AWS-AMAZON2016. 6. 2. 19:55

aws centos 6.3

dd if=/dev/zero of=/swapfile bs=1M count=16384


chown root:root /swapfile

  

chmod 600 /swapfile

  

mkswap /swapfile

  

swapon /swapfile

 

swapon -a

 


vi /etc/fstab

/swapfile   swap   swap   defaults  0  0


fdisk 파티션 생성

mkfs.ext4 /dev/xvdg1

mkdir /data

fsbat

blkid uuid 확인

fstab 수정

/dev/xvdg1
mount -a
 


/dev/xvdg1

 


 

 

'AWS-AMAZON' 카테고리의 다른 글

Amazon 클라우드 서비스 (AWS)에 대한 소개  (0) 2015.11.16
AWS EC2의 ROOT 계정 활성화, 패스워드 설정, 패스워드로 로그인 활성화  (0) 2015.08.12
AWS LINUX SSH 접속  (0) 2015.02.16
AMAZON VPN 구성 (Adding a Hardware Virtual Private Gateway to Your VPC)  (0) 2013.04.04
Posted by 배움나눔
AWS-AMAZON2015. 11. 16. 20:31

Amazon 클라우드 서비스 (AWS)에 대한 소개

출처 : http://bcho.tistory.com/531


Amazon 클라우드 서비스는 상용화되고 성숙된 Iaas 방식의 Public 클라우드 서비스중의 하나이다. 여기서는 Amazon 클라우드 서비스의 각각의 기능에 대해서 간략하게 소개한다.

Amazon EC2

Amazon EC2는 Amazon 클라우드 서비스의 가장 대표적인 Iaas 서비스 컴포넌트이다. Amazon은 하드웨어 서버를 가상화 하여, 가상화된 하드웨어 자원을 사용자에게 제공하고, 사용자는 그 위에 OS와 소프트웨어를 설치하여 클라우드 서비스를 사용하는 개념이다.

Amazon에서는 Pre configure된 OS 이미지를 제공해서 사용자로 하여금 원하는 이미지와 소프트웨어를 선택할 수 있도록 하고, 또는AMI (Amazon Machine Image)라는 형태로 사용자가 직접 시스템에 대한 이미지를 올려서 사용할 수 있도록 한다.

Amazon에서 제공하는 Pre configure된 이미지들은 다음과 같다.

 

Application Development Environments

Application Servers

Video Encoding & Streaming

IBM sMash

IBM WebSphere Application Server

Wowza Media Server Pro

JBoss Enterprise Application Platform

Java Application Server

Windows Media Server

Ruby on Rails

Oracle WebLogic Server

 

 

위의 표에서 보는 것과 같이 Java,.NET,Ruby on Rails와 같은 다양한 프로그래밍 플랫폼과 Oracle, MySQL,DB2 과 같은 다양한 데이터 베이스는 물론이고 Media Server와 같은 Streaming Service와, WebSphere Portal과 같은 애플리케이션 서비스도 제공할 수 있는 구조가 된다.

기본적으로 EC2는 하드웨어를 가상화하기 때문에 원하는 OS와 원하는 소프트웨어를 대부분 Install할 수 있는 장점을 가지고 있기 때문에 플랫폼에 대한 수용력이 높다.

 반대로 가상화된 하드웨어 자원에 대해서만 서비스를 제공할 뿐 그위에 설치되는 OS와 소프트웨어에 대해서는 서비스를 제공하지 않기 때문에 사용하는 사용자 입장에서는 해당 소프트웨어에 대한 라이선스 구매와 유지 보수료 지불에 대한 비용 지불 그리고 각각 소프트웨어에 대한 설치와 운영을 별도로 해야 하기 때문에 기존 on premise 방식의 운영 방식에 비해서는 하드웨어 자원을 임대하여 쓰는 것 이외에는 소프트웨어 비용에 대한 문제와 운영관점의 문제는 그대로 남아 있는 문제점을 가지고 있다.

Amazon SDB (Simple DB)

Simple DB 서비스는 Key-Value 타입의 데이터를 저장하기 위한 데이터 저장소 서비스이다. No-SQL인 Cassandra나 Hadoop 기반의HBase와 유사하게 Key-Value 타입의 데이터를 저장하고, 대용량의 데이터 저장 및 빠른 검색을 지원하며, Value에 들어가는 데이터의 형에는 제약이 없다. 이런 특성을 Schemeless라고 하는데, 관계형 데이터 저장이 필요 없는 데이터 구조에서 데이터 저장의 유연성을 부여해준다.

