--- title: "Set up a site-to-site VPN to AWS" description: "Connect your E2E VPC to an AWS VPC over a site-to-site IPsec VPN through an E2E Firewall, and test it with ping and SSH both ways." content_type: "how-to" product: "firewall" platform: "MyAccount" url: "/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-aws/" topic: ["network"] --- # Set up a site-to-site VPN to AWS Connect your E2E VPC to a VPC on Amazon Web Services (AWS) with a site-to-site IPsec VPN. Resources on each side reach each other on their private IPs, and the traffic between them is encrypted. Use it to reach private services across both clouds, or to run one application across E2E and AWS. On the E2E side, the tunnel ends on an E2E Firewall, a FortiGate placed in your VPC. On the AWS side, it ends on a virtual private gateway attached to the AWS VPC. A node in the E2E VPC sends traffic for AWS to the firewall's private IP. The firewall sends it through the tunnel from its public IP, and AWS delivers it into the AWS VPC. ![E2E side on the left: private instances in an E2E private subnet, behind the E2E side FortiGate. AWS side on the right: an AWS VPC with private and public subnets, and AWS Site-to-Site VPN. An IPsec tunnel joins the FortiGate to the AWS Site-to-Site VPN.](/images/myaccount/firewall/vpn-aws-architecture.png) ## Before you begin You need: - An **Active** VPC on E2E, and its address range. See [VPC](/myaccount/vpc/). - A reserved IP for the firewall's public address. A reserved IP is billed separately, for as long as you keep it. See [Reserved IP](/myaccount/reserved-ip/) for how to reserve one and what it costs. - An AWS account that can create VPCs, subnets, gateways, VPN connections, and EC2 instances. ## Example values The steps use these placeholders. Write down each value as you get it. | Placeholder | What goes there | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | `` | The firewall's public IP, a reserved IP, such as `203.0.113.10`. It is under **Public IP** on **Manage Firewall**. | | `` | The firewall's address in your E2E VPC. It is under **Private IP** on **Manage Firewall**. | | `` | Your E2E VPC's address range, a `/23` range when E2E picked it. It is under **CIDR** on **Manage Virtual Private Cloud**. | | `` | The address range you give the AWS VPC, a private `/16` range. Choose one that shares no addresses with ``. | | `` | A `/24` block inside `` for the public subnet. | | `` | Another `/24` block inside `` for the private subnet. | | `` | The AWS end of the tunnel, a public address, from the VPN configuration file you download from AWS. | | `` | The pre-shared key for the tunnel, from the same file. | | `` | The E2E node's network interface in the VPC, such as `ens4`. | | `` | The E2E test node's private IP. It is on the node's details in MyAccount. | | `` | The AWS test instance's private IP, from the AWS console. | ## Create the firewall 1. In MyAccount, under **Network**, click **Firewall**, and on **Manage Firewall**, click **Add New Firewall**. **Create Firewall Appliance** opens. 2. Choose a plan. 3. Enter **Your Firewall name**. 4. Under **Network**, in **Select VPC**, pick your E2E VPC. The firewall gets a private IP in it. 5. In **Select IP**, pick your reserved IP. It becomes the firewall's public IP. 6. Click **Create My Firewall**. 7. Wait until the firewall's **Status** is **Running**. For every choice on the form, see [Create a firewall](/myaccount/firewall/how-to/create-a-firewall/). On **Manage Firewall**, note the firewall's **Public IP**, your ``, and its **Private IP**, your ``. ## Sign in to the FortiGate 1. In a browser, go to `https://`. 2. Sign in with the username `admin` and the password from the launch email E2E sent when the firewall first ran. The FortiGate's screen opens. For more on the first sign-in, see [Sign in to the FortiGate](/myaccount/firewall/how-to/sign-in-to-the-fortigate/). ## Set up the AWS side Do these steps in the AWS console. The names, such as `E2E-AWS`, are examples. If you change one, use your name in every later step. ### Create the AWS VPC 1. Go to **VPC** > **Your VPCs**, and click **Create VPC**. 2. Enter **Name** `E2E-AWS`, **IPv4 CIDR** ``, and **Tenancy** **Default**. 3. Click **Create VPC**. ### Create the subnets 1. Go to **VPC** > **Subnets**, and click **Create Subnet**. 2. For the public subnet, enter **Name** `E2E-AWS-Public-Subnet`, **AZ** `us-east-1a`, and **CIDR** ``. Create it. 3. Create another subnet for the private side, with **Name** `E2E-AWS-Private-Subnet`, **AZ** `us-east-1a` or `us-east-1b`, and **CIDR** ``. ### Create an internet gateway 1. Go to **Internet Gateways** and create an internet gateway named `E2E-IGW`. 2. Attach it to the `E2E-AWS` VPC. ### Create a NAT gateway The NAT gateway lets instances in the private subnet reach the internet, for updates, while staying unreachable from it. 1. Go to **NAT Gateways** and click **Create NAT Gateway**. 