Cisco Secure Access Help

PDF

Cisco Secure Access Help

Configure a Site-to-Site VPN tunnel with Amazon Web Services

Updated: August 24, 2026

Want to summarize with AI?

Log in

Understand how to deploy a site-to-site (S2S) VPN tunnel from Amazon Web Services (AWS) to Cisco Secure Access.

Deploy a site-to-site (S2S) VPN tunnel from Amazon Web Services (AWS) to Cisco Secure Access. An AWS S2S VPN in Secure Access will support the following:

The S2S VPN topology depends on components configured in the following order. Components in the diagram are numbered by order of configuration.


The S2s Aws Diagram 01 interface.

For more detailed instructions, refer to Amazon Virtual Private Cloud Documentation. Please note that AWS may update their documentation without notice.

Limitations

  • Number of Primary Tunnels: Secure Access supports a maximum of two primary tunnels within an AWS Site-to-Site (S2S) VPN tunnel group. Cisco has not validated configurations involving more than two S2S tunnels from a single AWS transit gateway. Additionally, the Secure Access dashboard does not provide the capability to add IP addresses for more than two tunnels in an AWS network tunnel group.

  • Bandwidth per Tunnel: Each IPsec tunnel is limited to a maximum bandwidth of 1 Gbps. Given the two-tunnel limit, the total supported throughput for Secure Access in an AWS S2S VPN deployment is 2 Gbps.

Before you begin

Prerequisites include the following.

  • A valid Cisco Secure Access account.

  • An AWS account with an active subscription and an Amazon VPC.

Procedure

  1. Navigate to VPC dashboard > Create VPC.

  2. Resources to create: VPC only

  3. IPv4 CIDR block: Choose IPv4 CIDR manual input and enter an IPv4 CIDR for your VPC.

  4. Click Create VPC.

    The AWS dashboard shows the new VPC details.


    The S2s Aws UI 02 interface.

  5. Navigate to VPC dashboard > Virtual private cloud > Subnets.

  6. Click Create subnet.

  7. Choose your VPC ID or IP address.

    The AWS dashboard shows the Create subnet menu.


    The S2s Aws UI 03 interface.

  8. Configure subnet 1 of 2.

    1. Enter a Subnet name that indicates the VPC and whether this is the first or second subnet.
    2. Choose an Availability Zone.
    3. Enter an IPv4 subnet CIDR block that is within the VPC CDIR range and does not overlap with the IPv4 range of other subnets in the VPC.

  9. Click Add a subnet. Repeat the above steps to configure subnet 2 of 2 with a different availability zone for high availability.

  10. Click Create subnet.

    The AWS dashboard shows the new subnets.


    The S2s Aws UI 04 interface.

  11. Click Transit gateways in the left navigation menu of the AWS VPC dashboard.

    The AWS dashboard shows the transit gateway configuration menu.
    The S2s Aws UI 05 interface.

  12. Create a transit gateway with an Amazon-side Autonomous System Number (ASN).

    Note
    The Amazon side ASN is required for dynamic routing supported by Border Gateway Protocol (BGP) sessions. This example uses 64519. The range is from 64512 to 65534 for 16-bit ASNs. We recommend entering an ASN that is not already in use by other transit gateways in your Amazon VPC.

  13. Click Create transit gateway.

    Once the gateway Status is Available, create a transit gateway attachment between the transit gateway and the VPC.
    The S2s Aws UI 06 interface.

  14. Click Transit gateway attachments in the left navigation menu of the AWS VPC dashboard.

  15. Click Create transit gateway attachment.

  16. Select the Transit gateway ID of the gateway you just created.

  17. Select the VPC ID of the VPC you created for Component 1.

  18. Click Create transit gateway attachment.

  19. In the left navigation menu of the AWS VPC dashboard, navigate to Virtual private network (VPN) and click Customer gateways.

  20. Click Create customer gateway.

  21. Repeat these steps to create a second customer gateway with a different placeholder IP address. This example uses 209.165.200.241.


    The S2s Aws UI 08 interface.

  22. In the left navigation menu of the AWS VPC dashboard, navigate to Virtual private network (VPN) and click Site-to-Site VPN connections.

  23. Click Create VPN connection and configure the following:

    1. Target gateway type: Transit gateway
    2. Select the virtual private gateway that you created earlier.
    3. Customer gateway: Existing
    4. Select the first customer gateway that you created earlier.
    5. Routing options: Dynamic
    6. Tunnel 1 options > Inside IPv4 CIDR for tunnel 1: Enter a size /30 IPv4 block from the 169.254.0.0/24 range.
      Note
      AWS allows inside CIDR addresses in the 169.254.0.0/16 range in which the network address is the first 16 bits, with 65,536 IP addresses in the range 169.254.0.0 to 169.254.255.255. Secure Access utilizes the 169.254.0.0/24 subnet range for BGP peer addresses, refer to Secure Access BGP Configuration.
    7. Tunnel 1 options > Pre-shared key for tunnel 1: Enter a passphrase. You will enter this in the Secure Access network tunnel group in the next step.
    8. Tunnel 1 options > Advanced options for tunnel 1: Edit tunnel 1 options.
    9. Tunnel 1 options > DPD timeout action: Restart.
    10. Tunnel 1 options > Startup action: Start.

