VPC-Private Network Connections
For both durability and security, we recommend using a VPC-private network connection — either VPC-Hardware VPN Access or VPC-DirectConnect — for your Q-Cloud Protect.
Q-Cloud Protect appliances in the C2S region must able to communicate with the following resources outside of your VPC. In addition, these are the only external resources that your cloud appliance will be able to communicate with.
- EC2 server to manage metadata stored in EBS volumes and snapshots
- S3 to manage storage buckets
- CAP server to manage authorizations
- Source DXi appliances or OST servers from which data is being replicated.
- If NTP is configured, the pool.ntp.org server.
Review the following concepts to gain a better understanding of VPC connections.
A Virtual Private Cloud (VPC) is an isolated section within the AWS cloud where Q-Cloud Protect instances reside. You can configure your own VPC and its virtual network, including the configuration of the network connection between your Q-Cloud Protect instances and your on-site DXi appliances.
For more information regarding Amazon's VPC, see http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-vpc.html.
A VPC S3 endpoint enables instances within your VPC to communicate with their S3 buckets over a private connection that does not require an Internet gateway or a VPN connection. All data transferred between your instances and their S3 buckets stays securely within the Amazon network.
For more information regarding VPC endpoints, see https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-endpoints.html#vpc-endpoints-s3.
The VPC-Hardware VPN Access connection uses a VPN tunnel to securely connect your on-site DXi with your Q-Cloud Protect instance in the VPC.
Review the following information about the components that complete this type of connection. For information about creating a VPC-Hardware VPN Access connection, see Creating a VPC-Hardware VPN Access Connection.
To create this connection, you will need to create the following components.
- VPC in which your instances will reside.
- VPC endpoint policy to enable a private connection — a secure connection that does not require an Internet gateway or a VPN connection — between instances within the VPC and S3 buckets within the same region.
- For metered AMIs in AWS Marketplace, an Internet gateway within the VPC that allows your instances to communicate with the Internet, and AWS API services.
- For licensed AMIs in GovCloud, an Internet gateway within the VPC that allows your instances to communicate with Quantum's license verification server, and AWS API services.
- For licensed AMIs C2S, a connection between your VPC and EC2 API endpoints.
Internet Protocol Security (IPsec) VPN tunnel to secure all communication between your on-site DXi appliances and Q-Cloud Protect instances. This VPN connection consists of the following:
- Virtual private gateway allowing communication to and from the Q-Cloud Protect instances within the VPC.
- Customer gateway allowing communication to and from the on-site DXi appliances.
- VPN connection between the virtual private gateway and the customer gateway.
In addition, you will need to configure the following:
- Public subnet to define the range of private IP addresses that can be assigned to your instances. Your instances will also be assigned public IP addresses to be used with the Internet gateway.
- Routing table to direct traffic for the subnet associated with your VPC.
- Security groups to define the traffic allowed to and from your instances in the VPC.
Dynamic Host Configuration Protocol (DHCP) options set provide instances access to domain name servers (DNS) while communicating with your on-site DXi appliances.
With a VPC-DirectConnect network connection, DirectConnect replaces the user-configured VPC-Hardware VPN Access connection. For more information about using AWS DirectConnect, see http://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html.
Note: Additional charges apply when you use AWS DirectConnect.