From 593038329d6f6651c1992e35b89e85dc480484f5 Mon Sep 17 00:00:00 2001 From: "akocbek@ie.ibm.com" Date: Thu, 6 Mar 2025 13:14:32 +0000 Subject: [PATCH 1/5] docs: add VPN DA reference architecture --- .../deploy-arch-ibm-slz-vpn.md | 100 ++++++++++++++++++ .../heat-map-deploy-arch-slz-vpn.svg | 4 + 2 files changed, 104 insertions(+) create mode 100644 reference-architectures/deploy-arch-ibm-slz-vpn.md create mode 100644 reference-architectures/heat-map-deploy-arch-slz-vpn.svg diff --git a/reference-architectures/deploy-arch-ibm-slz-vpn.md b/reference-architectures/deploy-arch-ibm-slz-vpn.md new file mode 100644 index 000000000..8bab913c2 --- /dev/null +++ b/reference-architectures/deploy-arch-ibm-slz-vpn.md @@ -0,0 +1,100 @@ +--- + +copyright: + years: 2025 +lastupdated: "2025-03-05" + +keywords: + +subcollection: deployable-reference-architectures + +authors: + - name: "Andrej Kocbek" + +# The release that the reference architecture describes +version: 2.1.3 + +# Whether the reference architecture is published to Cloud Docs production. +# When set to false, the file is available only in staging. Default is false. +production: false + +# Use if the reference architecture has deployable code. +# Value is the URL to land the user in the IBM Cloud catalog details page +# for the deployable architecture. +# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button +deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-client-to-site-vpn-1b824983-263f-4191-bfcd-c1d1b2220aa3-global + +docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-connect-landingzone-client-vpn + +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/blob/main/reference-architectures/c2s-basic.drawio.svg + +related_links: + - title: "VPC landing zone - Standard variation" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vsi-ra" + description: "A deployable architecture that is based on the IBM Cloud for Financial Services reference and that provides virtual servers in a secure VPC for your workloads." + +use-case: Cybersecurity +industry: Banking,FinancialSector +compliance: FedRAMP + +content-type: reference-architecture + +--- + +{{site.data.keyword.attribute-definition-list}} + +# Cloud automation for Client to Site VPN +{: #vpn-ra} +{: toc-content-type="reference-architecture"} +{: toc-industry="Banking,FinancialSector"} +{: toc-use-case="Cybersecurity"} +{: toc-compliance="FedRAMP"} +{: toc-version="2.1.0"} + +This deployable architecture pattern configures client-to-site VPN secure and encrypted server connectivity within an existing management VPC using only a few required inputs. Once deployed, you can install an OpenVPN client application on the devices you wish to use for VPN access, and import a profile from the VPN server. The configuration also allows you to specify a list of users who will have access to the private network, with access control managed by IBM Cloud IAM. + +## Architecture diagram +{: #ra-vpn-ext-architecture-diagram} + +![Architecture diagram for adding client-to-site VPN to a landing zone deployable architecture](c2s-basic.drawio.svg "Architecture diagram for adding client-to-site VPN to a landing zone deployable architecture"){: caption="Figure 1. client-to-site VPN on existing landing zone" caption-side="bottom"}{: external download="c2s-basic.drawio.svg"} + +## Design requirements +{: #ra-vpn-ext-design-requirements} + +![Design requirements for VPN on management VPC landing zone](heat-map-deploy-arch-slz-vpn "Design requirements"){: caption="Figure 2. Scope of the design requirements" caption-side="bottom"} + + +## Components +{: #ra-vpn-components} + +### Client-to-site VPN architecture decisions +{: #ra-vpn-components-arch} + +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| Set up secure client-to-site VPN | VPN | | | +| Store private certificate in existing Secrets Manager | Secrets Manager | Create