Connecting Windows Azure to Amazon AWS
In this post I will show how you can use a Windows Azure Virtual Network (VNET) to create a site to site IPsec tunnel to connect to a Virtual Private Cloud (VPC) hosted in Amazon Web Services (AWS). Using this setup you can literally have workloads in each cloud with full VM to VM connectivity over a secure IPsec tunnel. This scenario could easily be used for failover, backup or even migration between providers. The software VPN solution I chose for testing is Open Swan.
Creating a VPC in Amazon AWS
Starting on the Amazon side create a virtual private cloud (VPC) which is the equivalent to a virtual network in Windows Azure.
VPC Creation Wizard – Single Public Subnet with Internet Gateway
I’m choosing the 10.0.0.0/16 address space for the Amazon VPC network.
Provision an EC2 instance that will be used to host Open Swan and be the Amazon side of the tunnel.
Launch Ubuntu 13.04 into the VPC Subnet
Specify the subnet of the VPC previously deployed and I would advise bumping up the instance size to Small from Micro.
Once the instance is created switch to the EC2 view and allocate a new Elastic IP. This will be the public IP address you will connect to the VM using SSH and the IP address your Windows Azure Virtual Network will connect to.
Click Yes Allocate on the new Elastic IP dialog.
Select the instance from the drop down and click Yes Associate.
Creating the Windows Azure Virtual Network
Before configuring the Open Swan service I need to create the other side of the network in Windows Azure. To establish the IPsec tunnel Open Swan needs the gateway IP address and authentication key which both from the Windows Azure Virtual Network.
Create a Windows Azure Virtual Network
Specify Data Center Location and VNET/Affinity Group Name
Check site-to-site VPN
Define the onsite network properties which in this case is the Amazon VPC Address Space and Elastic IP of the Open Swan Server
Define the Windows Azure Address Space. Ensure you add the Gateway Subnet.
Creating the Windows Azure Virtual Network Gateway
Once the Virtual Network is created open it and click create gateway -> and select static routing.
Once the gateway is created you can get the gateway IP address and the authentication key and configure Open Swan on the Amazon side.
You will need the gateway IP and the key on the Amazon side.
Configuring Open Swan in Amazon Web Services
Connect to the Open Swan VM
Switch to the instances view, select your instance and on the Actions menu click Connect.
Select Connect with a standalone SSH client.
Copy the SSH command (or use Putty using the instructions on the screen) to connect via SSH. I’m using the Windows SSH client that comes with GitBash for the record
Once connected install and configure Open Swan for the VPN solution on the Amazon side.
Installing Open Swan
sudo apt-get install openswan
Select NO for installing a certificate since we will be using key based authentication.
The next steps require you to use a text editor to modify some configuration files. If you are rusty on using Linux editors like vi here is a handy cheat sheet: VI Cheat Sheet
Edit the ipsec.conf file
sudo vi ipsec.conf
Once open, enter edit mode by pressing: *i (in that order)
Replace the existing configuration with the following:
Exit and save the file by pressing: : x (in that order)
Change to the ipsec.d directory and create a new file named amznazure.conf.
sudo vi amznazure.conf
Contents of amznazure.conf
right=[WINDOWS AZURE GATEWAY IP]
Notes about the above configuration:
- left= is the local IP address of the Open Swan Server
- leftsubnet= is the local address space of the servers in the VPC
- right= is the IP Address of the Windows Azure VNET Gateway (replace with your own)
- rightsubnet= is the address space of the Windows Azure Virtual Network
Once you have specified the configuration you need to specify the authentication key.
sudo vi ipec.secrets
Add a line to the file in the following format (do not add the  brackets):
10.0.0.28 [WINDOWS AZURE GATEWAY IP] : PSK "[WINDOWS AZURE GATEWAY KEY]"
Next, enable enable IP forwarding to the Open Swan VM:
Then uncomment this line:
Apply the changed network setting.
sudo sysctl -p /etc/sysctl.conf
Next, disable source / destination checking on the Open Swan server.
Modify Security Groups to Allow Traffic from Windows Azure
In the Amazon management console select Security Groups and -> amzn-azure-group.
Add two custom UDP inbound rules – one for 500 and one for 4500 using the Windows Azure GW IP with /32 as the CIDR.
sudo service ipsec restart
Windows Azure Virtual Network Connected to Amazon AWS Virtual Private Cloud
The reason the software VPN solution needs to be on the Amazon AWS side is because the AWS networking stack supports configuring routing tables where Windows Azure does not (yet I assume).
In the Amazon management console switch back to the VPC view and select route tables.
Select the route table associated with your VPC and add a new route to the 172.16.0.0/16 (Windows Azure Network) and that routes traffic through the instance ID of the Open Swan Server.
Updating Route Information
Creating Instances to Test Connectivity
Create an instance in AWS on the VPC Subnet.
Launch an instance in Windows Azure on the Virtual Network created.
One both instances are up you will need to enable the ICMP rule on each VM to test out connectivity using PING.
Pinging an Azure VM from an Amazon VM over the IPsec Tunnel
Pinging an Amazon VM from an Azure VM over the IPsec Tunnel
That is it!
I can now deploy applications into Amazon AWS and Windows Azure and communicate between the two on a secure IPsec tunnel over the Internet.