CoPilot GUI \u2192 Networking \u2192 Connectivity \u2192 External Connections (S2C) \u2192 + External Connection \u2192 External Device \u2192 Type:<\/strong><\/p>\n\n\n\n
- \n
- BGP over IPSec<\/li>\n\n\n\n
- BGP over GRE<\/li>\n\n\n\n
- BGP over LAN<\/li>\n\n\n\n
- Static Routing over IPSec \u2192 Static Routing Type: Active Mesh<\/li>\n<\/ul>\n\n\n\n
You can only select BGP-capable Aviatrix Gateways from this path, such as Aviatrix Transit Gateway, Aviatrix BGP Spoke Gateway or Aviatrix Edge Gateway. Also the IPSec tunnel can only be route based.<\/p>\n\n\n\n
The other path: Controller -> Site2Cloud -> Setup -> Add New<\/strong> or
CoPilot -> Networking -> Connectivity -> External Connections (S2C) -> + External Connection -> External Device -> Type : Static Routing over IPSec -> Static Routing Type: Unmapped NAT or Mapped NAT<\/strong> can only build static mapped\/unmapped connections. This path is out of the scope of this blog.<\/span><\/p>\n\n\n\n<\/p>\n\n\n\n
To start with. I’ve deployed two Aviatrix Transits using following code:<\/p>\n\n\n\n
module \"mc-transit-1\" {\n source = \"terraform-aviatrix-modules\/mc-transit\/aviatrix\"\n version = \"2.2.1\"\n cloud = \"aws\"\n region = \"us-east-1\"\n cidr = \"10.100.0.0\/23\"\n account = \"aws-lab-jye\"\n name = \"transit1\"\n local_as_number = 65001\n}\n\nmodule \"mc-transit-2\" {\n source = \"terraform-aviatrix-modules\/mc-transit\/aviatrix\"\n version = \"2.2.1\"\n cloud = \"aws\"\n region = \"us-east-1\"\n cidr = \"10.200.0.0\/23\"\n account = \"aws-lab-jye\"\n name = \"transit2\"\n local_as_number = 65002\n}<\/code><\/pre>\n\n\n\nThis code created four transit gateways, a pair for each transit with following public IPs<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-68.png\")
<\/figure>\n\n\n\nTransit Name<\/td> Public IP<\/td><\/tr> transit1<\/td> 54.225.107.173<\/td><\/tr> transit1-hagw<\/td> 3.229.43.96<\/td><\/tr> transit2<\/td> 52.200.22.74<\/td><\/tr> transit2-hagw<\/td> 3.212.254.112<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Scenario one<\/h3>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/Aviatrix-S2C-connection-scenarios-No-Remote-GW-HA-Single-Remote-GW-1-1024x266.png\")
<\/figure>\n\n\n\nOne Remote Gateway, no Remote Gateway HA<\/p>\n\n\n\n
We selected Transit1, which have two gateways: transit1 and transt1-hagw <\/p>\n\n\n\n
We entered one <\/strong>target IP as Remote Gateway IP<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-69.png\")
<\/figure>\n\n\n\nAfter the connection is created, you can observe the tunnels via Multi-Cloud Transit -> List -> Transit Gateway -> Select Transit1 -> Details\/Diag -> Connections – <connection name><\/p>\n\n\n\n
Note how two tunnels will be created from each Transit Gateway towards the single Remote Gateway IP<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-71.png\")
<\/figure>\n\n\n\nWe can also observe this more clearly from CoPilot -> Cloud Routes -> Site 2 Cloud. We can clearly see the source coming from both transit gateways and target to a single IP. Will use CoPilot screenshot going forward.<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-72-1024x296.png\")
<\/figure>\n\n\n\nNote: There will be a bit delay before CoPilot can reflect the change.