2. Enter **Name** `E2E-AWS-NAT-GW`, set **Availability-Mode** to **Regional**, select the `E2E-AWS` VPC, and choose **Subnet** `E2E-AWS-Public-Subnet`. 3. Set **Method of Elastic IP (EIP) allocation** to **Automatic**. 4. Click **Create**. ### Set up the route tables 1. In the public route table, add a route with **Destination** `0.0.0.0/0` and **Target** `E2E-IGW`. 2. In the private route table, add a route with **Destination** `0.0.0.0/0` and **Target** `E2E-AWS-NAT-GW`. 3. Associate `E2E-AWS-Public-Subnet` with the public route table, and `E2E-AWS-Private-Subnet` with the private route table. ### Create a security group 1. Go to **Security Groups** and click **Create Security Group**. 2. Name it `E2E-VPN-SG`. 3. Add inbound rules for **SSH (22)**, **ICMP**, and any ports your application needs. ### Create a customer gateway The customer gateway is how AWS knows the E2E end of the tunnel. 1. Go to **Customer Gateways** and click **Create**. 2. Enter **Name** `E2E-AWS-CGW` and **IP Address** ``. 3. Click **Create**. ### Create a virtual private gateway 1. Go to **Virtual Private Gateways** and click **Create**. 2. Name it `E2E-VGW`. 3. Attach `E2E-VGW` to the `E2E-AWS` VPC. ### Create the site-to-site VPN connection 1. Go to **VPN Connections** and click **Create**. 2. Enter **Name** `E2E-VPN-Connection`, **Target Gateway** `E2E-VGW`, and **Customer Gateway** `E2E-AWS-CGW`. 3. Set **Routing** to **Static**, and under **Static IP Prefixes**, add ``. 4. Keep **Target gateway type** at **Virtual private gateway** and **Customer gateway** at **Existing**. In **Local IPv4 network CIDR**, enter ``, and in **Remote IPv4 network CIDR**, enter ``: the same two ranges as the FortiGate's Phase 2 selector. 5. Create the connection. ### Download the VPN configuration 1. Select the VPN connection and click **Download Configuration**. 2. Choose **Vendor** **Fortinet**, **Platform** **Fortigate 40+ Series**, **Software** the newest **FortiOS (GUI)** version listed, such as **FortiOS 6.4.4+ (GUI)**, and **IKE version** **ikev2**, to match the firewall's Phase 1 settings. Click **Download**. The file holds what the FortiGate needs: the tunnel outside IPs, including ``, the pre-shared keys, the inside IPs, and the Phase 1 and Phase 2 settings. Keep it open for the next section. ### Add routes to the E2E VPC In both the public and the private route tables, add a route with **Destination** `` and **Target** the virtual private gateway, `E2E-VGW`. ## Set up the FortiGate Do these steps on the FortiGate's screen, taking each value from the configuration file you downloaded from AWS. These values are examples; wherever your file shows a different value, use yours. ### Move the FortiGate's screen to port 444 The FortiGate's screen uses port 443, which an IPsec VPN on the same public IP also uses. Once the tunnel is up, the screen can stop opening on 443. Move the screen to port 444 before you set up Phase 1. 1. Open the FortiGate's command line: on the screen, or over SSH: ```bash ssh admin@ ``` 2. Run: ```text config system global set admin-sport 444 end ``` 3. Sign in again at `https://:444`. Use this address from now on. You can also change the port on the screen. See [Move the FortiGate's screen to port 444](/myaccount/firewall/how-to/set-up-a-site-to-site-vpn-to-google-cloud/#move-the-fortigates-screen-to-port-444). ### Set up Phase 1 1. Go to **VPN** > **VPN Tunnels**, click **Create new**, and choose **Custom IPsec tunnel**. 2. Name the tunnel `E2E-AWS`. Later steps use this name for the tunnel interface. 3. Enter these settings: | Setting | Value | | --------------- | ------------------ | | IP Version | IPv4 | | Remote Gateway | Static IP | | IP Address | `` | | Local Interface | port1 | | Pre-Shared Key | `` | | IKE Version | IKEv2 | | Encryption | AES128 | | Authentication | SHA1 | | DH Group | 2 | | Key Lifetime | 28800 | 4. Turn **NAT Traversal** off. The firewall's public IP sits on the FortiGate itself, with no address translation in between. `port1` carries the firewall's public IP, and `port2` its VPC address. ### Set up Phase 2 1. Go to **VPN** > **VPN Tunnels**, select the `E2E-AWS` tunnel, and under **Phase 2 Selectors**, click **Create New**. 2. Enter these settings: | Setting | Value | | -------------- | ------------------------------------ | | Name | The name the AWS configuration gives | | Local Address | `` | | Remote Address | `` | | Encryption | AES128 | | Authentication | SHA1 | | PFS | Enabled | | DH Group | 2 | | Key Lifetime | 3600 | | Auto-negotiate | Enabled | ### Set the tunnel interface addresses 1. Go to **Network** > **Interfaces**, and edit the tunnel interface `E2E-AWS`. 2. In **IP**, enter the FortiGate's inside IP from the AWS file, a `169.254.x.x` address. 