This guide covers the information you need to deploy the Remote Access Virtual Private Network Partner Solution in the AWS Cloud.

This Partner Solution reference deployment guide provides step-by-step instructions for deploying a scalable Cisco Remote Access Virtual Private Network (RA-VPN) on the AWS Cloud. This Partner Solution is for users who want to deploy or learn about Cisco AnyConnect RA-VPN services on Cisco Adaptive Security Virtual Appliance (ASAv) firewalls using the AWS Cloud architecture.

There is no cost to use this Partner Solution, but you will be billed for any AWS services or resources that this Partner Solution deploys. For more information, refer to the AWS Partner Solution General Information Guide.

This Quick Start requires an RA-VPN license from Cisco. The Cisco ASAv virtual firewall provides the following licensing options:

To use this Quick Start in a production environment, see Cisco Adaptive Security Virtual Appliance (ASAv) — Standard Package. Ensure that you subscribe to the image using the correct Region. If you want to use option 2, you must use the correct Amazon Machine Image (AMI). For more information, see how to Deploy the ASAv on the AWS Cloud.

Note: If you don’t have your own license, the ASAv uses a trial license with reduced capacity. It provides 90 days of free usage and up to two AnyConnect VPN sessions within a nonproduction environment where firewall throughput is limited to 100 Kbps. To upgrade to a production license, see the Cisco documentation.

This Quick Start requires a subscription to the Amazon Machine Image (AMI) for Cisco RA‑VPN, which is available from AWS Marketplace. Additional pricing, terms, and conditions may apply. For more information, see the Deployment steps.

This section provides details about some of the resources that are critical for understanding this deployment’s configuration and post-deployment steps. It also describes where, within the subnets, the ASAvs are deployed and how the interfaces function.

The ASAv’s OUTSIDE interfaces are in the public subnet, and there is an Elastic IP address associated with each ASAv’s OUTSIDE interface. When using RA-VPN, you receive the Elastic IP addresses after the Domain Name System (DNS) responds, which depends on the Amazon Route 53–weighted load balancing policy. On the ASAvs, there is a zero-day configuration deployed with AnyConnect, and different VPN pools are configured per ASAv.

In the private subnets, there are INSIDE interfaces for the ASAvs. These subnets are used for routing traffic toward on-premises networks through the transit gateway. Every ASAv has a default route that points toward its default gateway, denoted by the x.x.x.1 subnet address. In addition, each private subnet has a default route that points to on-premises networks via AWS Transit Gateway.

In the management subnet, there are ASAv interfaces. If you prefer to use a Jumpbox to help secure the ASAv management interface, deploy it in this subnet. ASAvs are managed through the OUTSIDE interface’s Elastic IP address. Optionally, this management subnet can provide outbound internet access through network address translation (NAT) gateways.

For peering purposes, an AWS Transit Gateway subnet and a route table are deployed into the VPC (not to be confused with the routing tables for AWS Transit Gateway). These subnets are used to peer into AWS Transit Gateway, and their associated route tables direct VPN pools toward the elastic network interfaces of the ASAvs.

AWS Transit Gateway extends your connectivity to on-premises resources via dedicated connections, such as AWS Site-to-Site VPN or AWS Direct Connect. It also enables communication between VPCs, which open new-use cases, such as a centralized security VPC or dedicated VPC functions, for both inbound and outbound connections.

The VPC attachment uses a transit gateway to peer into the VPC and propagate the VPC’s Classless Inter-Domain Routing (CIDR) range into the AWS Transit Gateway’s routing tables. It is also used as a target for the routing tables.

The VPN attachment establishes an AWS Site-to-Site VPN tunnel between your on-premises location and the AWS Cloud. This might be your preferred option if you don’t use Direct Connect.

Note: If you use AWS Direct Connect, you can manually set up peering within the transit gateway. This Quick Start guide, however, does not cover how to prevent interruptions with production services when used with a Direct Connect gateway.

The route table for AWS Transit Gateway is used to automatically propagate the VPC CIDR range through the VPC attachment. This includes static route entries, one of which points to your on-premises subnets through the VPN or Direct Connect attachment. A separate static route points to VPN pools through the VPC attachment.

Following best practices, a spoke-VPC route table is used for host-VPC connectivity. This route table does not have any route definitions. You can add a route that points to the host VPCs in your environment.

Deploying this Partner Solution with default parameters builds the following Remote Access Virtual Private Network environment in the AWS Cloud.

As shown in Figure 1, this Partner Solution sets up the following:

This Partner Solution provides the following deployment option:

To view the created resources, use the URLs displayed in the Outputs tab for the stack.

For troubleshooting common Partner Solution issues, refer to the AWS Partner Solution General Information Guide and Troubleshooting CloudFormation.

After you deploy a Partner Solution, confirm that your resources and services are updated and configured—including any required patches—to meet your security and other needs. For more information, refer to the Shared Responsibility Model.

To submit feature ideas and report bugs, use the Issues section of the GitHub repository for this Partner Solution. To submit code, refer to the Partner Solution Contributor’s Guide. To submit feedback on this deployment guide, use the following GitHub links:

This document is provided for informational purposes only. It represents current AWS product offerings and practices as of the date of issue of this document, which are subject to change without notice. Customers are responsible for making their own independent assessment of the information in this document and any use of AWS products or services, each of which is provided "as is" without warranty of any kind, whether expressed or implied. This document does not create any warranties, representations, contractual commitments, conditions, or assurances from AWS, its affiliates, suppliers, or licensors. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers.

The software included with this paper is licensed under the Apache License, version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at https://aws.amazon.com/apache2.0/ or in the accompanying "license" file. This code is distributed on an "as is" basis, without warranties or conditions of any kind, either expressed or implied. Refer to the License for specific language governing permissions and limitations.