YAMAHAルーター経由でOracle CloudとAWSをIPSec VPNで接続してみてみた



#■目的
YAMAHAルーターとOCI接続を数多くやってきましたが、YAMAHAルーター経由したOCIとAWSのIPSec複数拠点接続設定の問い合わせもよくくる、、
ということで、今回はGIUかんたん接続でYAMAHAルーターとAWS接続をやってみてみます。

#■構成図
<img width="936" alt="構成図.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/dceab5e4-1fc2-dea1-2cf3-daa224d48b59.png">

YAMAHAルーターは、グローバルIPアドレスのイオンモバイルのSIMを入れたNVR700wを使用します。
AWS側は、事前にVPC,EC2インスタンスを作成しておきます。今回は、仮想プライベートゲートウェイの作成から行います。
OCI側は、事前に以前の記事を参考に接続設定をします
・参考: [Oracle Cloud:YAMAHA NVR700wでOCIへIPsec VPN接続してみてみた](https://qiita.com/shirok/items/6ed54f495521ffe87a18)


#■AWSとYAMAHAルータ IPSec接続設定


##●仮想プライベートゲートウェイの作成

###① 仮想プライベートゲートウェイ画面
VPCダッシュボードから、「仮想プライベートゲートウェイ」を選択し、[仮想プライベートゲートウェイの作成]をクリック
![01.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/11004d5b-931a-54d4-a513-87413f2264a6.png)


###② 仮想プライベートゲートウェイの作成画面1
以下項目を設定し[仮想プライベートゲートウェイの作成]をクリック

	・名前タグ：任意の名前を設定
	・ASN: AmazonのデフォルトASNを選択

![02.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/b1027511-2ce0-67ad-27ad-a9c6e500da27.png)


###③仮想プライベートゲートウェイの作成画面2
「作成画仮想プライベートゲートウェイの作成しました。」
が表示されたら、[閉じる]をクリック
![03.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/60251bb7-64ff-dcc6-e0d7-327c74ce8c70.png)


##●VPN接続の作成
###① サイト間のVPN接続画面
VPCダッシュボードから、「サイト間のVPN接続」を選択し、[VPN接続の作成]をクリック
![10.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/361fa43b-4c08-a1e4-28c9-8e7801ae89d6.png)

###②VPN接続の作成画面1
以下項目を設定し[VPN接続の作成]をクリック

    ・名前タグ: 任意の名前を設定
    ・Target Gatway type: ここではVirtual Private Gatwayを選択
    ・仮想プライベートゲートウェイ: 作成した仮想プライベートゲートウェイを選択
    ・カスタマーゲートウェイ: 新規を選択
    ・BGP ASN: 任意のPriavate ASNを設定
    ・ルーティングオプション: ここでは動的BGPを選択

![11.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/9ff283f4-f2a3-8a28-cfae-c8dd4f197bce.png)

###③VPN接続の作成画面2
「VPN接続の作成リクエストが成功しました」が表示されたことを確認し[閉じる]をクリック
<img width="872" alt="12.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/a77f0834-beef-a287-ad97-3c09511a1b60.png">


###④ サイト間のVPN接続画面
作成したBPN接続が表示され、状態が「保留中」であることを確認
<img width="1023" alt="13.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/d7b59a8b-5e37-a972-5af8-b8cc193625e0.png">

#■Amazon VPCとVPN(IPsec)接続Web GUI設定

##●AWS アクセスキー発行
YAMAHAルーターとAWSをGUIでIPSec接続できるように
接続設定用AWSユーザーを作成し、AWS IAMアクセスキー ID とシークレットアクセスキーを作成します


###①AWS Webコンソールから、「IAM」> [ユーザー]画面から[ユーザーを追加]をクリック
<img width="1226" alt="01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/88b83c66-3917-9eba-9d33-c7bee814dc2b.png">


###②ユーザー設定画面
以下項目を入力し[次のステップ:アクセス制限]をクリック

	・ユーザー名: 任意の名前を入力
	・プログラムによるアクセス: チェックする

<img width="954" alt="02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/a7aedbcc-641f-5b2f-57ec-0a9a688c1145.png">