3. In **Remote IP/Netmask**, enter the AWS inside IP from the file, a `169.254.x.x/30` address. 4. Under **Administrative Access**, turn on **PING**, so that you can ping across the tunnel. ### Add a static route to AWS 1. Go to **Network** > **Static Routes**, and click **Create New**. 2. Set **Destination** to `` and **Interface** to the VPN tunnel interface, `E2E-AWS`. This sends all traffic for the AWS VPC into the tunnel. ### Create the firewall policies You need two policies, one for each direction. Go to **Policy & Objects** > **Firewall Policy**, and click **Create New** for each. Give each policy a name; the FortiGate needs one to save it. Policy 1, E2E to AWS: | Field | Value | | ------------------ | -------------------- | | Name | `E2E-AWS` | | Incoming Interface | port2 | | Outgoing Interface | VPN tunnel `E2E-AWS` | | Source | all | | Destination | all | | Service | ALL | | Action | ACCEPT | | NAT | Disable | Policy 2, AWS to E2E, is the reverse of Policy 1: | Field | Value | | ------------------ | -------------------- | | Name | `AWS-E2E` | | Incoming Interface | VPN tunnel `E2E-AWS` | | Outgoing Interface | port2 | | Source | all | | Destination | all | | Service | ALL | | Action | ACCEPT | | NAT | Disable | Click **OK** to save each policy. ## Check that the tunnel is up Check the tunnel status on both sides: - In AWS, open the VPN connection and its **Tunnel details**. AWS lists two tunnels. These steps set up one, so Tunnel 1 reads **Up** and Tunnel 2 stays **Down**, and AWS warns that the connection is not using both tunnels. That is expected with one tunnel. - On the FortiGate, go to **VPN** > **VPN Tunnels**. The `E2E-AWS` tunnel is **Up**. If either side shows another status, check that the pre-shared key and the Phase 1 and Phase 2 settings match the AWS file exactly. ## Create a test server on each side To test private traffic over the tunnel, create: - One node in your E2E VPC. See [Create a node](/myaccount/node/how-to/create-a-node/). - One EC2 instance in the `E2E-AWS` VPC. Note each one's private IP: `` and ``. To sign in to the E2E node over SSH from the internet, it needs a public IP. Give it one in either of these ways: - When you create the node, pick the VPC and turn on **Enable this option to assign a static public IPv4 address for this node.** This option is offered on node families other than E1. - After you create it, attach a reserved IP to it, then sign in over SSH as usual. See [Attach a reserved IP to a node](/myaccount/node/how-to/attach-a-reserved-ip/). For what a reserved IP costs, see [Reserved IP](/myaccount/reserved-ip/). ## Send the node's traffic through the firewall Before the node can reach ``, it needs a route that sends traffic for AWS to the firewall. 1. Sign in to the E2E node over SSH and list its routes: ```bash ip route show ``` 2. A route to another private range through the VPC's gateway, such as one on `ens4`, can send AWS traffic the wrong way. If the node does not use that route, remove it: ```bash sudo ip route del ``` - `` is the range of the route you are removing, as `ip route show` lists it. 3. Add a route that sends traffic for the AWS VPC to the firewall: ```bash sudo ip route add via dev ``` - `` is the AWS VPC's range. - `` is the FortiGate's private IP in your E2E VPC. - `` is the node's interface connected to the FortiGate's network, such as `ens4`. All traffic for the AWS VPC now goes to the FortiGate, which sends it into the tunnel. ## Test the connection ### Ping in both directions From the E2E node, ping the AWS instance's private IP: ```bash ping ``` From the AWS instance, ping the E2E node's private IP: ```bash ping ``` Replies in both directions show that the VPN works both ways. ### Sign in over SSH from the E2E node to the AWS instance 1. On the E2E node, create a key pair, if you do not have one, and show its public key: ```bash ssh-keygen -t rsa -f ~/.ssh/e2e_aws_key cat ~/.ssh/e2e_aws_key.pub ``` 2. Sign in to the AWS instance with its PEM key, and add the public key to the end of this file: ```text ~/.ssh/authorized_keys ``` 3. On the AWS instance, set the permissions: ```bash chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys ``` 4. From the E2E node, sign in to the AWS instance over the tunnel. `ubuntu` is the user on an Ubuntu instance: ```bash ssh -i ~/.ssh/e2e_aws_key ubuntu@ ``` The sign-in succeeds over the private IP. Your E2E VPC and your AWS VPC now reach each other privately through the firewall, for ping in both directions and SSH from E2E to AWS. To add more nodes, give each one the route to the AWS VPC. To connect another VPC to the firewall, see [Attach a VPC to a firewall](/myaccount/firewall/how-to/attach-a-vpc-to-a-firewall/). For help with a tunnel that stays down, see [The site-to-site VPN tunnel does not come up](/myaccount/firewall/troubleshooting/firewall/#the-site-to-site-vpn-tunnel-does-not-come-up).