Creating a Geo VPN Gateway

If you have a global workforce that needs to access the cloud with the best user experience, build a cloud network with Geo VPN access capability.

The geolocation VPN feature combines the Aviatrix scale-out VPN solution with latency-based routing to dynamically route VPN users to the nearest VPN access gateway based on the latency between the user and the gateways.

Geo VPN service is currently only available for AWS cloud.

To create a Geo VPN Gateway instance in AWS:

  1. Go to Aviatrix CoPilot > Cloud Fabric > UserVPN > select the Geo VPN tab.

  2. Click + GeoVPN Gateway.

For more information on these gateway settings, see UserVPN Gateway Settings.

Setting Description

Name

Enter a name for the gateway.

Cloud

Geo VPN is only available in standard AWS cloud.

Account

Select the cloud account in which to launch the gateway. These accounts are onboarded through CoPilot > Cloud Resources > Cloud Accounts.

Region

Select the region in which to launch the gateway.

VPC/VNet

Select the VPC or VNet in which to launch the gateway.

Instance Size

Select the size of the gateway instance.

High Performance Encryption

For more information, see the “About High Performance Encryption” document.

Instances

To add a gateway stance, click + Instance.

VPN Access Configuration
The following fields are only available when you are adding the first Geo VPN gateway to an account.

ELB

Elastic Load Balancing is required for Geo VPN gateways.

ELB Name

Enter the name of the Elastic Load Balancer.

VPN Protocol

Select the ELB VPN protocol: TCP or UDP.

For Geo VPN gateways, all primary and HA instances for a Geo VPN gateway need to have the same VPN protocol.

Max Connections (Per Gateway Instance)

Maximum number of active VPN users allowed to be connected to this gateway. The default is 100.

When you change this address, make sure the number is smaller than the VPN CIDR block. The UserVPN VPN CIDR Block allocates 4 IP addresses for each connected VPN user; when the VPN CIDR Block is a /24 network, it supports about 60 users.

Authentication

Click on this dropdown menu and select an authentication option:

  • None (Certificate-Only)

  • DUO

  • LDAP

  • LDAP + DUO

  • Okta

  • SAML

Split Tunnel

Turn Split Tunnel on to ensure only the specified CIDR ranges go through the VPN tunnel. When you turn this setting on, new fields appear below.

Policy-Based Routing

Policy-Based Routing (PBR) enables you to route VPN traffic to a different subnet with its default gateway.

By default, all VPN traffic is NATed and sent to VPN gateway’s eth0 interface. If you want to force the VPN traffic to go out on a different subnet other than VPN gateway eth0 subnet, you can specify a PBR Subnet in the VPC and the PBR Default gateway.

Split Tunnel options

Additional CIDR(s)

(Optional) The VPC CIDR where the VPN gateway is deployed is the default CIDR that VPN gateway pushes to the VPN client. Leave it blank if you do not need it.

When Split Tunnel Mode is enabled, the Additional CIDRs specifies a list of destination CIDR ranges that will also go through the VPN tunnel.

This is a useful field when you have multiple VPC/VNets that the VPN user needs to access.

Nameserver(s)

(Optional) When Split Tunnel Mode is enabled, you can instruct the VPN gateway to push down a list of DNS servers to your desktop, so that a VPN user is connected, it will use these DNS servers to resolve domain names.

Search Domain(s)

(Optional) Split Tunnel Mode enables you to specify a list of search domains. The supplied domain name is appended to the search domain to create an FQDN (Fully Qualified Domain Name) that is queried to the Nameserver.

Windows VPN clients support a maximum of 10 search-domain entries. The OpenVPN service supports only up to 10 on the Windows OS.

Geo VPN Configuration options

Account

Select the cloud account where the DNS domain is hosted.

Domain Name

Enter the hosted domain name.

This domain name must be hosted by AWS Route53 in the selected account.

VPN Service

The hostname that users will connect to. A DNS record will be created for this name in the specified domain name.

Click Create.

Your gateway is created. To view the task’s progress, go to Monitoring > Notifications > select the Tasks tab.

If enabling GeoVPN fails, make sure the Domain Name you enter is a registered name under AWS Route 53 in a public hosted zone. In addition, this Domain name must be hosted in the account that you have access privilege. If the domain name is hosted by another account, you will not be able to add the DNS record.