Transcription
AWS Client VPNAdministrator Guide
AWS Client VPN Administrator GuideAWS Client VPN: Administrator GuideCopyright Amazon Web Services, Inc. and/or its affiliates. All rights reserved.Amazon's trademarks and trade dress may not be used in connection with any product or service that is notAmazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages ordiscredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who mayor may not be affiliated with, connected to, or sponsored by Amazon.
AWS Client VPN Administrator GuideTable of ContentsWhat is AWS Client VPN? . 1Features of Client VPN . 1Components of Client VPN . 1Working with Client VPN . 2Limitations and rules of Client VPN . 3Pricing for Client VPN . 3How Client VPN works . 5Client authentication and authorization . 5Authentication . 6Authorization . 13Connection authorization . 14Requirements and considerations . 14Lambda interface . 15Using the client connect handler for posture assessment . 16Enabling the client connect handler . 16Service-linked role . 17Monitoring connection authorization failures . 17Split-tunnel Client VPN . 17Split-tunnel benefits . 18Routing considerations . 19Enabling-split-tunnel . 19Connection logging . 19Connection log entries . 19Scaling considerations . 20Scenarios and examples . 22Access to a VPC . 22Access to a peered VPC . 24Access to an on-premises network . 25Access to the internet . 27Client-to-client access . 29Restrict access to your network . 31Restrict access using security groups . 31Restrict access based on user groups . 33Getting started . 34Prerequisites . 35Step 1: Generate server and client certificates and keys . 35Step 2: Create a Client VPN endpoint . 35Step 3: Enable VPN connectivity for clients . 36Step 4: Authorize clients to access a network . 36Step 5: (Optional) Enable access to additional networks . 37Step 6: Download the Client VPN endpoint configuration file . 37Step 7: Connect to the Client VPN endpoint . 38Working with Client VPN . 39Client VPN endpoints . 39Create a Client VPN endpoint . 39Modify a Client VPN endpoint . 41Export and configure the client configuration file . 42View Client VPN endpoints . 45Delete a Client VPN endpoint . 45Target networks . 45Associate a target network with a Client VPN endpoint . 46Apply a security group to a target network . 47Disassociate a target network from a Client VPN endpoint . 47View target networks . 48iii
AWS Client VPN Administrator GuideAuthorization rules .Add an authorization rule to a Client VPN endpoint .Remove an authorization rule from a Client VPN endpoint .View authorization rules .Routes .Split-tunnel on Client VPN endpoint considerations .Create an endpoint route .View endpoint routes .Delete an endpoint route .Client certificate revocation lists .Generate a client certificate revocation list .Import a client certificate revocation list .Export a client certificate revocation list .Client connections .View client connections .Terminate a client connection .Connection logs .Enable connection logging for a new Client VPN endpoint .Enable connection logging for an existing Client VPN endpoint .View connection logs .Disable connection logging .Security .Data protection .Encryption in transit .Internetwork traffic privacy .Identity and access management for Client VPN .Using service-linked roles .Logging and monitoring .Resilience .Multiple target networks for high availability .Infrastructure security .Best practices .Monitoring Client VPN .Monitoring with CloudWatch .Viewing CloudWatch metrics .Monitoring with CloudTrail .Client VPN information in CloudTrail .Understanding Client VPN log file entries .Client VPN quotas .Client VPN quotas .Users and groups quotas .General considerations .Troubleshooting AWS Client VPN .Unable to resolve Client VPN endpoint DNS name .Traffic is not being split between subnets .Authorization rules for Active Directory groups not working as expected .Clients can't access a peered VPC, Amazon S3, or the internet .Access to a peered VPC, Amazon S3, or the internet is intermittent .Client software returns TLS error .Client software returns user name and password errors (Active Directory authentication) .Clients cannot connect (mutual auth
A Client VPN endpoint does not support subnet associations in a dedicated tenancy VPC. Client VPN supports IPv4 traffic only. Client VPN is not Federal Information Processing Standards (FIPS) compliant. If multi-factor authentication (MFA) is disabled for your Active Directory, a user password cannot be in the following format.
