Creating Security Groups for SBC SWe in AWS

 Create security group rules for the subnets associated with the following interfaces using the tables corresponding to each type of interface.

• MGT0
• HA
• PKT0
• PKT1

Customize security groups based on your network security requirements.

Inbound Security Group Rules

It is recommended to open the following ports using Inbound/Ingress rules in the security groups associated with the management, HA and packet interfaces. Port recommendations are also provided for deployments that include an High-Availability Front End (HFE).

Management Security Group

HA Security Group

Packet Security Group

HA Forwarding Node Security Group

Outbound Security Group Rules

It is recommended to open all ports using Outbound/Egress rules in the security groups associated with the management, HA and packet interfaces.  If an HFE is present, the same recommendation applies  to its public-facing (eth0) port.

Route Table Rule

AWS uses the most specific route in your route table that matches the traffic to determine how to route the traffic (longest prefix match). You need to have the rule to route all the non-Virtual Private Clouds (VPC) traffic to internet gateway or ensure that the internet traffic is routed through your own NAT instance or Gateway. If you cannot provide a way to send out the SBC API query to the internet, the HA solution fails (SBC) in AWS.

The routes to the IPv4 and IPv6 addresses or CIDR blocks are independent of each other. AWS uses the most specific route that matches either IPv4 traffic or IPv6 traffic to determine how to route the traffic.

For example, the following route table has a route for IPv4 Internet traffic 0.0.0.0/0 that points to an Internet gateway. Any traffic destined for a target within the VPC (10.0.0.0/16) is covered by the Local route, and therefore, routed within the VPC. All other traffic from the subnet uses the internet gateway.

Dynamic Host Configuration Protocol (DHCP) Option Set

The Dynamic Host Configuration Protocol (DHCP) provides a standard for passing configuration information to hosts on a TCP/IP network. The options field of a DHCP message contains the configuration parameters. Some of those parameters are the domain name, domain name server, and the netbios-node-type.

The DHCP options sets are associated with your AWS account so that you can use them across all of your VPC. For detailed information on the DHCP option sets, refer to DHCP Options Sets of the AWS documentation.

The following DHCP option sets are provided by AWS:

• default DHCP option set
• custom DHCP option set

When you create a VPC, AWS automatically creates a set of DHCP options and associates them with the VPC. This set includes two options:

• domain-name-servers=AmazonProvidedDNS
• domain-name=domain-name-for-your-region

The AmazonProvidedDNS is an Amazon DNS server, which enables DNS for instances that need to communicate over the VPC's Internet gateway. The string AmazonProvidedDNS maps to a DNS server running on a reserved IP address at the base of the VPC IPv4 network range, with the last octet incremented by two digits. For example, the DNS Server on a 10.0.0.0/16 network is located at 10.0.0.2.”. For VPCs with multiple IPv4 CIDR blocks, the DNS server IP address is located in the primary CIDR block.

AWS HA uses several API requests to know the peer instance and also during IP switch-over. At the back-end, AWS has several servers with different IP address running to provide the SBC seamless performance or response. If one server goes down, the Amazon-provided DNS automatically updates the API endpoint. This may not be the case with the custom DNS and results in an API request failure. To overcome this issue, the SBC needs to add the field AmazonProvidedDNS in the DNS server, in addition to the IP address of the custom DNS server. For detailed inforamtion on the custom DNS, refer to Using DNS with Your VPC of the AWS documentation.

Create Security Group

Before creating security group rules, create a subnet for this purpose within the virtual private cloud (VPC). Use the CIDR value for this subnet when creating security group rules.

To create a security group:

1. Navigate to EC2 Management Console.

2. From the left pane, click Security Groups.

   Security Groups Tab

   

   
   

3. Click Create Security Group. The Create Security Group page displays.

4. Enter a Security group name and Description.
    

5. Select an appropriate VPC from the list.

6. Click Add Rule to create security group rules. 

   Note

   By default, the Inbound rules tab is displayed on the screen.

   Creating Security Group for MGT

   

   
   

7. Click Create.

8. Repeat step 3 through 7 to create the new security group for HA, PKT0, and PKT1 network interfaces.