###③ユーザーを追加画面
[ユーザーをクループに追加]を選択し、[グループの作成]をクリック

<img width="958" alt="03.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/21d7a37c-1669-a9b0-e683-8cb079036eb1.png">


###④グループの作成画面
以下設定をし、[グループの作成]をクリック

	・グループ名: 任意の名前を入力
	・ポリシー名: [AmazonVPCReadOnlyAccess]を選択

<img width="956" alt="04_1.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/729eca1a-13fe-d03a-5cae-b5cbca17da51.png">


###⑤ユーザーを追加画面
作成した「グループ」と「アタッチされたポリシー」を確認して、[次のステップ:確認]をクリック
<img width="957" alt="05.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/f6d63934-5412-6651-96da-464c5e69b159.png">


###⑥ユーザーを追加画面(タグの追加)
タグの追加は必要に応じて設定し、[次のステップ:確認]をクリック
<img width="958" alt="06.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/fd469f35-ee91-ffc8-e2a4-1e625a334d7d.png">



###⑦ ユーザーを追加画面(確認)
表示された内容を確認し、[ユーザーの作成]をクリックします。
<img width="958" alt="07.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/dd45381d-0d3a-4aa0-d489-8e16195f2765.png">



###⑧ユーザーを追加画面(成功)
[.csv のダウンロード]をクリックしてダウンロード
accessKeys.csvファイルがダウンロードされます
<img width="959" alt="08.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/61d4ddca-2035-5ff7-9d6a-01a364d3953c.png">



###⑨accessKeys.csvファイル確認
accessKeys.csvファイルにAccess key ID,Secret access keyが記載されていることを確認
この情報を使用してYAMAHAルーターのGUI画面でかんたん接続します。

```shell
[root@mac ~]# cat accessKeys.csv
	Access key ID,Secret access key
	AKIAQE,g4c6PWoL0cJWrAvck4foz
```


##■YAHAMAルーターGUI設定
ここからは、YAMAHAルーターのWebUIへ接続しGUIでAWSへ接続します。

###① かんたん設定画面
YAMAH Webコンソールに接続し、[かんたん設定]タブから、[VPN] > [クラウド接続]を選択し、「新規作成」の[新規]をクリック
<img width="1197" alt="01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/66cfeb93-db4c-d905-0dbd-6ee38f270981.png">



###②サービス種別の選択画面
[次へ］をクリック
<img width="1200" alt="02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/6b8dd90f-da7f-0f79-c33a-8a22a7b6b0eb.png">


###③接続設定画面
以下設定を行い[次へ]をクリック


	・設定名: 任意の名前を設定
	・アクセスキーID: ダウンロードしたcsvの「Access key ID」を設定
	・シークレットアクセスキー: ダウンロードしたcsvの「Secret access key」を設定
	・VPN ID: 作成したVPN接続のIDを設定
	・リージョン: VPCのリージョンを設定
	・AWSからの設定取得: [取得する]を選択

<img width="1091" alt="03.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/fe453262-25af-14be-9240-719e63c1f521.png">



###④入力内容を確認画面
入力内容を確認し[次へ]をクリック
<img width="1092" alt="04.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/773aa89d-5684-593f-9e64-c5e3f4a9d419.png">


###⑤内容の確認と取得画面1
進捗状況がすべてチェックされグリーンになり問題ないことを確認し、[OK]をクリック
<img width="943" alt="05.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/45ea4167-b4b9-b709-121f-2f412c1b50af.png">


###⑥内容の確認と取得画面2
AWSと接続できたことを確認し設定完了
<img width="600" alt="06.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/230c4505-75db-2994-895e-ed3385ae4a04.png">


