Skip to content

HSCN RaaS Architecture

Sources: RaaS HSCN Design (TRIB 53282678) · HSCN Transit Stack (TRIB 53282567) · HSCN Customers (TRIB 19931889960)

Overview

The HSCN variant of RaaS extends the standard architecture with connectivity to the Health & Social Care Network (HSCN) — a private WAN used by UK NHS organisations across England.

HSCN customers differ from standard RaaS customers in a critical way: they do not have public-facing VPNs. Instead, they peer into the management account via two StrongSwan VPN servers that connect through Redcentric (the HSCN network provider and AWS Direct Connect partner).

graph TB
    subgraph CustSite["NHS Trust Site"]
        CustNet[Customer Systems]
    end

    subgraph HSCN["HSCN Private WAN (via Redcentric)"]
        RC[Redcentric Gateway]
    end

    subgraph Mgmt["Management Account (640815619001) — eu-west-2"]
        direction TB
        subgraph TransitStack["HSCN Transit Stack"]
            SS1["StrongSwan Node 1\n10.104.29.4\n(Primary)"]
            SS2["StrongSwan Node 2\n10.104.29.20\n(Standby)"]
        end
        TGW["Transit Gateway\ntgw-039e174fce8f69655"]
        MGMT_VPC["Management VPC\n172.16.140.0/22"]
        PROXY["Proxy Instances\n(ALB-fronted)"]
        TGW_VPN["TGW VPN Attachment\n(customer VPN endpoint)"]
    end

    subgraph CustAcct["Customer AWS Account"]
        direction TB
        CustVPC["Customer VPC\n(e.g. 10.138.x.0/23)"]
        RHAPSODY["Rhapsody EC2"]
    end

    CustNet -->|"HSCN Private WAN"| RC
    RC -->|"IPsec VPN\n(Dynamic — strongswan+quagga BGP)"| SS1
    RC -->|"IPsec VPN\n(Dynamic — strongswan+quagga BGP)"| SS2
    SS1 & SS2 -->|"Secondary VPN to TGW"| TGW
    TGW -->|"VPC Attachment"| CustVPC
    TGW -->|"VPN to customer VPN endpoint"| TGW_VPN
    CustVPC --> RHAPSODY
    TGW <--> MGMT_VPC
    MGMT_VPC --> PROXY

Key Differences from Standard RaaS

Aspect Standard RaaS HSCN RaaS
Customer connectivity Public internet site-to-site VPN HSCN Private WAN via Redcentric
Public-facing VPN Yes — AWS managed VPN GW No — no public VPN endpoints
VPN software in management account N/A StrongSwan + Quagga (BGP, dynamic)
Transit Gateway Optional Required
Network provider None Redcentric (HSCN gateway)
Complexity Lower Higher — more hops, stricter change control

HSCN Transit Stack

The transit stack lives in the management account (640815619001, eu-west-2). It is a pair of EC2 instances running StrongSwan (IPsec VPN) + Quagga (BGP dynamic routing), providing:

  1. VPN from HSCN — via Redcentric, using AWS Direct Connect as the underlying transport
  2. Secondary VPN to the Transit Gateway — providing dynamic failover detection

All VPN connections are dynamic (not static) so that failover is detected automatically. Routes are propagated into the TGW route table.

Termination Node IPs

Node Private IP Role
hscn-vpn-termination01 10.104.29.4 Primary
hscn-vpn-termination02 10.104.29.20 Standby/failover

These IPs are within the HSCN IPAM range (10.104.29.0/24) — they are reachable from the Redcentric/HSCN side. Do not confuse them with the management VPC's standard CIDR range.

The VPN termination subnets are in a separate subnet from the EC2 VPN instances themselves.

VPN Design — Option 2 (Transit Gateway Attachment)

RaaS uses Option 2 for HSCN VPN connectivity: a VPN attachment directly on the Transit Gateway (not a Virtual Private Gateway at the customer VPC level). This means:

  • The customer VPN is defined in the management account via a CloudFormation custom resource
  • The VPN connects to the HSCN Transit Gateway via the TGW VPN attachment
  • The customer VPC connects to the TGW via a standard VPC attachment

This approach keeps all HSCN-facing resources centralised in the management account, making it easier to audit and maintain.

Proxy Instances

Proxy instances live in the management VPC private subnet, behind an Application Load Balancer (ALB). Configuration is delivered via S3 bootstrap.

  • Accessible from customer VPCs via the TGW
  • Provide outbound internet access for Rhapsody instances in HSCN customer accounts (HSCN traffic cannot route to the public internet directly)

Static vs Dynamic VPN

For the termination node VPN to the Transit Gateway, kernel routing is modified at bootstrap time:

  1. Default route deleted
  2. Management VPC route added
  3. VPC-specific route added
  4. VPN endpoint route added

A SELinux policy is created for the strongswan leftupdown script (callback that runs when a tunnel goes up/down).

BGP Route Propagation

The HSCN transit stack announces 10.104.29.0/24 to the HSCN side (Redcentric). The default route (0.0.0.0/0) points toward the TGW, allowing management account resources to reach the internet via the standard management proxy.

Routes propagated to the TGW route table include customer-specific CIDR blocks (e.g., 192.168.0.1/32 → VPN termination).

Access Through S3

S3 access from HSCN customer VPCs goes through the proxy. The default route is removed at the end of bootstrap to prevent S3 traffic from going via the HSCN network.