Amazon SimpleDB의 특징중의 하나는 Geo Replication이 가능하다는 것이다. Simple DB에 저장된 데이터는 물리적으로 떨어진Amazon의 데이터 센터에 복제되기 때문에 데이터의 접근성을 향상 시키고 장애시 데이터에 대한 안정성을 보장한다.

Amazon S3 (Simple Storage Service)

SDB가 Key-Value 페어로된 간단한 형식의 작은 크기의 데이터 저장을 위해 디자인 되었다면 S3는 대용량 Blob 데이터에 대한 저장을 위해서 디자인 되었다. 파일,이미지,동영상과 같은 큰 사이즈의 데이터를 저장한다. 저장될 수 있는 데이터의 수는 제한이 없으며, 저장되는 데이터의 크기는 레코드당 1byte에서 최대 5GB를 지원한다.

Amazon SQS (Simple Queue Service)

SQS는 IBM MQ나 JAVA의 JMS와 같은 전통적인 Queue의 Amazon 클라우드 버전으로 생각하면 된다. Queue를 통해서 Reliable Messaging이나 Asynchronous 아키텍쳐 구성을 지원한다.

Queue에 저장되는 메시지는 개당 최대 64Kb 까지 지원하며, 최대 14일까지 Queue에 저장될 수 있다.

Amazon RDS (Relational Database Service)

RDB 서비스는 MySQL 기반의 관계형 데이터 베이스 서비스를 제공한다. 대부분의 MySQL Feature를 지원하며 (geo replication 포함)

흥미로운 특징 중의 하나는 데이터베이스 아키텍쳐중의 하나인 Query-off loading 아키텍쳐를 지원한다는 것이다. 이 아키텍쳐는 Read Transaction이 많은 경우, 하나의 Master DB에 Create/Update/Delete를 일으키고 여러 개의 Slave DB에 데이터를 복사하여 여러 개의Slave DB에서 Read 관련 Transaction을 수행함으로써 Read Transaction을 분산 시켜서 대규모 처리를 가능하게 한다.

Amazon EBS (Elastic Block Storage)

EBS는 EC2 인스턴스에 Attach될 수 있는 가상의 하드디스크이다. 하나의 EC2 인스턴스에는 여러개의 EBS 볼륨이 마운트 될 수 있으며,하나의 볼륨 크기는 1GB~1TB이다. 실제로 저장될 때는 S3 서비스를 이용해서 저장되는데, 흥미로운 점은 분산 파일 구조를 채택하기 때문에 IO Performance가 상당히 높은 편이며, EBS는 Booting Partition으로도 마운트가 가능하다.

또한 특정 시점에 EBS의 이미지를 S3에 저장하여 백업용도로 사용가능하다.

Amazon Elastic Map & Reduce

Map & Reduce는 대규모 분산처리를 위한 처리 알고리즘으로, 하나의 큰 작업을 여러 단위의 작업으로 쪼갠후 (Map) 분산된 노드에서 각자 처리한 후 처리 결과를 하나로 모으는 (Reduce) 작업을 통해서 처리시간을 향상 시키는 기법이다. 주로 검색 결과 분석을 위해서 많이 사용되는데, 대표적인 오픈소스 구현으로는 Hadoop이 있다.

Amazon에서는 이 Hadoop기반의 Map & Reduce를 지원한다.

Map & Reduce를 실제 구축하기 위해서는 많은 수의 CPU와 고성능 IO를 지원하는 분산 파일 시스템이 필요하기 때문에 클라우드 시나리오에 매우 적절한 모델이며 주로 수학적인 계산등이 필요한 과학/계산 애플리케이션에 많이 활용될 수 있다.

