How to access AWS using Cloud Connect

Leaseweb offers private connectivity to AWS services, such as their VPC, from selected Leaseweb Data Centers. You can create a network connection from your Leaseweb services to your AWS services using the Leaseweb Cloud Connect service.

Optionally, this connection can be fully redundant using different devices and paths between AWS and Leaseweb.

Description

Cloud Connect supports the following AWS Direct Connect models:

• Hosted Virtual Interface (VIF)
• Hosted Connection

Both Direct Connect models provide access to private IP space (RFC 1918) to a Virtual Private Cloud (VPC) within AWS.

Deploying an AWS Hosted VIF connection

The delivery of a Cloud Connect – AWS Hosted VIF order has 3 phases:

• Phase 1: Requesting information
• Phase 2: Accepting Virtual Interface in the AWS console
• Phase 3: BGP configuration and testing

Phase 1 (Requesting information)

To deploy a Hosted VIF connection, we will first need some of your information. You will receive an email requesting the following details:

• AWS Account ID
• If your AWS VPC is attached to a Virtual Private Gateway, we require the Amazon side ASN of the Virtual Private Gateway
• If you have already created a Direct Connect Gateway, we require the Amazon side ASN of the Direct Connect Gateway
• If you are using another Private IP space than the default one.

How to find the ASN of your AWS Virtual Private Gateway

1. Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2.  In the navigation pane, click on Virtual private gateways.
   
3. Select the radio button next to your Virtual Private gateway and click Edit.
   
4. You will see the ASN in the new screen that pops up. Note: default AWS ASN is 65001.

How to find the ASN of your AWS Virtual Direct Connect Gateway

1.  Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Direct Connect gateways.
   
3. Click on the Direct Connect gateway.
   
4. On the next page, you will see the ASN. Note: default AWS ASN is 65001.
   

The above information is required for us to deploy the Hosted Virtual Interface.

Phase 2 (Accepting Virtual Interface in AWS console)

Once the Hosted VIF has been deployed, you will need to accept the Virtual Interface in the AWS console.

Leaseweb will configure the connection, and we will notify you by email to accept the Interface in AWS.
We will also provide the name of the interface to accept and ask you to provide the Amazon side ASN, in case you haven’t created a Virtual Private Gateway or Direct Connect Gateway.
If you already have a Gateway, please provide us with the used Amazon ASN from your gateway settings.

Creating an AWS Private Virtual Gateway

1.  Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Virtual private gateways.
   
3. In the next screen, click on Create virtual private gateway.
   
4. In the next screen, fill in the Name tag field, select the Custom ASN check box, and fill in the ASN that you prefer to use, which should be in the 64512-65534 range or use AWS default 65001.
   Then click Create Virtual Private Gateway.
   
5.  In the next screen, you will see the message that the gateway is successfully created. Click on the Virtual Private Gateway.
6. In this screen, you can see that the Virtual Private gateway is in the detached state.
   
7. Click on Actions and select Attach to a VPC from the drop-down list.
8. In the next screen, select your VPC that you want to attach the Virtual Private Gateway and click Yes, Attach.
9.  The state of the gateway will be in attaching for a few minutes, then it will change to attached.
   
   

Creating an AWS Direct Connect Gateway

1.  Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Direct Connect gateways.
   
3. In the next screen, click Create Direct Connect Gateway.
   
4. In the next screen, fill in the Name field (any name that helps you identify the gateway), enter the Amazon side ASN (use the AWS default ASN 65001 or define one yourself), and click Create Direct Connect Gateway.
   
5. The Direct Connect Gateway is created, and the state is available.
   

Accepting the Virtual Interface

To accept the Virtual Interface in the AWS console, log in to your AWS account. Under Services, go to Networking & Content Delivery, then click on Direct Connect.
In the navigation pane, click on Virtual Interfaces and then select the Virtual Interface and click Accept.
In the Accept virtual interface dialogue box, select a Virtual Private gateway or Direct Connect gateway, and then choose ‘Accept virtual interface‘.

Reply to the email that the Virtual Interface has been accepted by you, so Leaseweb can configure BGP on the CloudConnect router.

Phase 3 (BGP configuration and testing)

You will be notified by email that BGP is configured by Leaseweb, and you will be asked to test the connection. We will also provide the Leaseweb Private IP address that we reserved to be the Gateway on the Private Network.

