What is AWS Site-to-Site VPN? - AWS Site-to-Site VPN
ConceptsSite-to-Site VPN featuresSite-to-Site VPN limitationsSite-to-Site VPN resourcesPricing

What is AWS Site-to-Site VPN?

By default, instances that you launch into an Amazon VPC can't communicate with your own (remote) network. You can enable access to your remote network from your VPC by creating an AWS Site-to-Site VPN (Site-to-Site VPN) connection, and configuring routing to pass traffic through the connection.

Although the term VPN connection is a general term, in this documentation, a VPN connection refers to the connection between your VPC and your own on-premises network. Site-to-Site VPN supports Internet Protocol security (IPsec) VPN connections.

Concepts

The following are the key concepts for Site-to-Site VPN:

  • VPN connection: A secure connection between your on-premises equipment and your VPCs.

  • VPN tunnel: An encrypted link where data can pass from the customer network to or from AWS.

    Each VPN connection includes two VPN tunnels which you can simultaneously use for high availability.

  • Customer gateway: An AWS resource which provides information to AWS about your customer gateway device.

  • Customer gateway device: A physical device or software application on your side of the Site-to-Site VPN connection.

  • Target gateway: A generic term for the VPN endpoint on the Amazon side of the Site-to-Site VPN connection.

  • Virtual private gateway: A virtual private gateway is the VPN endpoint on the Amazon side of your Site-to-Site VPN connection that can be attached to a single VPC.

  • Transit gateway: A transit hub that can be used to interconnect multiple VPCs and on-premises networks, and as a VPN endpoint for the Amazon side of the Site-to-Site VPN connection.

Site-to-Site VPN features

The following features are supported on AWS Site-to-Site VPN connections:

  • Internet Key Exchange version 2 (IKEv2)

  • NAT traversal

  • 4-byte ASN in the range of 1–2147483647 for Virtual Private Gateway (VGW) configuration. See Customer gateway options for your AWS Site-to-Site VPN connection for more information.

  • 2-byte ASN for Customer Gateway (CGW) in the range of 1–65535. See Customer gateway options for your AWS Site-to-Site VPN connection for more information.

  • CloudWatch metrics

  • Reusable IP addresses for your customer gateways

  • Additional encryption options; including AES 256-bit encryption, SHA-2 hashing, and additional Diffie-Hellman groups

  • Configurable tunnel options

  • Custom private ASN for the Amazon side of a BGP session

  • Private Certificate from a subordinate CA from AWS Private Certificate Authority

  • Support for IPv6 traffic for VPN connections on a transit gateway

Site-to-Site VPN limitations

A Site-to-Site VPN connection has the following limitations.

  • IPv6 traffic is not supported for VPN connections on a virtual private gateway.

  • An AWS VPN connection does not support Path MTU Discovery.

In addition, take the following into consideration when you use Site-to-Site VPN.

  • When connecting your VPCs to a common on-premises network, we recommend that you use non-overlapping CIDR blocks for your networks.

Site-to-Site VPN resources

You can create, access, and manage your Site-to-Site VPN resources using any of the following interfaces:

  • AWS Management Console— Provides a web interface that you can use to access your Site-to-Site VPN resources.

  • AWS Command Line Interface (AWS CLI) — Provides commands for a broad set of AWS services, including Amazon VPC, and is supported on Windows, macOS, and Linux. For more information, see AWS Command Line Interface.

  • AWS SDKs — Provide language-specific APIs and takes care of many of the connection details, such as calculating signatures, handling request retries, and error handling. For more information, see AWS SDKs.

  • Query API— Provides low-level API actions that you call using HTTPS requests. Using the Query API is the most direct way to access Amazon VPC, but it requires that your application handle low-level details such as generating the hash to sign the request, and error handling. For more information, see the Amazon EC2 API Reference.

Pricing

You are charged for each VPN connection hour that your VPN connection is provisioned and available. For more information, see AWS Site-to-Site VPN and Accelerated Site-to-Site VPN Connection pricing.

You are charged for data transfer out from Amazon EC2 to the internet. For more information, see Data Transfer on the Amazon EC2 On-Demand Pricing page.

When you create an accelerated VPN connection, we create and manage two accelerators on your behalf. You are charged an hourly rate and data transfer costs for each accelerator. For more information, see AWS Global Accelerator pricing.