Amazon Elastic Load Balancing

클라우드 서비스에서 여러 개의 인스턴스를 운영하면 당연히 필요한 것이 인스턴스간의 부하분산이다. Amazon에서는 Elastic Load Balancing이라는 이름으로 진보된 형태의 부하분산 메커니즘을 제공한다.

o    하나의 데이터센터내에 배포된 인스턴스간 뿐만 아니라 여러 데이터센터에 걸쳐서배포된 인스턴스간에도 부하 분산을 지원

o    각 사용자들에 대해서 특정 인스턴스로 Connection을 Pinning 해주는 (L4에서 TCP Session이 한번 맺어지면 유지하는 것과 유사한 방식) 기능을 지원한다. 이 기능의 경우 서버쪽에 사용자의 상태를 저장하는 아키텍쳐 (웹 세션 저장과 같은 시나리오)를 구현할 수 있게 해준다.

o    또한 인스턴스의 상태를 파악하여 인스턴스가 장애가 났을 때, 장애가 난 인스턴스를 인지하여 정상적인 인스턴스로만 요청을 전달하는 Fail Over 기능을 지원한다.

Amazon Auto Scaling

클라우드에 있어서 가장 중요한 기능중 하나가, 쓴만큼 지불하되, 요구 용량이 늘어나면 서비스 가용 용량도 따라서 증가해야 한다. 인스턴스는 독립된 VM(제약된 CPU와 메모리 용량)을 기본으로 서비스를 제공하기 때문에 인스턴스에 할당된 VM의 용량을 넘어서는 경우에는 추가로 VM을 할당해줘야 한다. 이러한 일련의 작업을 자동으로 해주는 것이 Auto Scaling기능인데, Amazon EC2에서는 “CPU사용량이 몇 %이상 또는 저장 용량이 얼마 이상” 과 같은 조건을 정해놓으면 조건을 일치하는 시점에 자동으로 인스턴스를 늘리는 서비스를 제공한다.

Amazon SNS (Simple Notification Service)

일반적인 서비스 모델이 클라이언트 요청에 대해서 서버가 응답하는데, 비해서 Notification 서비스는 서버가 클라이언트에 요청을 보내는 모델이다. 대표적으로 핸드폰의 SMS나 이메일 푸쉬 서비스등이 이에 해당하는데, Amazon에서는 이러한 형태의 Notification Service를 제공한다.

Amazon의 Notification Service는 HTTP와 SMTP 프로토콜만을 지원한다.

기본적인 모델은 Subscription 모델로, Notification을 받고자 하는 클라이언트가 Topic(주제)에 Subscription을 신청하면 등록된 클라이언트들에서 이벤트가 있을 경우 Notification을 보내주는 모델이다.

 

Amazon VPC (Virtual Private Cloud)

VPC서비스는 Amazon EC2 클라우드의 인스턴스와 고객사의 on-premise 시스템 사이에 VPN 을 설정하여 EC2 클라우드 인스턴스를 특정 고객사에서만 접근할 수 있도록 해주는 서비스이다.

이 서비스는 일종의 Hosted Private Cloud 모델로 EC2내의 특정 자원에 대한 접근을 특정 고객사로 Dedication 해줄 수 있는 기능을 가지고 있으나, 반대로 해당 시스템은 EC2 대외 고객은 접근이 불가능 하다. 예를 들어 쇼핑몰의 판매 정보를 EC2에서 on-premise 시스템으로 VPC를 통해서 전송하고, 고객에게는 쇼핑몰 판매 서비스를 제공하는 형태의 서비스가 불가능 하다는 것이다. (VPC 인스턴스는on-premise 시스템과만 접속이 가능하다.)

Amazon CloudFront

CloudFront 서비스는 Amazon에서 제공하는 CDN (Contents Delivery Network) 서비스이다. Amazon S3에 저장된 Binary 데이터를CDN 노드를 이용하여 전세계에 걸쳐서 다운로드 속도에 대한 성능을 올려주는 서비스이다. (CDN은 전세계에 여러 센터에 걸쳐서 배포되고, CDN 서버들이 일종의 캐쉬 서버 역할을 해서 거리로 인해서 발생하는 Latency를 줄여준다.)

아래 그림과 같이 CloudFront는 미국,유럽,아시아에 걸쳐 총 16개의 CDN 센터를 운영하고 있다. 


