How to map RFC 1918 IP addresses to public IP spaces using Aviatrix?

Some enterprises have built their datacenter environments on Public IPs that they own. But, when they started adopting public clouds like AWS, their cloud VPCs were built on RFC 1918 spaces. When these VPCs need to connect to the organization’s on premise datacenters, those internal networks need to start supporting RFC 1918 IPs. This change is not always possible due to security concerns or due to long-running process inertia.

Aviatrix Systems has helped customers address this problem in multiple environments. Aviatrix gateways have the ability to translate RFC 1918 IPs to Public IP spaces through a 2-way NAT-ing feature.

Let’s use this example: Company XYZ owns this public IP range: 199.0.0.0/8. All their datacenter networks route only this IP space. Let’s say, one of the company’s applications deployed in AWS needs to connect to the on prem datacenter for database access. But, this application’s VPC has a CIDR of 172.16.0.0/16 (RFC-1918). XYZ Company’s datacenter network (or WAN) cannot route this traffic.

To solve this issue, let’s use an Aviatrix Gateway to connect this VPC to an on-premise IPsec device. Here are the steps:

1. 1. Install the Aviatrix controller from the AWS marketplace and provide the controller credentials for this AWS account. (http://docs.aviatrix.com/StartUpGuides/aviatrix-cloud-controller-startup-guide.html)
   2. Log into the controller and navigate to the Gateways tab.
   3. Create a gateway in the VPC that needs to be connected. In this example, the VPC is called AppVPC.

1. 1. Once the Gateway is created, you should see it listed in the Gateways list.
   2. Now let’s start setting up an IPsec tunnel that will connect to the datacenter. Navigate to the Site2Cloud page.
   3. Click on “+ Add new”
   4. Fill out the form that gets presented:
      1. VPC ID: Pick the VPC you want to connect (AppVPC)
      2. Connection Type: Mapped (this lets the gateway know to perform 2-way NATing)
      3. Connection Name: Any name to represent the IPSec Connection (App-DC-Pub)
      4. Remote Gateway Type: Select Generic since we want to connect to a Generic IPSec device on-premise.
      5. Primary Cloud Gateway: Make sure the gateway you created above is selected (OR-IPSEC)
      6. Remote Gateway IP Address: Enter the IP address (as seen from the internet) of the IPsec device you want to connect to on-premise.
      7. Remote Subnet: Enter the Datacenter’s IP Address (199.200.100.0/24)
      8. Remote Subnet (Virtual): Enter the IP space that the Datacenter’s IPs needs to map to. (in this case it is the same IP space)
      9. Local Subnet: Enter the VPC’s IP Range (172.168.0.0/16)
      10. Local Subnet (Virtual): Enter the IP space that the VPC IPs need to map to. (let’s map the VPC IPs to the Company’s IP space: 199.250.0.0/16)
      11. Leave all other options to their default values.
      12. Click OK.

1. 1. You will see the Connection listed. The status will say “Down” because the IPSec device has not been configured yet.

1. 1. Select the connection row -> select “Generic” on the Vendor option -> Click on Download Configuration.

1. 1. Use this configuration file to set up the IPsec connection in the device on-premise.
   2. Soon, when you refresh the status the Aviatrix controller page, you should see the connection status change to “up”.

1. Now you will be able to access instances in the VPC using corresponding public IP addresses. For example, if the VPC instance’s private IP address is 172.16.1.106, you will able to address the instance as 199.250.1.106 from the datacenter.

For more information on Aviatrix capabilities, please go to: http://docs.aviatrix.com/StartUpGuides/aviatrix_overview.html