Redundant VPN Connection to AWS Using BGP

Ensure you have at least 2 Public IP addresses in the Cato Management Application (Network > IP Allocation):

In AWS, create a Virtual Private Gateway:

Then, navigate to the Your VPN Dashboard > Create VPC. From here create your new VPC:

Then, navigate to the Customer Gateways. Create a 2 Customer Gateways using the new IP address allocated above (in the same AWS region):

a. Name - needs to recognizable to you.

b. IP Address - these are Public IP address that you have been allocated in the Cato Management Application.

c. VPC - for each customer Gateway you will need to ensure you select the same VPC.

Then, navigate to 'Site-To-Site VPN Connections' and create 2 VPN Connections (1 to each of the new Customer Gateways you have just created):

a.Name Tag - Descriptive Name

b. Customer Gateway - Here select one of the Customer Gateways you created

c.Routing Option - Select Dynamic (BGP)

d.Tunnel Options - You stipulate the Tunnel IP's if required but if left as default AWS will use 169.x.x.x range.

Note: AWS uses the Tunnel IP to create the BGP peer with Cato over the IPsec tunnel.

Click on Download Configuration for each of the new VPN Connections you have just set up:

Within this file get the following information to help set up the Cato Management Application:

a. Pre-Shared Key

b. BGP Configuration (Private IP Address and ASN)

Now within the Cato Management Application, navigate to the Site you want to set up IPsec/BGP...

a. The set up here is exactly the same as you would for a standard IPsec site except you need to add the private IP address's that you have in the AWS configuration you downloaded earlier.

Example of IKEv1 site:

Example of IKEv2 site:

b. Next, in the BGP section, enter the following:

i. ASN's

ii. Private IP's

iii. Routing Information

Note: The tunnel with the lower Metric will be the preferred route.

To check the status of the BGP connection select Show BGP Status.

To check in AWS, navigate to Site-to-Site Connection > Select your VPC connection > Tunnel Details. From here you can see if the VPN connection is and if BGP routes have been propagated to AWS.

Note: If you want to see what routes have been publish to the AWS site go to Route Table > Find Your Routing Table > Select Routes.

From behind a Socket site or connecting with the Cato Client, ping a host within the AWS environment.

In the Cato Management Application, go to the IPsec site with BGP.

Change the IP address to create a failover:

Make sure that you save the original IP address, you need it after the test is completed.

The pings start to drop and then the connection fails over and you see that the BGP failover is working correctly.

To fail back to the primary link, change the BGP and IPsec IP address back to the original settings, After a few dropped pings the connection falls back to the primary connection.