United States (Ashburn, VA) (Dallas/Fort Worth, TX) (Los Angeles, CA) (Miami, FL) (New York, NY) (Newark, NJ) (Palo Alto, CA) (Seattle, WA) (St. Louis, MO)

Europe Amsterdam,Dublin,Frankfurt,London

Asia Hong Kong,Tokyo,Singapore  총 16개 센터

(원본 http://www.michaelgaigg.com/blog/2008/11/19/fast-faster-cloudfront-speed-matters/ )

 

Amazon Cloud Watch

Cloud Watch는 EC2와 S3등의 Amazon 클라우드 서비스에 대한 모니터링 기능을 수행한다. 모니터링을 통하여 서버의 부하와 장애 상태를 체크하고 Elastic Load Balancer와 연동하여 비 장애 노드로 요청을 전달하고, 부하 상황에 따라 Auto Scaling 서비스와 연동하여 서비스 인스턴스 수를 탄력적으로 조정할 수 있게 해준다.

 

지금까지 Amazon Cloud의 기능에 대해서 살펴보았다. 여기서는 플랫폼적인 기능에대해서만 주력해서 살펴보았는데, Amazon은Amazon MarketPlace를 Customization하기 위한 Fulfilment Service나, Billing/Payment Service, 그리고 다양한 Support 프로그램등을 가지고 있다. 조금 더 자세한 사항은 http://aws.amazon.com/products/ 를 참고하기 바란다.

'AWS-AMAZON' 카테고리의 다른 글

aws centos 6.3  (0) 2016.06.02
AWS EC2의 ROOT 계정 활성화, 패스워드 설정, 패스워드로 로그인 활성화  (0) 2015.08.12
AWS LINUX SSH 접속  (0) 2015.02.16
AMAZON VPN 구성 (Adding a Hardware Virtual Private Gateway to Your VPC)  (0) 2013.04.04
Posted by 배움나눔
AWS-AMAZON2015. 8. 12. 19:33

AWS EC2의 ROOT 계정 활성화, 패스워드 설정, 패스워드로 로그인 활성화

출처 : http://lab4109.blogspot.kr/2013/10/aws-ec2-root.html


AWS EC2의 ROOT 계정 활성화, 패스워드 설정, 패스워드로 로그인 활성화

기본적으로 key pair file을 이용하도록 권장하고 있지만 root 계정이 가끔 필요할 때도 있고 일단은 뭐 보안이 크게 중요하지 않은 테스트 환경이라 한 번 설정해 본다.

1. root password 설정

?
1
2
3
4
ubuntu@ip-172-31-24-62:~$ sudo passwd root
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully

2. password 기반의 로그인을 활성화하기

?
1
ubuntu@ip-172-31-24-62:~$ sudo vi /etc/ssh/sshd_config

?
1
2
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication no

위의 no를 yes로. 그리고 저장. 그럼 된다.

3. key pair로 로그인할 때를 위해서 root로 ubuntu user의 것을 복사.

?
1
2
3
4
ubuntu@ip-172-31-24-62:~$ sudo mkdir /root/.ssh
mkdir: cannot create directory ‘/root/.ssh’: File exists
ubuntu@ip-172-31-24-62:~$ sudo cp /home/ubuntu/.ssh/authorized_keys /root/.ssh/
ubuntu@ip-172-31-24-62:~$

이미 있어서 그냥 복사만 했음.

마지막으로 SSHd 설정을 리로드하기.

?
1
ubuntu@ip-172-31-24-62:~$ sudo reload ssh

그럼 테스트, root로 key 없이 접속해 보기.

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
~/Project/awskey> ssh root@54.238.207.180
root@54.238.207.180's password:
Welcome to Ubuntu 13.10 (GNU/Linux 3.11.0-12-generic x86_64)
 
 * Documentation:  https://help.ubuntu.com/
 
  System information as of Thu Oct 31 06:56:20 UTC 2013
 
  System load:  0.0              Processes:           66
  Usage of /:   9.5% of 7.75GB   Users logged in:     0
  Memory usage: 8%               IP address for eth0: 172.31.24.62
  Swap usage:   0%
 
  Graph this data and manage this system at:
    https://landscape.canonical.com/
 
  Get cloud support with Ubuntu Advantage Cloud Guest:
    http://www.ubuntu.com/business/services/cloud
 
  Use Juju to deploy your cloud instances and workloads:
    https://juju.ubuntu.com/#cloud-saucy
 
0 packages can be updated.
0 updates are security updates.
 
