AWS Certified CloudOps Engineer - Associate
Site-to-Site VPN and Client VPN
Two hybrid problems, 2 services: connecting a data center to AWS over IPsec, and connecting individual people to a VPC over TLS. This lesson covers tunnels, static against BGP routing, where Direct Connect changes the answer, and the Client VPN rule that drops traffic even when the route exists.
Intermediate 32 minutes 7 Learning Objectives
- Identify the components of a Site-to-Site VPN connection and explain why every connection has 2 tunnels
- Choose between static and BGP routing for a VPN, and predict which route wins when both advertise the same prefix
- Compare terminating a VPN on a virtual private gateway against terminating it on a transit gateway
- Monitor VPN health with the TunnelState metric and diagnose the common causes of a tunnel that will not come up
- Contrast Site-to-Site VPN with Direct Connect, and explain when a scenario calls for both together
- Configure a Client VPN endpoint, including client CIDR rules, authentication, split-tunnel, and authorization rules
- Diagnose the Client VPN failure where a route exists but traffic is still dropped