##●NVR700wコンフィグ確認
かんたん設定で設定されたルーターのconfigを確認します


```shell
# show config
	# NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
	# MAC Address : 00:a0:de:b2:31, 00:a0:de:b2:32
	# Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
	# main:  NVR700W ver=00 serial=M401111 MAC-Address=00:a0:de:b2:31 MAC-Address=00:a0:de:b2:32
	# Reporting Date: Dec 16 00:00:34 2019
	administrator password encrypted *
	http login-timer=600 multi-session=on
	console character en.ascii
	ip route default gateway pdp wan1
	ip lan1 address 192.168.100.1/24
	ip wan1 address pdp
	ip wan1 nat descriptor 31000
	wan1 bind wwan 1
	wwan select 1
	description wwan aeonmobile
	wwan always-on on
	wwan auth accept chap
	wwan auth myname user@n-aeonmobile.com 0000
	wwan auto connect on
	wwan disconnect time off
	wwan disconnect input time off
	wwan disconnect output time off
	wwan access-point name 4gn.jp
	wwan access limit length off
	wwan access limit time off
	wwan enable 1
	tunnel select 1
	description tunnel AWS-IPSec_amazon-api_20191216000256
	ipsec tunnel 1
	ipsec sa policy 1 1 esp aes-cbc sha-hmac
	ipsec ike duration ipsec-sa 1 3600
	ipsec ike encryption 1 aes-cbc
	ipsec ike group 1 modp1024
	ipsec ike hash 1 sha
	ipsec ike keepalive use 1 on dpd 10 3
	ipsec ike local address 1 192.168.100.1
	ipsec ike nat-traversal 1 on type=2
	ipsec ike pfs 1 on
	ipsec ike pre-shared-key 1 text IPSecKey01
	ipsec ike remote address 1 110.110.110.111
	ipsec tunnel outer df-bit clear
	ip tunnel address 169.254.128.14/30
	ip tunnel remote address 169.254.128.13
	ip tunnel tcp mss limit 1379
	tunnel enable 1
	tunnel select 2
	description tunnel AWS-IPSec_amazon-api_20191216000256
	ipsec tunnel 2
	ipsec sa policy 2 2 esp aes-cbc sha-hmac
	ipsec ike duration ipsec-sa 2 3600
	ipsec ike encryption 2 aes-cbc
	ipsec ike group 2 modp1024
	ipsec ike hash 2 sha
	ipsec ike keepalive use 2 on dpd 10 3
	ipsec ike local address 2 192.168.100.1
	ipsec ike nat-traversal 2 on type=2
	ipsec ike pfs 2 on
	ipsec ike pre-shared-key 2 text IPSecKey02
	ipsec ike remote address 1 110.110.110.112
	ipsec tunnel outer df-bit clear
	ip tunnel address 169.254.246.154/30
	ip tunnel remote address 169.254.246.153
	ip tunnel tcp mss limit 1379
	tunnel enable 2
	nat descriptor type 31000 masquerade
	nat descriptor address outer 31000 primary
	nat descriptor masquerade static 31000 1 192.168.100.1 udp 500
	nat descriptor masquerade static 31000 2 192.168.100.1 esp
	nat descriptor masquerade static 31000 3 192.168.100.1 udp 4500
	bgp use on
	bgp autonomous-system 65000
	bgp neighbor 1 64512 169.254.128.13 hold-time=30 local-address=169.254.128.14
	bgp neighbor 2 64512 169.254.246.153 hold-time=30 local-address=169.254.246.154
	bgp router id 169.254.128.14
	bgp import filter 1 equal 0.0.0.0/0
	bgp import 64512 static filter 1
	ipsec auto refresh on
	telnetd service off
	dhcp service server
	dhcp server rfc2131 compliant except remain-silent
	dhcp scope 1 192.168.100.2-192.168.100.191/24
	dns host lan1
	dns server pdp wan1
	dns server select 500401 pdp wan1 any .
	dns private address spoof on
	dns private name setup.netvolante.jp
	analog supplementary-service pseudo call-waiting
	analog extension dial prefix sip prefix="9#"
	cloud vpn service 1 amazon-api
	cloud vpn parameter 1 AKIAQE2ZRNJBCRXNSTEH g4c6PWoL0cJWrA
	2SSG vpn-0753df86d096937e6
	cloud vpn option 1 region=ap-northeast-1
	cloud vpn name 1 AWS-IPSec
	cloud vpn bind 1 tunnel1 tunnel2
	sshd service on
	sshd host key generate *
	statistics traffic on
	wwan-module use on
```

##●設定確認

###・IPsec SA確認
IPsec SAが確立されていることを確認

```shell
# show ipsec sa
	Total: isakmp:2 send:2 recv:2

	sa    sgw isakmp connection    dir  life[s] remote-id
	----------------------------------------------------------------------------
	1     1    -     isakmp        -    28340   52.197.18.189
	2     2    -     isakmp        -    28340   54.95.75.6
	3     2    2     tun[0002]esp  send 3142    54.95.75.6
	4     2    2     tun[0002]esp  recv 3142    54.95.75.6
	5     1    1     tun[0001]esp  send 3142    52.197.18.189
	6     1    1     tun[0001]esp  recv 3142    52.197.18.189
```

