Granting VPN Users Access to an Additional AWS VPC

If Connect Tunnel users need access to additional VPCs, connect the VPCs to the Transit Gateway created by the CloudFormation template and grant access through the SMA8200v AMC. This requires updates to the Transit Gateway, route tables, and SMA8200v AMC resources and access control rules.

You need the additional VPC CIDR block and the Transit Gateway ID created by the CloudFormation stack. Both are available in the AWS VPC console under Transit Gateways.

Step 1 Attach the Additional VPC to the Transit Gateway

1. In the AWS console, navigate to VPC > Transit Gateways > Transit Gateway Attachments and click Create Transit Gateway Attachment.

2. Configure the following:

   • Transit Gateway ID: Select the Transit Gateway created by the CloudFormation stack.

   • Attachment type: Select VPC.

   • VPC ID: Select the additional VPC.

   • Subnet IDs: Select at least one subnet in the additional VPC. Select a subnet in each Availability Zone that contains resources users need to access.

   

3. Click Create Transit Gateway Attachment and wait for the attachment status to change to Available.

Step 2 Verify the Transit Gateway Route Table

When you create a VPC attachment, AWS automatically propagates the VPC CIDR to the Transit Gateway route table if route propagation is enabled (default).

1. Navigate to VPC > Transit Gateways > Transit Gateway Route Tables and select the route table associated with the Transit Gateway.

2. On the Routes tab, verify that the additional VPC CIDR appears with the new VPC attachment as the target and an Active state.

   

3. On the Associations tab, verify that the existing SMA8200v VPC attachment is associated with the same route table.

   If the additional VPC CIDR does not appear, route propagation may be disabled. In that case, create a static route for the additional VPC CIDR and select the new VPC attachment as the target.

Step 3 Update the SMA8200v VPC Route Table

Add a route for the additional VPC CIDR block to the SMA8200v VPC route table. This route enables traffic from VPN clients using addresses from the Static Pool to be forwarded through the Transit Gateway to the additional VPC.

1. In the AWS Management Console, navigate to VPC > Route Tables.

2. Select the route table associated with the SMA8200v subnet that was created by the CloudFormation stack.

3. Click Edit routes, and then click Add route.

4. Configure the route with the following values:

   • Destination: Additional VPC CIDR block (for example, 10.200.0.0/16)
   • Target: Transit Gateway. Select the Transit Gateway created by the CloudFormation stack.

   

5. Click Save changes.

The SMA8200v VPC route table now contains a route that directs traffic destined for the additional VPC CIDR block through the Transit Gateway. This configuration allows VPN clients to access resources in the additional VPC.

Step 4 Update the Additional VPC Route Table

To allow return traffic to reach VPN clients, the additional VPC must include routes that direct traffic back to the SMA8200v VPC CIDR and the Connect Tunnel static pool CIDR through the Transit Gateway.

1. In the AWS Management Console, navigate to VPC > Route Tables.

2. Select the route table associated with the subnets in the additional VPC that VPN users need to access.

3. Click Edit routes, and then add the following routes:

   Destination	Target
   SMA8200v VPC CIDR (for example, 10.100.0.0/16)	Transit Gateway
   Static Pool CIDR (for example, 10.101.0.0/16)	Transit Gateway



4. Click Save changes.

   If instances in the additional VPC use security groups, ensure that inbound rules allow traffic from the Static Pool CIDR and/or the SMA8200v VPC CIDR on the required ports.

Step 5 Add a Network Resource in the AMC

Add a network resource for the additional VPC CIDR in the SMA8200v AMC so that it can be referenced in access control rules.

1. Log in to the AMC at https://<AppliancePublicIp>:8443/ and navigate to Resources.

2. Click Add Resource, and then select Subnet as the resource type.

   You can also use other resource types, such as host names, IP addresses, or IP address ranges.

3. Enter a name and description for the resource.

   

4. Enter the additional VPC CIDR as the network address.

5. Click Save.

Step 6 Update access control rules in AMC

Add or edit an access control rule to grant the appropriate users access to the new resource.

Step 7 Verify Connectivity

After completing all configuration steps, connect a test client by using the Connect Tunnel application and verify the following:

• Verify pushed routes: From the connected client, run route print (Windows) or netstat -rn (macOS/Linux). The additional VPC CIDR should appear in the routing table as a pushed route.

• Test destination access: Ping or establish a connection to a resource in the additional VPC by using its private IP address.

• Troubleshoot connectivity issues: If connectivity fails, confirm that:
  • All four route table changes are saved.
  • The Transit Gateway (TGW) attachment state is Available.
  • Security groups on the target instances permit inbound traffic from the static pool CIDR.