May 22, 2023 By Powell Quiring 3 min read

Site-to-site Virtual Private Network (VPN) has been used to connect distributed networks for decades. This post describes how to use a VPC VPN Gateway to connect an on-premises (enterprise) network to the IBM Cloud VPC in a transit hub-and-spoke architecture:

VPN Gateway connectivity to a VPC transit hub and spoke.

Each spoke can be operated by a different business unit or team. The team can allow enterprise access to VPC resources like Virtual Service Instances running applications or VPC RedHat OpenShift IBM Cloud clusters. Private enterprise access to VPE-enabled services, like databases, is also possible through the VPN gateway. With this method, you can enjoy the ease of use and elasticity of cloud resources and pay for just what you need by accessing the resources securely over VPN.

The Centralize communication through a VPC Transit Hub and Spoke architecture tutorial was published a few months ago. The companion GitHub repository was modified to optionally support a policy-mode VPC VPN gateway to replace the IBM Direct Link simulation.

Multi-zone region (MZR) design

The transit hub design integrates with IBM multi-zone regions (MZRs), and the VPN Gateways are zone-specific. After some careful study, the zonal architecture shown below was implemented. It shows only two zones but can be expanded to three:

VPN Gateway zonal connectivity.

Notes:

  1. A VPN Gateway is connected to each zone. Enterprise CIDR blocks are connected to a specific cloud zone VPN Gateway. Notice the enterprise CIDR block is narrow:192.168.0.0/24. The cloud CIDR block is broad, covering the entire cloud (all VPCs and all zones): 10.0.0.0/8.
  2. A VPC Address Prefix representing the enterprise zone is added to the transit VPC. See how phantom address prefix allow the spokes to route traffic to the enterprise in the tutorial.
  3. A VPC ingress route table is added to the transit VPC as described in this example. It will automatically route all ingress traffic from the spokes heading to the enterprise through the VPN gateway appliances.

Follow the steps in the companion GitHub repository in the TLDR section. When editing the config_tf/terraform.tfvars file, make sure the following variables are configured:

config_tf/terraform.tfvars:

enterprise_phantom_address_prefixes_in_transit = true
vpn = true
firewall = false

Also consider setting make_redis = true to allow provisioning Redis instances for the transit and spoke with associated Virtual Private Endpoint Gateway connections. If configured, even the private Redis instance in the spoke can be accessed from the enterprise. The details of private DNS configuration and forwarding are covered in this section of part 2 of the tutorial.

When all of the layers have been applied, run the tests (see special notes in the GitHub repository README.md on configuring Python if needed). All the tests should pass:

python install -r requirements.txt
pytest

A note on enterprise-to-transit cross-zone routing

The initial design worked well for enterprise <> spokes. The enterprise <> transit within the same zone also worked. But additional configuration is required to resolve enterprise <> transit cross-zone routing failures:

VPN Gateway cross-zone routing.

Without the additional cross-zone VPN Gateway Connections, there were no return VPC route table entries in the default route table in the transit VPC to the cross-zone enterprise (see the red line). The VPN Gateway Connections automatically add routes to the default route table in the transit VPC but only in the zones containing the VPN Gateway. In the diagram above, the worker 10.2.0.4 had no route to return to 192.168.0.4.

The extra cross-zone connections for the transit VPC zones resolved this issue, as shown by the blue line.

Conclusions

Site-to-site VPN might be just the technology you need to connect your enterprise to the IBM Cloud VPC in a multi-zone region. Using the steps described in this post, you can minimize the number of VPN Gateways required to fully connect the enterprise to the cloud. Enjoy the private connectivity to VPC resources like Virtual Server Instances and resources from the catalog that can be accessed through a Virtual Private Endpoint Gateway.

Learn more about IBM Cloud VPC
Was this article helpful?
YesNo

More from Cloud

Private cloud use cases: 6 ways private cloud brings value to enterprise business

7 min read - As cloud computing continues to transform the enterprise workplace, private cloud infrastructure is evolving in lockstep, helping organizations in industries like healthcare, government and finance customize control over their data to meet compliance, privacy, security and other business needs.  According to a report from Future Market Insights (link resides outside ibm.com), the global private cloud services market is forecast to grow to USD 405.30 billion by 2033, up from USD 92.64 billion in 2023.  What is a private cloud? A private cloud is…

Hyperscale vs. colocation: Go big or go rent?

9 min read - Here’s the situation: You’re the CIO or similarly empowered representative of an organization. Different voices within your business are calling attention to the awesome scalability and power of hyperscale computing, which you’ve also noticed with increasing interest. Now the word comes down from on high that you’ve been tasked with designing and implementing your company’s hyperscale computing solution—whatever that should be. Your organization already has an ambitious agenda in mind for whatever IT infrastructure you wind up choosing. The company…

IBM Tech Now: March 25, 2024

< 1 min read - ​Welcome IBM Tech Now, our video web series featuring the latest and greatest news and announcements in the world of technology. Make sure you subscribe to our YouTube channel to be notified every time a new IBM Tech Now video is published. IBM Tech Now: Episode 95 On this episode, we're covering the IBM X-Force Threat Intelligence Index 2024: IBM X-Force Cyber Range Combating deepfakes Stay plugged in You can check out the IBM Blog Announcements for a full rundown…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters