VPN solution help

[FastNOC]

Hi everyone, I hope this is the right forum.

Here's my scenario.

I have a need for a static IP to certain sites. I had a static IP but my provider changed plans and now I'm DHCP.

I own an RVS4000 router and I have cloud instances at EC2 I can use, or spin up a new instance.

what I need to do is use the rvs4000 as a CLIENT and connect it to a remote VPN that exists on the cloud. then using my firewall I can route specific sites to use the VPN.

I need to know the best and easiest way to accomplish this. I need this to be done at the router level, not the workstation, and I believe the RVS4000 can connect to a remote VPN as well as run it's own VPN for incoming.

Anyone got suggestions? i thought this would be very simplle but that's turning out not to be the case. I'm assuming the best approach is L2TP but what's the best implementation?

 

[dougsk]

You don't need static addresses for site to site IPsec VPN, you just need public addresses, although it's really useful for quicker tunnel teardown and buildup if one side is static.

I had initially thought that you could just build a virtual machine inside the ec2 virtual environment, but it looks like, if you buy the right type of EC2 cloud called a virtual private cloud, VPC, they've got you covered on their end of the vpn tunnel.

Establish IKE Security Association using Pre-Shared Keys
Establish IPsec Security Associations in Tunnel mode
Utilize the AES 128-bit encryption function
Utilize the SHA-1 hashing function
Utilize Diffie-Hellman Perfect Forward Secrecy in "Group 2" mode
Establish Border Gateway Protocol (BGP) peerings // you really don't need this, I can't imagine. Only if you wanted multiple subnets, but pays to double check.
Bind tunnels to logical interfaces (route-based VPN) ///ditto
Utilize IPsec Dead Peer Detection
Perform packet fragmentation prior to encryption //adjust mtu of inside interface down to something like 1472 depending on your ISP connection maybe 1464 if pppoe or even 1364 ping -f -l will help

http://aws.amazon.com/vpc/faqs/#C8

Not familiar with that model RVS4000, but here's on older firmware ui.

http://ui.linksys.com/files/RVS4000/1.0.13/vpn_main.htm
Unfortunately this firmware only supports 3des for the encryption cipher, so you'll want to see if a newer firmware supports AES for the block cipher. And if it doesn't you'll want to get a new router that does.

You'll want to use "aggressive mode" under the advanced setting, since your side is dynamic. Main Mode usually only works both sides are static.