 
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
 
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
 
root@ip-172-31-24-62:~#

key pair를 이용해 root로 접속하기

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
~/Project/awskey> ssh -i up_db_server.pem root@54.238.207.180
Welcome to Ubuntu 13.10 (GNU/Linux 3.11.0-12-generic x86_64)
 
 * Documentation:  https://help.ubuntu.com/
 
  System information as of Thu Oct 31 08:10:46 UTC 2013
 
  System load:  0.0               Processes:           69
  Usage of /:   12.0% of 7.75GB   Users logged in:     0
  Memory usage: 26%               IP address for eth0: 172.31.24.62
  Swap usage:   0%
 
  Graph this data and manage this system at:
    https://landscape.canonical.com/
 
  Get cloud support with Ubuntu Advantage Cloud Guest:
    http://www.ubuntu.com/business/services/cloud
 
  Use Juju to deploy your cloud instances and workloads:
    https://juju.ubuntu.com/#cloud-saucy
 
Last login: Thu Oct 31 08:10:47 2013 from 211.106.111.78
root@ip-172-31-24-62:~#


'AWS-AMAZON' 카테고리의 다른 글

aws centos 6.3  (0) 2016.06.02
Amazon 클라우드 서비스 (AWS)에 대한 소개  (0) 2015.11.16
AWS LINUX SSH 접속  (0) 2015.02.16
AMAZON VPN 구성 (Adding a Hardware Virtual Private Gateway to Your VPC)  (0) 2013.04.04
Posted by 배움나눔
AWS-AMAZON2015. 2. 16. 18:22

AWS LINUX SSH 접속

OpenSSH Client 연결 시 permission denied(publickey)

 

AWS에서 ssh 를 통해 계정 패스워드를 입력 하다 보면  putty나 SSH Client에서 Permission denied(publickey)라는 오류를 출력하며 접속이 안 되는 경우가 있다.

이 경우  OpenSSH Server 설정에 Password 입력이 비 활성화 되어 있어 그런 경우가 있다

이 경우 /etc/ssh/sshd_config(Ubuntu Linux 기준) 파일에서 PasswordAuthentication를 찾아 no를 yes 변경 하면은 Password 입력을 활성화 할 수 있다.

'AWS-AMAZON' 카테고리의 다른 글

aws centos 6.3  (0) 2016.06.02
Amazon 클라우드 서비스 (AWS)에 대한 소개  (0) 2015.11.16
AWS EC2의 ROOT 계정 활성화, 패스워드 설정, 패스워드로 로그인 활성화  (0) 2015.08.12
AMAZON VPN 구성 (Adding a Hardware Virtual Private Gateway to Your VPC)  (0) 2013.04.04
Posted by 배움나눔
AWS-AMAZON2013. 4. 4. 15:30

AMAZON VPN 구성 (Adding a Hardware Virtual Private Gateway to Your VPC)

출처 : http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html

AMAZON VPN 구성

Adding a Hardware Virtual Private Gateway to Your VPC

By default, instances that you launch into a virtual private cloud (VPC) can't communicate with your own network. You can enable access to your network from your VPC by attaching a virtual private gateway to the VPC, creating a custom route table, and updating your security group rules.

You can complete this process manually, as described on this page, or let the VPC creation wizard take care of many of these steps for you. For more information about using the VPC creation wizard to set up the virtual private gateway, see Scenario 3: VPC with Public and Private Subnets and Hardware VPN Access or Scenario 4: VPC with a Private Subnet Only and Hardware VPN Access.

Although the term VPN connection is a general term, in the Amazon VPC documentation, a VPN connection refers to the connection between your VPC and your own network.

Topics

For information about how you're charged for using a VPN connection with your VPC, see the Amazon VPC product page.

Components of Your VPN

A VPN connection consists of the following components.

Virtual Private Gateway

A virtual private gateway is the VPN concentrator on the Amazon side of the VPN connection.

For information about how many virtual private gateways you can have per region, as well as the limits for other components within your VPC, see Amazon VPC Limits.

Customer Gateway

A customer gateway is a physical device or software application on your side of the VPN connection.

For a list of customer gateways that we have tested with Amazon VPC, see Amazon Virtual Private Cloud FAQs.

VPN Configuration Examples

The following diagrams illustrate single and multiple VPN connections. The VPC has an attached virtual private gateway, and your network includes a customer gateway, which you must configure to enable the VPN connection. You set up the routing so that any traffic from the VPC bound for your network is routed to the virtual private gateway.

When you create multiple VPN connections to a single VPC, you can configure a second customer gateway to create a redundant connection to the same external location. You can also use it to create VPN connections to multiple geographic locations.

Single VPN Connection

VPN layout

Multiple VPN connections

Multiple VPN layout

VPN Routing Options

When you create a VPN connection, you must specify the type of routing that you plan to use. The type of routing that you select can depend on the make and model of your VPN devices. If your VPN device supports Border Gateway Protocol (BGP), specify dynamic routing when you configure your VPN connection. If your device does not support BGP, specify static routing. For a list of static and dynamic routing devices that have been tested with Amazon VPC, see the Amazon Virtual Private Cloud FAQs.

When you use a BGP device, you don't need to specify static routes to the VPN connection because the device uses BGP to advertise its routes to the virtual private gateway. If you use a device that doesn't support BGP, you must select static routing and enter the routes (IP prefixes) for your network that should be communicated to the virtual private gateway. Only IP prefixes that are known to the virtual private gateway, whether through BGP advertisement or static route entry, can receive traffic from your VPC.

We recommend that you use BGP-capable devices, when available, because the BGP protocol offers robust liveness detection checks that can assist failover to the second VPN tunnel if the first tunnel goes down. Devices that don't support BGP may also perform health checks to assist failover to the second tunnel when needed.

What You Need for a VPN Connection

To use Amazon VPC with a VPN connection, you or your network administrator must designate a physical appliance as your customer gateway and configure it. We provide you with the required configuration information, including the VPN preshared key and other parameters related to setting up the VPN connection. Your network administrator typically performs this configuration. For information about the customer gateway requirements and configuration, see the Amazon Virtual Private Cloud Network Administrator Guide.

The following table lists the information that you need to have so that we can establish your VPN connection.

Item How Used Comments  

The type of customer gateway (for example, Cisco ASA, Juniper J-Series, Juniper SSG, Yamaha)

Specifies how to format the returned information that you use to configure the customer gateway.

 

Internet-routable IP address (static) of the customer gateway's external interface.

Used to create and configure your customer gateway (it's referred to as YOUR_UPLINK_​ADDRESS)

The value must be static and can't be behind a device performing network address translation (NAT).

  

(Optional) Border Gateway Protocol (BGP) Autonomous System Number (ASN) of the customer gateway, if you are creating a dynamically routed VPN connection.

Used to create and configure your customer gateway (referred to as YOUR_BGP_ASN).

If you use the wizard in the console to set up your VPC, we automatically use 65000 as the ASN.

You can use an existing ASN assigned to your network. If you don't have one, you can use a private ASN (in the 64512–65534 range). For more information about ASNs, see the Wikipedia article.

Amazon VPC supports 2-byte ASN numbers.

  

Internal network IP ranges that you want advertised over the VPN connection to the VPC.

Used to specify static routes.

  

Configuring Two VPN Tunnels for Your VPN Connection

You use a VPN connection to connect your network to a VPC. Each VPN connection has two tunnels, with each tunnel using a unique virtual private gateway public IP address. It is important to configure both tunnels for redundancy. When one tunnel becomes unavailable (for example, down for maintenance), network traffic is automatically routed to the available tunnel for that specific VPN connection.

The following diagram shows the two tunnels of the VPN connection.

Using Redundant VPN Connections to Provide Failover

As described earlier, a VPN connection has two tunnels to help ensure connectivity in case one of the VPN connections becomes unavailable. To protect against a loss of connectivity in case your customer gateway becomes unavailable, you can set up a second VPN connection to your VPC by using a second customer gateway. By using redundant VPN connections and customer gateways, you can perform maintenance on one of your customer gateways while traffic continues to flow over the second customer gateway's VPN connection. To establish redundant VPN connections and customer gateways on your network, you’ll need to set up a second VPN connection. The customer gateway IP address for the second VPN connection must be publicly accessible and can’t be the same public IP address that you are using for the first VPN connection.

The following diagram shows the two tunnels of the VPN connection and two customer gateways.

Dynamically routed VPN connections use the Border Gateway Protocol (BGP) to exchange routing information between your customer gateways and the virtual private gateways. Statically routed VPN connections require you to enter static routes for the network on your side of the customer gateway. BGP advertised and statically entered route information allow gateways on both sides to determine which tunnels are available and reroute traffic if a failure occurs. We recommend that you configure your network to use the routing information provided by BGP (if available) to select an available path. The exact configuration depends on the architecture of your network.