Enable route propagation between AWS VPC and AWS Virtual Private Gateway

You will need to enable route propagation between AWS VPC and AWS Virtual Private Gateway.

How to enable route propagation between VPC and Virtual Private Gateway:

1. Log in to the AWS console and go to your VPC.
   
2.  Click on Route Tables on the left navigation pane.
   
3. In the next screen, click on Route Propagation.
   
4.  If under propagate, you see “No”, click on Edit route propagation.
   If you see “Yes”, then route propagation is already enabled.
   
5. In the next screen, check the box next to the Virtual Private Gateway of your VPC and click Save.
   
   Your route propagation is now enabled.
   

ACL rules

• Please change inbound/outbound security rules to your AWS VMs to allow communication between the two environments.

Set static routes on your Leaseweb servers

• On your Leaseweb servers, please add a static route for your AWS IP space using the Leaseweb Private IP address as the Gateway that we provided.

This completes the setup of your AWS Hosted VIF connection, and you should be able to test and use the connection between your Leaseweb servers and AWS Instances.

Deploying an AWS Hosted Connection

An AWS Hosted Connection can be delivered as a single connection or a redundant connection.
Both options use the same Direct Connect Gateway or Virtual Private Gateway, but use a different Virtual Interface with different settings.

The delivery of a Cloud Connect – AWS Hosted Connection order has 3 phases:

• Phase 1: Requesting information
• Phase 2: Accepting connection and creating a Virtual Interface in the AWS console
• Phase 3: BGP configuration and testing

Phase 1 (Requesting information)

To deploy a Hosted Connection, we will first need some of your information. You will receive an email requesting the below:

• AWS Account ID
• If your AWS VPC is attached to a Virtual Private Gateway, we require the Amazon side ASN of the Virtual Private Gateway
• If you have already created a Direct Connect Gateway, we require the Amazon side ASN of the Direct Connect Gateway

How to find the ASN of your AWS Virtual Private Gateway

1. Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2.  In the navigation pane, click on Virtual private gateways.
   
3. Check the radio button next to your Virtual Private gateway and click Edit.
   
4. In the new screen, you will find the ASN. The default AWS ASN is 65001.

How to find the ASN of your AWS Virtual Direct Connect Gateway

1.  Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Direct Connect gateways.
   
3. Click on the Direct Connect gateway.
   
4. On the next page, you will find the ASN. The default AWS ASN is 65001.
   

The above information is required for us to deploy the Hosted Connection.

Phase 2 (Accepting connection and creating a Virtual Interface in the AWS console)

With the information provided by you, Leaseweb will configure the Cloud Connect connection.
Once the new connection has been deployed, you will need to accept the new connection to activate it.
If you ordered Redundant Cloud Connect, you will receive the information for both connections and will need to accept both connections in your Direct Connect gateway (each with its own Virtual Interface).

We will notify you by email to accept the Connection. We will also provide the following information:

1. AWS ASN (which is the ASN you have provided us)
2. Customer ASN
3. BGP Auth key
4. Customer IP address(es)
5. AWS IP Address(es)

Creating an AWS Private Virtual Gateway

1.  Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Virtual private gateways.
   
3. In the next screen, click Create virtual private gateway.
   
4. In the next screen, fill in the Name tag field. You have the option of using the AWS default ASN (65001) or selecting the Custom ASN radio button, and filling in the ASN that we have provided if you are not using the AWS default.
   Click Create Virtual Private Gateway.
   
5.  In the next screen, you will see the message that the gateway is successfully created. Click on the Virtual Private Gateway.
6. In this screen, you will see that the Virtual Private gateway is in a detached state.
   
7. Click on Actions and select Attach to a VPC from the drop-down list.
8. In the next screen, select your VPC that you want to attach the Virtual Private Gateway and click Yes, Attach.
9.  The state of the gateway will be in “attaching” for a few minutes, and will change to attached.
   

Creating an AWS Direct Connect Gateway

1.  Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Direct Connect gateways.
   
