This is a conceptual Demo Scenario that will help you to bring highly available and secured connectivity with dynamic routing between Cloud and On-Prem using regular Internet circuits.

Key idea of this scenario based on limitations coming from On-Prem side which as two Internet circuits (Main and Backup where Backup is the Radio Bridge)

The materials from this repository will help you quickly build from the scratch the following network topology:

Target Topology

To prepare your admin workstation (desktop, laptop or maybe something else) follow these steps:

Prepare your VK Cloud project (enable CLI and API access): URL
Create and upload your SSH key into the cloud admin account: URL
Install Terraform components depending on your OS: URL
Install Ansible components depending on your OS: URL
Install GIT components and copy this repo onto your admin workstation

Additional Steps:

Use you private SSH key within Terraform and Ansible
Use proper account credentials within Terraform

Under the Hood

Main part of thies scenario related to the routers (a pair of IaaS Virtual Machines (IaaS Routers) converted into traditional routers with advanced functionoality)

Terraform

Provisions a pair of IaaS Routers with internal and external ports. Includes supplimentary Shell script (which is a part of Terraform manifest) to maintain configuration across reboots.

Ansible

Configure IaaS Routers using role-based playbooks controlled via the Inventory File

Additional Software Used:

strongSwan (to manage IPsec)
FRR (to manage BGP)
Keepalived (VRRP)

Private and Public Ports

Each IaaS Router will use two secured connections to On-Prem environment through the Internet:

IPsec Site-to-Site in Transport Mode (to protect GRE Tunnels)
GRE Tunnel (to transfer a data)

Secured Connections

GRE Tunnels topology clearly ecxplained in the following diagram:

GRE Tunnels

High Availability Design

BGP peering eliminates single points of failure on the Cloud side through:

Bidirectional eBGP sessions from each IaaS Router to On-Premises
Optimized route metrics reflecting circuit priority (Primary/Backup)
Automatic failover during circuit failures (including Cloud Availability Zone failures)
Asymmetric routing prevention via MED and Local Preference configuration

BGP Peering

Усовершенствованная поставка, в которой количество маршрутизаторов (создаются через Terraform) и приватных интерфейсов в их составе управляется через переменные окружения. Это позволяет горизонтально масштабировать поставку (по количеству маршрутизаторов и количеству подключенных к ним приватных подсетей).

Readme

1.7 MiB

0 Stars 1 Watchers 0 Forks