Equivalent workflow in CoPilot \u2192<\/strong> Networking \u2192 Connectivity \u2192 External Connections (S2C) \u2192 + External Connection<\/strong>
Specify only a single<\/strong> Remote Device 1 Tunnel Destination IP<\/p>\n\n\n\n![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-98-1024x847.png\")
<\/figure>\n\n\n\nNotice how Remote Device IP<\/strong> point to the same public IP from both primary and HAGW.<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-100-1024x110.png\")
<\/figure>\n\n\n\nScenario two<\/h3>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/Aviatrix-S2C-connection-scenarios-No-Remote-GW-HA-dual-Remote-GWs-2-1024x267.png\")
<\/figure>\n\n\n\nTwo Remote Gateways, no Remote Gateway HA<\/span><\/p>\n\n\n\n
We selected Transit1, which have two gateways: transit1 and transt1-hagw<\/p>\n\n\n\n
We entered two <\/strong>target IPs as Remote Gateway IP separated by comma:<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-74.png\")
<\/figure>\n\n\n\nStill only two <\/strong>tunnels will be created. <\/p>\n\n\n\n
- \n
- First tunnel from primary gateway to first remote gateway IP<\/li>\n\n\n\n
- Second tunnel from HA gateway to second remote gateway IP<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-73-1024x135.png\")
<\/figure>\n\n\n\nScenario Three<\/h3>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/Aviatrix-S2C-connection-scenarios-Remote-GW-HA-Dual-Remote-GWs-2-1024x267.png\")
<\/figure>\n\n\n\nTwo Remote Gateway, Remote Gateway HA<\/span><\/p>\n\n\n\n
We selected Transit1, which have two gateways: transit1 and transt1-hagw<\/span> <\/p>\n\n\n\n
We entered two <\/strong>target IPs as Remote Gateway IP separated by comma: <\/p>\n\n\n\n
Note: When Remote Gateway HA is enabled, you cannot enter same IP as Remote Gateway IP and Backup Remote Gateway IP, makes sense:<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-75.png\")
<\/figure>\n\n\n\nWith Enable Remote Gateway HA checked, enter two different IP for Remote Gateway and Backup Remote Gateway <\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-76.png\")
<\/figure>\n\n\n\nNow four tunnels will be created, each transit gateway will try to establish a tunnel with both remote gateways<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/09\/image-77-1024x194.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
2022-10-17 Addition for Tunnel IPs<\/h2>\n\n\n\n
In above examples, I have left tunnel IP, pre-shared keys blank, so they are generated by Aviatrix automatically, and then can be downloaded as configuration file.<\/p>\n\n\n\n
Aviatrix is looking for \/30 for IPSec tunnel IPs, and \/29 for GRE tunnel IPs. (Requirement for TGW Connect)<\/p>\n\n\n\n
Here’s an reference example to plan for those IPs:<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/Aviatrix-Transit-to-VNG-Full-Mesh-Tunnel-IPs-1024x561.png\")
<\/figure>\n\n\n\nFrom transit1 to transit2, notice I placed “|” in between BGP neighbors, first IP represent the primary GW and second IP represent HA GW<\/p>\n\n\n\n
Local Tunnel IP: 169.254.21.2\/30,169.254.21.6\/30\n\n | |\nRemote Tunnel IP: 169.254.21.1\/30,169.254.21.5\/30\n\n\nLocal Tunnel IP (Backup): 169.254.21.10\/30,169.254.21.14\/30\n | |\nRemote Tunnel IP (Backup): 169.254.21.9\/30,169.254.21.13\/30<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/image-74-574x1024.png\")
<\/figure>\n\n\n\nFrom transit2 back to transit1, notice I placed “|” in between BGP neighbors, first IP represent the primary GW and second IP represent HA GW<\/p>\n\n\n\n
Local Tunnel IP: 169.254.21.1\/30,169.254.21.9\/30\n | | Remote Tunnel IP: 169.254.21.2\/30,169.254.21.10\/30\n\n\nLocal Tunnel IP (Backup): 169.254.21.5\/30,169.254.21.13\/30\n | |\nRemote Tunnel IP (Backup): 169.254.21.6\/30,169.254.21.14\/30<\/code><\/pre>\n\n\n\n<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/image-75-593x1024.png\")
<\/figure>\n\n\n\nCoPilot -> Cloud Routes -> Site 2 Cloud shows the IPSec tunnels:<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/image-77-1024x295.png\")
<\/figure>\n\n\n\nCoPilot -> Cloud Routes -> BGP Info shows the neighbor relationship:<\/p>\n\n\n\n
![\"\"](\"https:\/\/cloudlearning365.com\/wp-content\/uploads\/2022\/10\/image-76-1024x517.png\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"When working with Aviatrix External Connections, it could be confusing to understand how tunnels are established. I will take you through three scenarios and hopefully help to planning to Aviatrix External connections with other vendors.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2],"tags":[],"class_list":["post-491","post","type-post","status-publish","format-standard","hentry","category-aviatrix"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/491","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=491"}],"version-history":[{"count":17,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/491\/revisions"}],"predecessor-version":[{"id":1750,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=\/wp\/v2\/posts\/491\/revisions\/1750"}],"wp:attachment":[{"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=491"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=491"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudlearning365.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=491"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}