Skip to content

VPN Management

Source: Update RaaS Participant VPNs (TRIB 19296780289)

For HSCN-specific VPN operations, see UK HSCN → VPN Operations.

Always work from non-production first

Run all playbooks against non-production environments first to verify correctness before touching prod. Use limits to run against one host at a time.

Overview

Most VPN operations are performed from your AWS Workspace against the relevant Ansible Tower instance (tower.us.raas.rhapsody.global or tower.uk.raas.rhapsody.global).

The processes below are designed to minimise Rhapsody downtime. All changes can be achieved by updating the RaaS stacks and terminating the RaaS node to let the bootstrap scripts reconfigure the VPN.

Before You Start — Review the VPN Form

Verify information provided by the client:

  • "Public IP of termination device" and "subnet" are the two required pieces for building the tunnel
  • AWS supports all common DH groups and encryption algorithms
  • Phase 1 lifetime must be between 900 and 28,800 seconds (AWS defaults to 28,800)
  • Phase 2 lifetime must be between 900 and 3,600 seconds, and cannot be greater than Phase 1
  • When providing our subnet, enter a single subnet that includes the IPs of the customer instances in their config file — multiple subnets/IPs cause tunnel instability

Change Virtual IP of Rhapsody Node

  1. Update the vpn_ip in the customer config in deploy-raas: 
    environments:
  - name: <customer_code>-<VPN_name>
    vpn_ip: 1.1.1.1   # ← update this
    bgp_asn: 65010
  2. SCM Update — click Sync on the project in Ansible Tower
  3. Deploy Rhapsody — set deploy_stack: false to create a changeset first
  4. Review and execute the CloudFormation changeset in AWS console
  5. Rhapsody - Update DNS and inventory
  6. Rhapsody - Configure Alias Interface (standard RaaS stack) to update the virtual IP
  7. MAINTENANCE - Service State → stop strongswan
  8. Rhapsody - Configure Strongswan to update NAT rules
  9. View Strongswan Configuration to verify the VIP, NAT rules, and routes
  10. If NAT rules are not updated: run ad-hoc command strongswan restart and recheck

Add a New VPN / Modify an Existing VPN

  1. Update the participants section in the customer config: 
    participants:
  - name: <customer_code>-<VPN_name>
    cidr_blocks:
      - 1.1.1.1/32
      - 192.168.0.0/24
    ip_address: 2.2.2.2
    bgp_asn: 65000
  2. SCM Update on the deploy-raas project
  3. Deploy Rhapsody — create a changeset, review in CloudFormation, execute
  4. Verify the VPN static route in AWS console: VPC → Site-to-site VPN → Static routes
  5. Rhapsody - Update DNS and inventory
  6. Rhapsody - Configure Strongswan to update NAT rules and VPN routes
  7. MAINTENANCE - Service State → restart strongswan
  8. View Strongswan Configuration to verify
  9. Enable CloudWatch logging on the new VPN tunnels:
  10. Create a log group: <customer_code>-<VPN_name>-vpn-logs in CloudWatch
  11. Modify each VPN tunnel option → enable Tunnel activity log → select the log group
  12. Send customer the VPN endpoint IP and PSK using the VPN Site Questionnaire template

Add Additional Routes via VPN

  1. Update cidr_blocks in the participants config to add the new subnet(s)
  2. SCM Update → Deploy Rhapsody (changeset) → verify CloudFormation → execute
  3. Verify static routes in AWS console
  4. Rhapsody - Update DNS and inventory
  5. Rhapsody - Configure Strongswan
  6. Restart strongswan via MAINTENANCE - Service State
  7. View Strongswan Configuration to confirm new routes

Update IP Whitelist Rules via VPN

  1. Add remote_vpn_acl entries to the participant block: 
    participants:
  - name: <customer_code>-<VPN_name>
    cidr_blocks:
      - 1.1.1.1/32
    ip_address: 2.2.2.2
    bgp_asn: 65000
    remote_vpn_acl:
      - 10004
      - 10014
  2. Rhapsody - Update DNS and inventory
  3. Rhapsody - Configure Strongswan to apply whitelist rules
  4. Verify: iptables -t filter -L -n to confirm rules applied