Connect your AWS assets to Cato Cloud with Amazon Virtual Private Gateway

This article describes how to connect to AWS using a single non-redundant VPN connection. Though it's quick and simple, for production environments, we recommend you use dual tunnels with BGP for maximum redundancy.

This article covers the goal of connecting your AWS assets to Cato Cloud with Amazon Virtual Private Gateway for a single VPN connection with static routes.

Amazon Terminology:

Virtual Private Gateway

A virtual private gateway is the VPN endpoint on the Amazon side of the VPN connection.

Customer Gateway

A customer gateway is a physical device or software application on your side of the VPN connection. When you create a VPN connection, the VPN tunnel comes up when traffic is generated from your side of the VPN connection. The virtual private gateway is not the initiator; your customer gateway must initiate the tunnels. For more info aboutAmazon VPG (Virtual Private Gateway)

Step-by-Step configuration guide:

Let's say we have a working service (VPC, public subnet, Internet Gateway, etc.) on AWS under VPC 'Hen-GAOC-VPC' and we want to connect it through Cato Cloud.

1) In the Cato Management Application, go to Network > IP Allocation and either setup a new IP closest to the location of the AWS asset (you may also use an existing IP if already assigned). In the example, we've assigned another IP in Singapore:

In the example, we've assigned another IP in Singapore:

2) In AWS, navigate to VPC > Virtual Private Network (VPN) > Customer Gateways and create a Customer Gateway:

3) Navigate to VPC > Virtual Private Network (VPN) > Virtual Private Gateways, create a Virtual Private Gateway and attach it to the VPC:

4) Navigate to VPC > Virtual Private Network (VPN) > Site-to-Site VPN Connections and create a VPN Connection:

5) Choose the VPN Connection we've just created and click on Download Configuration:

6) Open the configuration file and search for pre-shared key (we will need it soon):

7) Navigate to VPC >Virtual Private Network (VPN) > Site-to-Site VPN Connections. Once the State is Available, check the Tunnel details in the lower lefthand corner of the page, and copy the Outside IP address of the Amazon Tunnel 1.

8) In the Cato Management Application, go to Network > Sites and click New :

9) Once the site created, scroll down to the IPsec section:

10) Save and scroll down to Show connection details

11) In AWS, navigate to VPC > Route Tables. Choose VPC's Route Table, Route Propagation:

12) On the same Route Table, go to Routes and remove (if you have) the old Internet gateway 0.0.0.0 entry. This ensures that all the traffic traversed via Cato.