###・bgp neighbor確認
AWSとBGPが確立されていることを確認

```shell
# show status bgp neighbor
	BGP neighbor is 169.254.128.13, remote AS 64512, local AS 65000, external link
	BGP version 4, remote router ID 169.254.128.13
	BGP state = Established, up for 00:09:29
	Last read 00:00:09, hold time is 30, keepalive interval is 10 seconds
	Received 59 messages, 0 notifications, 0 in queue
	Sent 61 messages, 0 notifications, 0 in queue
	Connection established 1; dropped 0
	Last reset never
	Local host: 169.254.128.14, Local port: 179
	Foreign host: 169.254.128.13, Foreign port: 44037

	BGP neighbor is 169.254.246.153, remote AS 64512, local AS 65000, external link
	BGP version 4, remote router ID 169.254.246.153
	BGP state = Established, up for 00:09:33
	Last read 00:00:03, hold time is 30, keepalive interval is 10 seconds
	Received 61 messages, 0 notifications, 0 in queue
	Sent 62 messages, 0 notifications, 0 in queue
	Connection established 1; dropped 0
	Last reset never
	Local host: 169.254.246.154, Local port: 179
	Foreign host: 169.254.246.153, Foreign port: 41953
```

###・IP Route確認
IPSec Tunnel IPのRouteとAWSのCIDR情報が伝搬されていることを確認

```shell
# show ip route
	Destination         Gateway          Interface       Kind  Additional Info.
	default             200.200.200.251   WAN1(PDP)    static
	200.200.200.201/32   200.200.200.251        WAN1 temporary
	169.254.128.12/30   -                 TUNNEL[1]  implicit
	169.254.246.152/30  -                 TUNNEL[2]  implicit
	172.24.0.0/16       169.254.128.13    TUNNEL[1]       BGP  path=64512
	192.168.100.0/24    192.168.100.1          LAN1  implicit
	210.0.0.0/8         200.200.200.201        WAN1  implicit
```




##● AWSサイト間のVPN接続画面
AWSのサイト間のVPN接続画面のVPN接続の状態が「使用可能」となり、
Tunnel Detailの各Tunnelのステータスが「アップ」であることを確認
<img width="1225" alt="01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/e2b7d274-afd2-f8bc-ea33-a092f7208ad4.png">


#■OCIとYAMAHAルータ IPSec接続設定

OCIとYAMAHAルータのIPSec接続は以前の記事を参考に設定します。
[Oracle Cloud:YAMAHA NVR700wでOCIへIPsec VPN接続してみてみた](https://qiita.com/shirok/items/6ed54f495521ffe87a18)
ここでは、YAMAHAルータの設定を記載します

##●IPSec接続設定
OCIに接続するtunnelナンバーを11と12で設定

```shell
tunnel select 11
    description tunnel OCI-VPN1
    ipsec tunnel 11
    ipsec sa policy 11 11 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 11 3600
    ipsec ike duration isakmp-sa 11 28800
    ipsec ike encryption 11 aes256-cbc
    ipsec ike group 11 modp1536
    ipsec ike hash 11 sha256
    ipsec ike keepalive log 11 off
    ipsec ike keepalive use 11 on dpd 5 4
    ipsec ike local address 11 200.200.200.201
    ipsec ike local id 11 0.0.0.0/0
    ipsec ike nat-traversal 11 on
    ipsec ike pfs 11 on
    ipsec ike pre-shared-key 11 text IPSecKey11
    ipsec ike remote address 11 100.100.100.101
    ipsec ike remote id 11 0.0.0.0/0
    ip tunnel tcp mss limit auto
    tunnel enable 11

tunnel select 12
    description tunnel OCI-VPN2
    ipsec tunnel 12
    ipsec sa policy 12 12 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 12 3600
    ipsec ike duration isakmp-sa 12 28800
    ipsec ike encryption 12 aes256-cbc
    ipsec ike group 12 modp1536
    ipsec ike hash 12 sha256
    ipsec ike keepalive log 12 off
    ipsec ike keepalive use 12 on dpd 5 4
    ipsec ike local address 12 200.200.200.201
    ipsec ike local id 12 0.0.0.0/0
    ipsec ike nat-traversal 12 on
    ipsec ike pfs 12 on
    ipsec ike pre-shared-key 12 text IPSecKey12
    ipsec ike remote address 12 100.100.100.102
    ipsec ike remote id 12 0.0.0.0/0
    ip tunnel tcp mss limit auto
    tunnel enable 12
```

