CloudRouterAdvanced/README.md

Quick Start

This is a conceptual Demo Scenario that will help you to bring highly available and secured connectivity with dynamic routing between Cloud and On-Prem using regular Internet circuits.

Key idea of this scenario based on limitations coming from On-Prem side which has two Internet circuits (Main and Backup where Backup is the Radio Bridge)

The materials from this repository will help you quickly build from the scratch the following network topology:

To prepare your admin workstation (desktop, laptop or maybe something else) follow these steps:

1. Prepare your VK Cloud project (enable CLI and API access): URL
2. Create and upload your SSH key into the cloud admin account: URL
3. Install Terraform components depending on your OS: URL
4. Install Ansible components depending on your OS: URL
5. Install GIT components and copy this repo onto your admin workstation

Additional Steps:

• Use you private SSH key within Terraform and Ansible
• Use proper account credentials within Terraform

Under the Hood

Main part of this scenario related to the routers (a pair of IaaS Virtual Machines (IaaS Routers) converted into traditional routers with advanced functionality)

Terraform

Provisions a pair of IaaS Routers with internal and external ports. Includes supplimentary Shell script (which is a part of Terraform manifest) to maintain configuration across reboots.

Ansible

Configure IaaS Routers using role-based playbooks controlled via the Inventory File

Additional Software Used:

• strongSwan (to manage IPsec)
• FRR (to manage BGP)
• Keepalived (VRRP)

Each IaaS Router will use two secured connections to On-Prem environment through the Internet:

• IPsec Site-to-Site in Transport Mode (to protect GRE Tunnels)
• GRE Tunnel (to transfer a data)

GRE Tunnels topology clearly explained in the following diagram:

High Availability Design

BGP peering eliminates single points of failure on the Cloud side through:

• Bidirectional eBGP sessions from each IaaS Router to On-Premises
• Optimized route metrics reflecting circuit priority (Primary/Backup)
• Automatic failover during circuit failures (including Cloud Availability Zone failures)
• Asymmetric routing prevention via MED and Local Preference configuration