and store private certificate to ensure secure communication and authentication between public network and the private VPC | | + +### Network security architecture decisions +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| Load VPN configuration to simplify VPN setup | VPNs | Open following ports by default: 53 (DNS service), 443 (https) | | +| Create two subnets to achieve high availability | VPC | Distributing resources across two subnets allows for load balancing between them, ensuring that no single point of failure affects the performance or availability of client-to-site VPN | | +| * Create connection to isolated existing management VPC and allow only a limited number of network connections \n * All other connections from or to existing management VPC are forbidden | ACL and security group rules in client-to-site VPN| | More ports might be opened in preset or added manually after deployment | +{: caption="Table 2. Network security architecture decisions" caption-side="bottom"} + + + +## Next steps +{: #ra-vpn-ext-next-steps} + +- See the landing zone [deployment guide](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-overview). diff --git a/reference-architectures/heat-map-deploy-arch-slz-vpn.svg b/reference-architectures/heat-map-deploy-arch-slz-vpn.svg new file mode 100644 index 000000000..dff68acb2 --- /dev/null +++ b/reference-architectures/heat-map-deploy-arch-slz-vpn.svg @@ -0,0 +1,4 @@ + + + +
Application
integration
Mobile
Bare metal servers
Primary storage
Enterprise
connectivity
Build & test
Data security
Backup & restore
Monitoring
Edge
Blockchain
Enterprise
applications
Data Ops
Data analytics
Data storage
Business intelligence
Virtual servers
Virtualization
Containers
Cloud Foundry
Serverless
Backup
Archive
Data migration
BYOIP/Edge gateways
Load balancing
Cloud native connectivity
Isolation
Content delivery network
Domain name service
Identity & access
Application security
Infrastructure & endpoints
Threat detection & response
Governance, risk & compliance
Delivery pipeline
Code repository
Disaster recovery
High availability
Logging
Auditing/tracking
Alerting
Event management
Automated deployment
Management/
orchestration
Domain
Aspect
Application
platforms
Data
Compute
Storage
Networking
Security
DevOps
Resiliency
Service
management
Included in this architecture
Artificial intelligence
 \ No newline at end of file From 66792e6e4fa25cb70bc68a141bb6464e7679da68 Mon Sep 17 00:00:00 2001 From: akocbek <106765658+akocbek@users.noreply.github.com> Date: Tue, 18 Mar 2025 12:55:35 +0000 Subject: [PATCH 2/5] Update reference-architectures/deploy-arch-ibm-slz-vpn.md Co-authored-by: Shawna Hinger --- reference-architectures/deploy-arch-ibm-slz-vpn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/deploy-arch-ibm-slz-vpn.md b/reference-architectures/deploy-arch-ibm-slz-vpn.md index 8bab913c2..f5fed6e79 100644 --- a/reference-architectures/deploy-arch-ibm-slz-vpn.md +++ b/reference-architectures/deploy-arch-ibm-slz-vpn.md @@ -31,7 +31,7 @@ image_source: https://github.com/terraform-ibm-modules/terraform-ibm-client-to-s related_links: - title: "VPC landing zone - Standard variation" url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vsi-ra" - description: "A deployable architecture that is based on the IBM Cloud for Financial Services reference and that provides virtual servers in a secure VPC for your workloads." + description: "A deployable architecture that is based on the IBM Cloud for Financial Services Framework reference and that provides virtual servers in a secure VPC for your workloads." use-case: Cybersecurity industry: Banking,FinancialSector From 844e75ee2c7cbb5137edd0100cab019c88dde575 Mon Sep 17 00:00:00 2001 From: akocbek <106765658+akocbek@users.noreply.github.com> Date: Tue, 18 Mar 2025 12:55:52 +0000 Subject: [PATCH 3/5] Update reference-architectures/deploy-arch-ibm-slz-vpn.md