##●IPSec設定反映

```shell
# ipsec auto refresh on
```



##●BGP接続設定

```shell
tunnel select 11
 ip tunnel address 192.168.0.101/30
 ip tunnel remote address 192.168.0.102

tunnel select 12
 ip tunnel address 192.168.0.105/30
 ip tunnel remote address 192.168.0.106

bgp use on
 bgp autonomous-system 65000
 bgp log neighbor
 bgp neighbor 11 31898 192.168.0.102 hold-time=180 local-address=192.168.0.101
 bgp neighbor 12 31898 192.168.0.106 hold-time=180 local-address=192.168.0.105
 bgp import filter 1 equal 0.0.0.0/0
 bgp import 31898 static filter 1
```

##●BGP設定反映

```shell
# bgp configure refresh
```


```shell
# show ipsec sa
    Total: isakmp:5 send:4 recv:67

     sa    sgw isakmp connection    dir  life[s] remote-id
    ----------------------------------------------------------------------------
    1     12   -     isakmp        -    28773   140.204.10.62
    2     12   1     tun[0012]esp  send 3575    140.204.10.62
    3     11   47    tun[0011]esp  send 1352    140.204.10.49
    4     1    78    tun[0001]esp  send 2295    52.194.161.178
    5     1    78    tun[0001]esp  recv 2295    52.194.161.178
    6     12   -     tun[0012]esp  recv 2955    140.204.10.62
    7     11   -     isakmp        -    4746    140.204.10.49
    8     1    -     isakmp        -    21296   52.194.161.178
    9     2    -     isakmp        -    21297   54.249.65.49
    10    11   47    tun[0011]esp  recv 1352    140.204.10.49
    11    2    79    tun[0002]esp  send 2296    54.249.65.49
    12    2    79    tun[0002]esp  recv 2296    54.249.65.49
```

##●BGP接続確認

```shell
# show status bgp neighbor
	BGP neighbor is 169.254.151.189, remote AS 64512, local AS 65000, external link
	BGP version 4, remote router ID 0.0.0.0
	BGP state = Active
	Last read 00:00:00, hold time is 0, keepalive interval is 0 seconds
	Received 0 messages, 0 notifications, 0 in queue
	Sent 1 messages, 0 notifications, 0 in queue
	Connection established 0; dropped 0
	Last reset never
	Local host: unspecified
	Foreign host: 169.254.151.189, Foreign port: 0

	BGP neighbor is 169.254.21.85, remote AS 64512, local AS 65000, external link
	BGP version 0, remote router ID 0.0.0.0
	BGP state = Active
	Last read 00:00:00, hold time is 0, keepalive interval is 0 seconds
	Received 0 messages, 0 notifications, 0 in queue
	Sent 0 messages, 0 notifications, 0 in queue
	Connection established 0; dropped 0
	Last reset never
	Local host: unspecified
	Foreign host: 169.254.21.85, Foreign port: 0

	BGP neighbor is 192.168.0.102, remote AS 31898, local AS 65000, external link
	BGP version 0, remote router ID 0.0.0.0
	BGP state = Active
	Last read 00:00:00, hold time is 0, keepalive interval is 0 seconds
	Received 0 messages, 0 notifications, 0 in queue
	Sent 0 messages, 0 notifications, 0 in queue
	Connection established 0; dropped 0
	Last reset never
	Local host: unspecified
	Foreign host: 192.168.0.102, Foreign port: 0

	BGP neighbor is 192.168.0.106, remote AS 31898, local AS 65000, external link
	BGP version 0, remote router ID 0.0.0.0
	BGP state = Active
	Last read 00:00:00, hold time is 0, keepalive interval is 0 seconds
	Received 0 messages, 0 notifications, 0 in queue
	Sent 0 messages, 0 notifications, 0 in queue
	Connection established 0; dropped 0
	Last reset never
	Local host: unspecified
	Foreign host: 192.168.0.106, Foreign port: 0
```

