71 lines
3.1 KiB
Markdown
71 lines
3.1 KiB
Markdown
# Quick Start
|
|
|
|
This is a conceptual Demo Scenario that will help you to bring highly available and secured connectivity with dynamic routing between Cloud and On-Prem using regular Internet circuits.
|
|
|
|
>Key idea of this scenario based on limitations coming from On-Prem side which has two Internet circuits (Main and Backup where Backup is the `Radio Bridge`)
|
|
|
|
The materials from this repository will help you quickly build from the scratch the following network topology:
|
|
|
|
|
|
|
|
To prepare your admin workstation (desktop, laptop or maybe something else) follow these steps:
|
|
|
|
1. Prepare your VK Cloud project (enable CLI and API access): [URL](https://cloud.vk.com/docs/en/tools-for-using-services/api/rest-api/enable-api)
|
|
2. Create and upload your SSH key into the cloud admin account: [URL](https://cloud.vk.com/docs/tools-for-using-services/vk-cloud-account/instructions/account-manage/keypairs#importing_existing_key)
|
|
3. Install Terraform components depending on your OS: [URL](https://cloud.vk.com/docs/en/tools-for-using-services/terraform/quick-start)
|
|
4. Install Ansible components depending on your OS: [URL](https://docs.ansible.com/projects/ansible/latest/installation_guide/intro_installation.html#pipx-install)
|
|
5. Install GIT components and copy this repo onto your admin workstation
|
|
|
|
Additional Steps:
|
|
|
|
- Use you private SSH key within Terraform and Ansible
|
|
- Use proper account credentials within Terraform
|
|
|
|
# Under the Hood
|
|
|
|
>Main part of this scenario related to the routers (a pair of IaaS Virtual Machines (`IaaS Routers`) converted into traditional routers with advanced functionality)
|
|
|
|
**IPv4 addressing plan for the project**
|
|
|
|
Here is a card to assist with configuration planning. The card is filled out using the IP addressing from the Demo Scenario and the `inventory.ini` file, which will be used when running the Ansible playbook.
|
|
|
|
|
|
|
|
**Terraform**
|
|
|
|
Provisions a pair of `IaaS Routers` with internal and external ports. Includes supplimentary Shell script (which is a part of Terraform manifest) to maintain configuration across reboots.
|
|
|
|
**Ansible**
|
|
|
|
Configure `IaaS Routers` using role-based playbooks controlled via the [Inventory File](ansible/inventory.ini)
|
|
|
|
**Additional Software Used:**
|
|
|
|
- strongSwan (to manage IPsec)
|
|
- FRR (to manage BGP)
|
|
- Keepalived (VRRP)
|
|
|
|
|
|
|
|
Each IaaS Router will use two secured connections to On-Prem environment through the Internet:
|
|
|
|
- IPsec Site-to-Site in Transport Mode (to protect GRE Tunnels)
|
|
- GRE Tunnel (to transfer a data)
|
|
|
|
|
|
|
|
GRE Tunnels topology clearly explained in the following diagram:
|
|
|
|
|
|
|
|
**High Availability Design**
|
|
|
|
BGP peering eliminates single points of failure on the Cloud side through:
|
|
|
|
- Bidirectional eBGP sessions from each `IaaS Router` to On-Premises
|
|
- Optimized route metrics reflecting circuit priority (Primary/Backup)
|
|
- Automatic failover during circuit failures (including Cloud Availability Zone failures)
|
|
- Asymmetric routing prevention via MED and Local Preference configuration
|
|
|
|
|