  24. Repeat these steps for Tunnel 2 options with a different size /30 IPv4 block from the 169.254.0.0/24 range. Refer to the note above about the difference in CIDR range requirements between AWS and Secure Access.

  25. Click Create VPN connection.

  26. Repeat these steps to create a second VPN connection.

    1. Select the second customer gateway that you created earlier.
    2. Inside IPv4 CIDR for tunnels 1 and 2 should match the inside IP addresses you entered for tunnels 1 and 2 in the first S2S connection.

    Confirm that both S2S VPN connections have an available State.


    The S2s Aws UI 09 interface.

  27. Step 1 - General Settings: Set Device Type to AWS.

  28. Step 2 - Tunnel ID and Passphrase: Each AWS customer gateway that you created in the previous step will have two tunnels, and each tunnel will have an outside IP address.

    1. Primary Hub > First Tunnel IP Address: Enter the outside IP address of tunnel 1 for AWS S2S VPN connection 1.
      Note
      To find this IP address in AWS, navigate to VPC > VPN connections, click the VPN ID of VPN connection 1, then navigate to Tunnel state > Tunnel 1 > Outside IP address.
    2. Primary Hub > Second Tunnel IP Address: Enter the outside IP address of tunnel 2 for AWS S2S VPN connection 1.
    3. Secondary Hub > First Tunnel IP Address: Enter the outside IP address of tunnel 1 for AWS S2S VPN connection 2.
    4. Secondary Hub > Second Tunnel IP Address: Enter the outside IP address of tunnel 2 for AWS S2S VPN connection 2.
    5. Passphrase: Enter the pre-shared key that you created for the tunnels in AWS.

    The S2s Aws UI 10 interface.

  29. Step 3 - Routing, Dynamic routing > Device AS Number: Enter the Amazon-side Autonomous System Number (ASN) configured for the Transit Gateway in AWS.


    The S2s Aws UI 11 interface.

  30. Step 4 - Data for Tunnel Setup: Copy or download the primary and secondary tunnel IDs, data center (DC) IP addresses, and passphrase (pre-shared key). This is the only time your passphrase will be displayed.

  31. Create two customer gateways using the same procedure that you followed for Component 3:

    1. In AWS VPC dashboard, navigate to Virtual private network (VPN) and click Customer gateways.
    2. Click Create customer gateway.
    3. BGP ASN: Enter the Peer (Secure Access) BGP AS from the Secure Access network tunnel group.
    4. IP address: Enter the DC IP address for the Secure Access primary tunnel.
    5. Click Create customer gateway.
    6. Repeat these steps to create a secondary customer gateway with the DC IP address for the Secure Access secondary tunnel.

  32. Modify the VPN connection in AWS. For more information, refer to Modify AWS Site-to-Site VPN connection options.

    1. In the left navigation menu of the AWS VPC dashboard, navigate to Virtual private network (VPN) and click Site-to-Site VPN connections.
    2. Click the VPN ID of the first connection. Navigate to Actions > Modify VPN connection.
    3. Change Target customer gateway to the primary tunnel customer gateway created to replace the placeholder gateway.
    4. Click Save changes.
    5. Repeat these steps for the second VPN connection and the secondary tunnel customer gateway.
    6. Delete the placeholder customer gateway.

    The S2s Aws UI 12 interface.

  33. In Secure Access, navigate to Connect > Network Connections > Network Tunnel Groups and click the name of the network tunnel group to review the connection status with AWS.


    The S2s Aws UI 15 interface.

  34. Verify the IP address values under Primary Tunnel Hubs in Secure Access. The ID of Tunnel Group 1 should match the Outside IP Address of VPN connection 1, Tunnel 1 in AWS. The ID of Tunnel Group 2 in Secure Access should match VPN connection 1, Tunnel 2 in AWS.


    The S2s Aws UI 16 interface.

  35. Verify the IP address values under Secondary Tunnel Hubs in Secure Access. The tunnel group IDs should match the tunnel addresses of VPN connection 2 in AWS.

    When the tunnel group IDs in the Secure Access primary and secondary tunnel hubs match the tunnel addresses of AWS VPN connections 1 and 2, this confirms that the tunnel connection has been established between AWS and Secure Access DCs.

  36. In AWS, navigate to VPC dashboard > VPC ID > Main route table > Route table ID > Edit routes > Add route.

    1. Destination: Enter the value 0.0.0.0/0.
    2. Target: Transit Gateway, select your Transit Gateway ID.
    3. Click Save changes.

  37. In Secure Access, navigate to Connect > Network Connections > Network Tunnel Groups.

    1. Click the name of the network tunnel group, then click a tunnel name to review Routing details.
    2. Client Routes show routes advertised by Amazon to Secure Access via BGP.
    3. Cloud Routes show routes advertised by Secure Access to Amazon via BGP.

This confirms that branch access to resources in your AWS VPC is now protected by the site-to-site (S2S) IPsec/IKEv2 VPN tunnel with Cisco Secure Access.

What to do next

For information about managing and monitoring your network tunnel group, refer to Manage Network Tunnel Groups.