##●BGPルート伝搬確認

```shell
# show ip route
	Destination         Gateway          Interface       Kind  Additional Info.
	default             200.200.200.251   WAN1(PDP)    static
	10.0.0.0/24         192.168.0.102    TUNNEL[11]       BGP  path=31898
	200.200.200.201/32   200.200.200.251        WAN1 temporary
	169.254.21.84/30    -                 TUNNEL[2]  implicit
	169.254.151.188/30  -                 TUNNEL[1]  implicit
	172.25.0.0/16       169.254.151.189   TUNNEL[1]       BGP  path=64512
	192.168.0.100/30    -                TUNNEL[11]  implicit
	192.168.0.104/30    -                TUNNEL[12]  implicit
	192.168.100.0/24    192.168.100.1          LAN1  implicit
	210.0.0.0/8         200.200.200.201        WAN1  implicit
```


##●ルーターコンフィグ確認

```shell
# show config
    # NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
    # MAC Address : 00:a0:de:b2:31, 00:a0:de:b2:32
    # Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
    # main:  NVR700W ver=00 serial=M401111 MAC-Address=00:a0:de:b2:31 MAC-Address=00:a0:de:b2:32
    # Reporting Date: Dec 16 00:00:34 2019
    administrator password encrypted *
    http login-timer=600 multi-session=on
    console character en.ascii
    ip route default gateway pdp wan1
    ip lan1 address 192.168.100.1/24
    ip wan1 address pdp
    ip wan1 nat descriptor 31000
    wan1 bind wwan 1
    wwan select 1
    description wwan aeonmobile
    wwan always-on on
    wwan auth accept chap
    wwan auth myname user@n-aeonmobile.com 0000
    wwan auto connect on
    wwan disconnect time off
    wwan disconnect input time off
    wwan disconnect output time off
    wwan access-point name 4gn.jp
    wwan access limit length off
    wwan access limit time off
    wwan enable 1
    tunnel select 1
    description tunnel AWS-IPSec_amazon-api_20191224085716
    ipsec tunnel 1
    ipsec sa policy 1 1 esp aes-cbc sha-hmac
    ipsec ike duration ipsec-sa 1 3600
    ipsec ike encryption 1 aes-cbc
    ipsec ike group 1 modp1024
    ipsec ike hash 1 sha
    ipsec ike keepalive use 1 on dpd 10 3
    ipsec ike local address 1 192.168.100.1
    ipsec ike nat-traversal 1 on type=2
    ipsec ike pfs 1 on
    ipsec ike pre-shared-key 1 text IPSecKey01
    ipsec ike remote address 1 110.110.110.111
    ipsec tunnel outer df-bit clear
    ip tunnel address 169.254.151.190/30
    ip tunnel remote address 169.254.151.189
    ip tunnel tcp mss limit 1379
    tunnel enable 1
    tunnel select 2
    description tunnel AWS-IPSec_amazon-api_20191224085716
    ipsec tunnel 2
    ipsec sa policy 2 2 esp aes-cbc sha-hmac
    ipsec ike duration ipsec-sa 2 3600
    ipsec ike encryption 2 aes-cbc
    ipsec ike group 2 modp1024
    ipsec ike hash 2 sha
    ipsec ike keepalive use 2 on dpd 10 3
    ipsec ike local address 2 192.168.100.1
    ipsec ike nat-traversal 2 on type=2
    ipsec ike pfs 2 on
    ipsec ike pre-shared-key 2 text IPSecKey02
    ipsec ike remote address 2 110.110.110.112
    ipsec tunnel outer df-bit clear
    ip tunnel address 169.254.21.86/30
    ip tunnel remote address 169.254.21.85
    ip tunnel tcp mss limit 1379
    tunnel enable 2
    tunnel select 11
    description tunnel OCI-VPN1
    ipsec tunnel 11
    ipsec sa policy 11 11 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 11 3600
    ipsec ike duration isakmp-sa 11 28800
    ipsec ike encryption 11 aes256-cbc
    ipsec ike group 11 modp1536