Setting Up the VPN Connection

Use the following procedure to manually set up the VPN connection. Alternatively, you can create the VPC and subnets and complete the first four steps in this procedure using the VPC wizard. For more information, see Implementing Scenario 3 or Implementing Scenario 4.

This procedure assumes that you have a VPC with one or more subnets, and that you have the required network information (see What You Need for a VPN Connection).

  1. Create a customer gateway.

    1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

    2. In the navigation pane, click Customer Gateways, and then click Create Customer Gateway.

    3. Specify the routing type and the static IP address for your customer gateway device, and then click Yes, Create.

  2. Create a virtual private gateway and attach it to the VPC.

    1. In the navigation pane, click Virtual Private Gateways, and then click Create Virtual Private Gateway.

    2. Click Yes, Create when prompted.

    3. Select the virtual private gateway that you just created, and then click Attach to VPC.

    4. In the Attach to VPC dialog box, select the VPC from the list, and then click Yes, Attach.

  3. Add a route to the route table and enable route propagation.

    1. In the navigation pane, click Route Tables, and then select the route table that's associated with the subnet; by default, this is the main route table for the VPC.

    2. On the Routes tab in the details pane, if you are using static routing for your VPN connection, add the static route used by your VPN connection in the Destination box, and then click Add.

    3. On the Routes tab, enter the IP prefix for your customer network in the Destination box, select the virtual private gateway ID in the Target list, and then click Add.

    4. On the Route Propagation tab in the details pane, select the virtual private gateway associated with the VPC from the list, and then click Add.

      Note

      If you configured your VPN connection to use dynamic routing and you've enabled route propagation, the BGP advertised routes from your customer gateway won't appear in the route table unless the status of the VPN connection is UP.

  4. Add rules to the security group to allow SSH and RDP access from your network. For more information about adding inbound rules, see Adding and Removing Rules.

    1. In the navigation pane, click Security Groups, and then select the default security group for the VPC.

    2. On the Inbound tab in the details pane, add a rule for inbound SSH access and a rule for inbound RDP access to the group from your network, and then click Apply Rule Changes.

  5. Create a VPN connection.

    1. In the navigation pane, click VPN Connections.

    2. Click Create VPN Connection.

    3. In the Add VPN Connection dialog box, do the following, and then click Yes, Create:

      • Specify the IP address for your customer gateway.

      • Select one of the routing options based on whether your VPN router supports Border Gateway Protocol (BGP):

        • If your VPN router supports BGP, select Use dynamic routing (requires BGP).

        • If your VPN router does not support BGP, select Use static routing. In the IP Prefix box, specify each IP prefix for the private network of your VPN connection, and then click Add.

  6. Configure the customer gateway.

    1. In the navigation pane, click VPN Connections.

    2. Select your VPN connection, and then click Download Configuration.

    3. Give the configuration information to your network administrator, along with this guide: Amazon Virtual Private Cloud Network Administrator Guide. After the network administrator configures the customer gateway, the VPN connection is operational.

  7. Launch an instance into the subnet.

    1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

    2. In the navigation pane, click Instances.

    3. Click Launch Instance.

    4. On the Create a New Instance page, click Quick Launch Wizard and follow the directions. Specify a name for your instance, choose a key pair, select an AMI, and then click Continue.

    5. Click Edit Details, select Launch into a VPC under Instance Details, specify a subnet, and then click Save Details.

    6. Review the settings that you've chosen. Make any changes that you need, and then click Launch.

Testing the End-to-End Connectivity of Your Instance

After you set up your VPN connection and launch an instance, you can test the connection by pinging the instance. You just need to use an AMI that responds to ping requests. We recommend you use one of the Amazon Linux AMIs. If you are using instances running Windows Server, you'll need to log in to the instance and enable inbound ICMPv4 on the Windows firewall in order to ping the instance.

Important

You must configure any security group or network ACL in your VPC that filters traffic to the instance to allow inbound and outbound ICMP traffic.

You can monitor the status of your VPN connections using the Amazon VPC console or by using the Amazon EC2 API/CLI. You can view information about your VPN connections, including its state, the time since last state change, and descriptive error text.

To test the end-to-end connectivity

  1. After the instance is running, get its private IP address (for example, 10.0.0.4). The Amazon EC2 console displays the address as part of the instance's details.

