SMA1000 AWS Reference Deployment

Introduction

This CloudFormation template serves as the reference deployment for an SMA1000 virtual appliance in AWS. In addition to deploying an SMA1000 appliance, it also configures a static IP pool for Connect Tunnel clients, an optional site-to-site VPN connection to a private on-prem network, and the routing required to make it all work.

Architecture

Network Diagram

Components

• Appliance VPC
  • SMA1000 appliance instance
  • Route to static IP pool CIDR, with SMA1000 appliance ENI adapter designated as next hop
  • Transit gateway attachment (if site-site-to VPN is enabled)
  • Route to on-prem network CIDR, via transit gateway attachment (if site-site-to VPN is enabled)
• Static IP Pool
  • Reserved CIDR which does not overlap with appliance VPC (or on-prem network, if site-site-to VPN is enabled)
• Transit Gateway (if site-site-to VPN is enabled)
  • Static route to appliance VPC CIDR, via appliance VPC attachment
  • Static route to static pool CIDR, via appliance VPC attachment
• IPsec site-to-site VPN connecting to on-prem network (if site-site-to VPN is enabled)
  • Customer gateway
  • Transit gateway attachment

Usage

You can use the following link to deploy this template via the AWS web console:

Parameters

Authentication

• KeyPair - EC2 SSH key pair to add to authorized_keys on SMA1000 appliance.

Appliance VPC

• ApplianceVpcCidr - Network address for appliance VPC in CIDR notation.
• ApplianceSubnetCidr - Network address for appliance subnet in CIDR notation.
• RedirectAll - Enable "redirect all" tunnel mode on the SMA1000 appliance using an AWS-managed NAT Gateway? This option is not compatible with IPv6 parameter as AWS NAT Gateways do not support outbound IPv6 traffic.
• Ipv6 - Enable IPv6? Not compatible with RedirectAll parameter as AWS NAT Gateways do not support outbound IPv6 traffic.

Static Pool

• StaticPoolCidr - Private IPv4 network address for static pool in CIDR notation. All traffic to this CIDR will be routed through the SMA1000 appliance.
• StaticPoolV6Cidr - Private IPv6 network address for static pool in CIDR notation. Required if IPv6 is enabled. All traffic to this CIDR will be routed through the SMA1000 appliance.
• SiteToSiteVpn - Create IPsec site-to-site VPN connection to a remote gateway device?

Site-to-Site VPN

• SiteToSiteRemoteGatewayPublicIp - Public IP address of remote gateway device for site-to-site VPN. Required if site-to-site VPN connection is enabled.
• SiteToSiteRemoteGatewayBgpAsn - Remote gateway device ASN for site-to-site VPN. Required if site-to-site VPN connection is enabled.
• SiteToSitePreSharedKey - IPsec pre-shared key for site-to-site VPN. Required if site-to-site VPN connection is enabled.
• SiteToSiteRemoteCidr - Remote IPv4 network address for site-to-site VPN. Required if site-to-site VPN connection is enabled. All traffic to this CIDR will be routed through the site-to-site VPN connection.

Outputs

This template has 2 unconditional outputs:

• AppliancePublicIp - Public IP address of SMA1000 appliance.
• ApplianceInstanceId - Instance ID of SMA1000 appliance. This is also the password for both the admin and tunnel users.

If you have enabled the site-to-site VPN connection, there are 2 additional outputs:

• TunnelPublicIp1 - Public IP for AWS side of site-to-site VPN tunnel #1.
• TunnelPublicIp2 - Public IP for AWS side of site-to-site VPN tunnel #2.

Remote Gateway Configuration

If you have enabled the site-to-site VPN connection then you also need to configure your remote gateway device. The template outputs TunnelPublicIp1 and TunnelPublicIp2 are the public IPs on the AWS side of the site-to-site VPN tunnel that you need to configure your device to connect to. Only one tunnel needs to be active for the solution to work, although AWS recommends configuring both for redundancy.

Post-Deployment

Admin Access

Login with the username admin and the password indicated in the ApplianceInstanceId template output.

Connect Tunnel Access

Connect Tunnel access is configured on the SMA1000 appliance and ready to use immediately after the deployment completes. Login with the username tunnel and the password indicated in the ApplianceInstanceId template output.

SMA1000 Access Policies

If the site-to-site VPN connection is enabled, an SMA1000 access policy allowing the tunnel user access to the remote network CIDR is created for you automatically. If you wish to allow access to other internal resources or to define more restrictive policies for the site-to-site VPN connection, then you may need to modify the appliance configuration. See the SMA1000 administration guide for more information.