    ipsec ike hash 11 sha256
    ipsec ike keepalive log 11 off
    ipsec ike keepalive use 11 on dpd 5 4
    ipsec ike local address 11 200.200.200.201
    ipsec ike local id 11 0.0.0.0/0
    ipsec ike nat-traversal 11 on
    ipsec ike pfs 11 on
    ipsec ike pre-shared-key 11 text IPSecKey11
    ipsec ike remote address 11 100.100.100.101
    ipsec ike remote id 11 0.0.0.0/0
    ip tunnel address 192.168.0.101/30
    ip tunnel remote address 192.168.0.102
    ip tunnel tcp mss limit auto
    tunnel enable 11
    tunnel select 12
    description tunnel OCI-VPN2
    ipsec tunnel 12
    ipsec sa policy 12 12 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 12 3600
    ipsec ike duration isakmp-sa 12 28800
    ipsec ike encryption 12 aes256-cbc
    ipsec ike group 12 modp1536
    ipsec ike hash 12 sha256
    ipsec ike keepalive log 12 off
    ipsec ike keepalive use 12 on dpd 5 4
    ipsec ike local address 12 200.200.200.201
    ipsec ike local id 12 0.0.0.0/0
    ipsec ike nat-traversal 12 on
    ipsec ike pfs 12 on
    ipsec ike pre-shared-key 12 text IPSecKey12
    ipsec ike remote address 12 100.100.100.102
    ipsec ike remote id 12 0.0.0.0/0
    ip tunnel address 192.168.0.105/30
    ip tunnel remote address 192.168.0.106
    ip tunnel tcp mss limit auto
    tunnel enable 12
    nat descriptor type 31000 masquerade
    nat descriptor address outer 31000 primary
    nat descriptor masquerade static 31000 1 192.168.100.1 udp 500
    nat descriptor masquerade static 31000 2 192.168.100.1 esp
    nat descriptor masquerade static 31000 3 192.168.100.1 udp 4500
    bgp use on
    bgp autonomous-system 65000
    bgp neighbor 1 64512 169.254.151.189 hold-time=30 local-address=169.254.151.190
    bgp neighbor 2 64512 169.254.21.85 hold-time=30 local-address=169.254.21.86
    bgp neighbor 11 31898 192.168.0.102 hold-time=180 local-address=192.168.0.101
    bgp neighbor 12 31898 192.168.0.106 hold-time=180 local-address=192.168.0.105
    bgp router id 169.254.128.14
    bgp import filter 1 equal 0.0.0.0/0
    bgp import 31898 static filter 1
    bgp import 64512 static filter 1
    ipsec auto refresh on
    telnetd service off
    dhcp service server
    dhcp server rfc2131 compliant except remain-silent
    dhcp scope 1 192.168.100.2-192.168.100.191/24
    dns host lan1
    dns server pdp wan1
    dns server select 500401 pdp wan1 any .
    dns private address spoof on
    dns private name setup.netvolante.jp
    analog supplementary-service pseudo call-waiting
    analog extension dial prefix sip prefix="9#"
    cloud vpn service 1 amazon-api
    cloud vpn parameter 1 AKIAQE2ZRNJBCRXNSTEH g4c6PWoL0cJWrA
    2SSG vpn-030ad75b05aea2e9d
    cloud vpn option 1 region=ap-northeast-1
    cloud vpn name 1 AWS-IPSec
    cloud vpn bind 1 tunnel1 tunnel2
    sshd service on
    sshd host key generate *
    statistics traffic on
    wwan-module use on
```


#■AWS: VPCのRouteとFirewall設定
OCIとOn-Premise のCIDRと通信できるように、ここではネットワークACLとルートテーブルを設定

##●ルートテーブル設定
[VPC] > [サブネット] > [対象のサブネット]を選択し、「ルートテーブル」タブを選択して以下のように設定
<img width="1419" alt="Route_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/efb9fb84-25f9-5ba9-aed5-07e136d94082.png">


##●ネットワークACL設定
[VPC] > [サブネット] > [対象のサブネット]を選択し、「ネットワークACL」タブを選択して以下のように設定
<img width="1423" alt="NW-ACL02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/ed96d5e0-62b8-8030-efd6-76653ae5be8a.png">