Co-authored-by: Shawna Hinger --- reference-architectures/deploy-arch-ibm-slz-vpn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/deploy-arch-ibm-slz-vpn.md b/reference-architectures/deploy-arch-ibm-slz-vpn.md index f5fed6e79..8ab4eb79a 100644 --- a/reference-architectures/deploy-arch-ibm-slz-vpn.md +++ b/reference-architectures/deploy-arch-ibm-slz-vpn.md @@ -43,7 +43,7 @@ content-type: reference-architecture {{site.data.keyword.attribute-definition-list}} -# Cloud automation for Client to Site VPN +# Cloud automation for Client-to-Site VPN {: #vpn-ra} {: toc-content-type="reference-architecture"} {: toc-industry="Banking,FinancialSector"} From ce54d03a6592de08f60edec95ceba7fad7cfc356 Mon Sep 17 00:00:00 2001 From: akocbek <106765658+akocbek@users.noreply.github.com> Date: Tue, 18 Mar 2025 12:56:14 +0000 Subject: [PATCH 4/5] Update reference-architectures/deploy-arch-ibm-slz-vpn.md Co-authored-by: Shawna Hinger --- reference-architectures/deploy-arch-ibm-slz-vpn.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/deploy-arch-ibm-slz-vpn.md b/reference-architectures/deploy-arch-ibm-slz-vpn.md index 8ab4eb79a..101e5c94a 100644 --- a/reference-architectures/deploy-arch-ibm-slz-vpn.md +++ b/reference-architectures/deploy-arch-ibm-slz-vpn.md @@ -51,7 +51,7 @@ content-type: reference-architecture {: toc-compliance="FedRAMP"} {: toc-version="2.1.0"} -This deployable architecture pattern configures client-to-site VPN secure and encrypted server connectivity within an existing management VPC using only a few required inputs. Once deployed, you can install an OpenVPN client application on the devices you wish to use for VPN access, and import a profile from the VPN server. The configuration also allows you to specify a list of users who will have access to the private network, with access control managed by IBM Cloud IAM. +This deployable architecture pattern configures client-to-site VPN secure and encrypted server connectivity within an existing management VPC using only a few required inputs. After it's been deployed, you can install an OpenVPN client application on the devices that you wish to use for VPN access, and import a profile from the VPN server. The configuration also allows you to specify a list of users that can have access to the private network, with access control managed by IBM Cloud Identity and Access Management. ## Architecture diagram {: #ra-vpn-ext-architecture-diagram} From 6fdc4b7698ed2ee4f9812268303014c80d1bd4ae Mon Sep 17 00:00:00 2001 From: "akocbek@ie.ibm.com" Date: Tue, 18 Mar 2025 13:37:17 +0000 Subject: [PATCH 5/5] PR review fix --- reference-architectures/deploy-arch-ibm-slz-vpn.md | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/reference-architectures/deploy-arch-ibm-slz-vpn.md b/reference-architectures/deploy-arch-ibm-slz-vpn.md index 101e5c94a..43c48ed57 100644 --- a/reference-architectures/deploy-arch-ibm-slz-vpn.md +++ b/reference-architectures/deploy-arch-ibm-slz-vpn.md @@ -1,5 +1,4 @@ --- - copyright: years: 2025 lastupdated: "2025-03-05" @@ -63,11 +62,6 @@ This deployable architecture pattern configures client-to-site VPN secure and en ![Design requirements for VPN on management VPC landing zone](heat-map-deploy-arch-slz-vpn "Design requirements"){: caption="Figure 2. Scope of the design requirements" caption-side="bottom"} - ## Components {: #ra-vpn-components} @@ -87,13 +81,6 @@ business challenge, or target cloud environments. | * Create connection to isolated existing management VPC and allow only a limited number of network connections \n * All other connections from or to existing management VPC are forbidden | ACL and security group rules in client-to-site VPN| | More ports might be opened in preset or added manually after deployment | {: caption="Table 2. Network security architecture decisions" caption-side="bottom"} - - ## Next steps {: #ra-vpn-ext-next-steps}