匯出的AWS配置中提供的地址。輸入從AWS匯出的配置中提供的預共用金鑰。

The Add and edit a new connection page along side the IPSEC configuration made from the AWS configuration. On the Cisco router side of the screenshot, The ipsec profile is highlighted as step one. The remote end point and pre-shared key are marked as step two and three respectively to match the AWS screenshot. The tunnel Group and password are highlighted as step two and three.

步驟8

輸入Local Identifier for your Small Business router — 此條目應與AWS中建立的Customer Gateway匹配。輸入您的小型企業路由器的IP地址和子網掩碼 — 此條目應與AWS中新增到VPN連線的靜態IP字首匹配。輸入您的小型企業路由器的IP地址和子網掩碼 — 此條目應與AWS中新增到VPN連線的靜態IP字首匹配。

Screenshot of the Local Group Setup. Local identifier is marked as step one and the IP address is marked as step 2.

步驟9

輸入AWS連線的遠端識別符號 — 這將列在AWS站點到站點VPN連線的隧道詳細資訊下。輸入您的AWS連線的IP地址和子網掩碼（在AWS配置過程中定義）。然後按應用鍵。

Screen Shot of Remote Group Setup section. Remote Identifier is marked as step one and highlighted in a green box. IP address and Subnet mask are marked as step two and are both highlighted in a green box.

步驟10

進入Ip Site to Site（Ip站點到站點）頁面後，按Apply。

Screenshot of Site to Site page with Apply Button highlighted in green.

結論

現在，您已成功在RV系列路由器和AWS之間建立站點到站點VPN。有關站點到站點VPN的社群討論，請轉至思科小型企業支援社群頁面，然後搜尋站點到站點VPN。

這份文件是否有所幫助？

Feedback意見

讓思科協助您