#■OCI: VCNのRouteとFirewall設定
AWSとOn-Premise のCIDRと通信できるように、ここではセキュリティ・リストとルート・ルールを設定

##●ルート表設定
[ネットワーキング] > [仮想クラウド・ネットワーク] > [対象のVCN] > [ルート表の詳細]から対象のルート表を選択して以下のように設定
<img width="1421" alt="Route_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/f302ae44-ab7f-0a95-efa9-0d9704b8e1b2.png">


##●セキュリティ・リスト設定
[ネットワーキング] > [仮想クラウド・ネットワーク] > [対象のVCN] > [セキュリティ・リスト]から対象のキュリティ・リストを選択して以下のように設定
<img width="1419" alt="Security_01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/cf5484e7-40e3-bfcd-1abb-60bcc8b9df6f.png">




#■接続疎通確認
##● OIC -> AWSインスタンス疎通確認

###・traceroute確認

```shell
[root@tokyo-inst01 opc]# traceroute 172.25.0.10
    traceroute to 172.25.0.10 (172.25.0.10), 30 hops max, 60 byte packets
    1  140.91.206.3 (140.91.206.3)  0.656 ms 140.91.206.5 (140.91.206.5)  0.610 ms  0.530 ms
    2  192.168.0.101 (192.168.0.101)  114.435 ms  105.154 ms  119.114 ms
    3  172.25.0.10 (172.25.0.10)  306.368 ms  337.274 ms  315.354 ms
```

###・ping疎通確認

```shell
[root@tokyo-inst01 opc]# ping 172.25.0.10 -c 3
    PING 172.25.0.10 (172.25.0.10) 56(84) bytes of data.
    64 bytes from 172.25.0.10: icmp_seq=1 ttl=252 time=199 ms
    64 bytes from 172.25.0.10: icmp_seq=2 ttl=252 time=179 ms
    64 bytes from 172.25.0.10: icmp_seq=3 ttl=252 time=177 ms

    --- 172.25.0.10 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2001ms
    rtt min/avg/max/mdev = 177.914/185.675/199.977/10.131 ms
```

###・ssh接続確認

```shell
[root@tokyo-inst01 opc]# ssh -i AWS_id_rsa ec2-user@172.25.0.10 hostname
    ip-172-25-0-10.ap-northeast-1.compute.internal
```

##● AWS -> OCIインスタンス疎通確認

###・traceroute確認

```shell
[root@ip-172-25-0-10 ec2-user]# traceroute 10.0.0.2
traceroute to 10.0.0.2 (10.0.0.2), 30 hops max, 60 byte packets
 1  169.254.151.190 (169.254.151.190)  135.655 ms  151.680 ms  140.557 ms
 2  140.204.10.49 (140.204.10.49)  224.682 ms  237.639 ms  243.538 ms
 3  ip-10-0-0-2.ap-northeast-1.compute.internal (10.0.0.2)  260.594 ms !X  267.558 ms !X  279.500 ms !X
```


###・ping疎通確認

```shell
[root@ip-172-25-0-10 ec2-user]# ping 10.0.0.2 -c 3
    PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
    64 bytes from 10.0.0.2: icmp_seq=1 ttl=62 time=204 ms
    64 bytes from 10.0.0.2: icmp_seq=2 ttl=62 time=183 ms
    64 bytes from 10.0.0.2: icmp_seq=3 ttl=62 time=203 ms

    --- 10.0.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2000ms
    rtt min/avg/max/mdev = 183.944/197.340/204.138/9.472 ms
```

###・ssh接続確認


```shell
[root@ip-172-25-0-10 ec2-user]# ssh -i id_rsa opc@10.0.0.2 hostname
    tokyo-inst01
```

#■参考
・[YAMAHA: Amazon VPCとの接続](https://network.yamaha.com/setting/router_firewall/cloud/amazon_vpc)
・[ORACLEマニュアル: Yamaha RTX Series](https://docs.cloud.oracle.com/iaas/Content/Network/Reference/yamahartx.htm)
・[AWSマニュアル: Yamaha 製デバイス](https://docs.aws.amazon.com/ja_jp/vpc/latest/adminguide/Yamaha.html)