3. In the next screen, click on Create Direct Connect Gateway.
   
4. In the next screen, fill in the Name field (any name that helps you identify the gateway), enter the Amazon side ASN (the ASN that we provided), and click Create Direct Connect Gateway
   
5. The Direct Connect Gateway is created, and the state is available.
   

Accepting a Hosted Connection and creating a Virtual Interface (single and redundant connections)

Now that you have a Direct Connect Gateway, you can accept the connection Leaseweb created for you.
For Redundant Cloud Connect, you will need to accept 2 connections, each with its own settings.

1. Log in to the AWS console. Under Services, go to Networking & Content Delivery. Click on Direct Connect.
   
2. In the navigation pane, click on Connections.
   
3. The new connection will appear. Please click on it and then click Accept. The state will be pending for a few minutes while AWS deploys the connection. After it is deployed, the state will change from “ordering” to “available”.
   
4. The connection is now available.
   However, you will need to create a Virtual Interface and attach the Virtual Interface to a gateway.
5. To create a Virtual Interface, go to Virtual Interfaces and click Create Virtual Interface.
   
6. There are three Virtual interface types on the next page: Public, Private and Transit. We support Private or Transit Interfaces, so please select either Private or Transit. Please note that Transit Gateway is only supported for connections from 1Gbps and above.
   
7.  Fill in the fields below:
   • Virtual Interface Name: Use the connection name
   • Connection: In the drop-down, the connection ID you just accepted will be displayed as Virtual Interface
   • Owner: select My AWS account
   • Gateway type: select the type of Gateway that you would like to use
     • Direct Connect Gateway is a global resource, and you can associate it with up to 10 Virtual Private Gateways
     • Virtual Private Gateway can be attached to a single VPC VLAN: the VLAN ID of the Leaseweb Private Network.
     • To find the VLAN ID, log in to the Leaseweb Customer Portal and click on Private Network
   • BGP ASN:  Enter the Customer ASN that we provided
   • Click Additional Settings Information: The same information is required if you create a Transit Gateway.
   • Note: If you have selected to create a Transit Interface, on the Gateway type, the only option is Direct Connect Gateway.
8. Under Additional Settings, fill in the fields:
   • Address family: Select IPv4
   • Your router peer IP: Enter the Customer IP address that we provided
   • Amazon router IP: Enter the AWS IP address that we provided
   • BGP authentication key: Enter the BGP auth key that we provided
   • Click Create virtual interface. Note: Please do not enable MTU size 9001
     
9. The new Virtual Interface will appear under Virtual Interfaces.
   Navigate to Virtual Interfaces and click on the Virtual Interface. The state will be down because the BGP is not configured yet.
   
10. Reply to the email that you received from us and confirm that the connection is accepted, a virtual interface has been created, and it has been associated with a gateway.

Redundant Cloud Connect steps

If you ordered Redundant Cloud Connect, you will need to follow the above steps again for the second connection.

Phase 3 (BGP configuration and testing)

With the confirmation from you that the connection has been accepted, Leaseweb will configure the BGP sessions on the Cloud Connect router.
You will be notified by email that BGP is configured, and you will be asked to test the connection.

We will also provide the Leaseweb Private IP address that we reserved to be the Gateway on the Leaseweb Private Network. This gateway IP you will need to use to configure the static routes on the Leaseweb servers.

Enable route propagation between AWS VPC and AWS Virtual Private Gateway

You will need to enable route propagation between AWS VPC and AWS Virtual Private Gateway.

• How to enable route propagation between VPC and Virtual Private Gateway:
  1. Log in to the AWS console and go to your VPC.
     
  2.  Click on Route Tables on the navigation pane on the left side.
     
  3. In the next screen, click on Route Propagation.
     
  4.  If under propagate, you see “No”, click on Edit route propagation. If you see “Yes”, then route propagation is already enabled.
     
  5. In the next screen, check the box next to the Virtual Private Gateway of your VPC and click Save.
     
     Your route propagation is now enabled.
     

ACL rules

• Please change the inbound/outbound security rules for your AWS VMs to allow communication between the two environments.

Set static routes on your Leaseweb servers

• On your Leaseweb servers, please add a static route for your AWS IP space using the Leaseweb Private IP address as the Gateway that we provided.

This completes the setup of your AWS Hosted Connection, and you should be able to test and use the connection between your Leaseweb servers and AWS Instances.