  2. From a computer in your network that is behind the customer gateway, use the ping command with the instance's private IP address. A successful response is similar to the following:

    PROMPT> ping 10.0.0.4
Pinging 10.0.0.4 with 32 bytes of data:

Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.0.4:
Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),

Approximate round trip times in milliseconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

You can now use SSH or RDP to connect to your instance in the VPC. For more information about how to connect to a Linux instance, see Connect to Your Linux Instance in theAmazon Elastic Compute Cloud User Guide. For more information about how to connect to a Windows instance, see Connect to Your Windows Instance in the Amazon Elastic Compute Cloud Microsoft Windows Guide.

Replacing Compromised Credentials

If you believe that the tunnel credentials for your VPN connection have been compromised, you can change the IKE preshared key. To do so, delete the VPN connection, create a new one using the same virtual private gateway, and configure the new keys on your customer gateway. You also need to confirm that the tunnel's inside and outside addresses match, because these might change when you recreate the VPN connection. While you perform the procedure, communication with your instances in the VPC stops, but the instances continue to run uninterrupted. After the network administrator implements the new configuration information, your VPN connection uses the new credentials, and the network connection to your instances in the VPC resumes.

Important

This procedure requires assistance from your network administrator group.

To change the IKE preshared key

  1. Delete the VPN connection. You don't need to delete the VPC or the virtual private gateway.

    1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

    2. In the navigation pane, click VPN Connections.

    3. Select the VPN connection and click Delete.

    4. In the Delete VPN Connection dialog box, click Yes, Delete.

  2. Create a new VPN connection.

    1. On the same VPN Connections page, click Create VPN Connection. Notice that your virtual private gateway and customer gateway are already selected.

    2. Select one of the routing options based on whether your VPN router supports Border Gateway Protocol (BGP). If you are unsure, see Amazon Virtual Private Cloud FAQs.

      • If your VPN router supports Border Gateway Protocol (BGP), click Use dynamic routing (requires BGP).

      • If your VPN router does not support BGP, click Use static routing. In the IP Prefix box, enter each IP prefix for your network, and then click Add.

    3. Click Yes, Create.

      Launch the wizard

  3. Download a new customer gateway configuration, which your network administrator must implement. This new configuration replaces the previous gateway configuration that used the old IKE preshared key.

    1. Select the VPN connection that you just created, and then click Download Configuration.

    2. Select the customer gateway's vendor, platform, and software version, and then click Yes, Download.

      Configuration download dialog box

    3. Save the text file and give it to your network administrator, along with the Amazon Virtual Private Cloud Network Administrator Guide.

Deleting a VPN connection

If you no longer need a VPN connection, you can delete it.

Important

If you delete your VPN connection and then create a new one, you have to download new configuration information and have your network administrator reconfigure the customer gateway.

To delete a VPN connection

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. In the navigation pane, click VPN Connections.

  3. Select the VPN connection and click Delete.

  4. In the Delete VPN Connection dialog box, click Yes, Delete.

If you no longer require a customer gateway, you can delete it. You can't delete a customer gateway that's being used in a VPN connection.

To delete a customer gateway

  1. In the navigation pane, click Customer Gateways.

  2. Select the customer gateway to delete and click Delete.

  3. In the Delete Customer Gateway dialog box, click Yes, Delete.

If you no longer require a virtual private gateway for your VPC, you can detach it.

To detach a virtual private gateway

  1. In the navigation pane, click Virtual Private Gateways.

  2. Select the virtual private gateway and click Detach from VPC.

  3. In the Detach from VPC dialog box, click the VPC list, select the VPC to detach, and then click Yes, Detach.

If you no longer require a virtual private gateway, you can delete it. You can't delete a virtual private gateway that's still attached to a VPC.

To delete a virtual private gateway

  1. Select the virtual private gateway to delete and click Delete.

  2. In the Delete Virtual Private Gateway dialog box, click Yes, Delete

'AWS-AMAZON' 카테고리의 다른 글

aws centos 6.3  (0) 2016.06.02
Amazon 클라우드 서비스 (AWS)에 대한 소개  (0) 2015.11.16
AWS EC2의 ROOT 계정 활성화, 패스워드 설정, 패스워드로 로그인 활성화  (0) 2015.08.12
AWS LINUX SSH 접속  (0) 2015.02.16
Posted by 배움나눔

티스토리툴바