Welcome back
to Part 3 of this demo series.
In this part of the demo series,
we're going to go ahead and create the client VPN endpoint.
So this is the thing that our software
running on our client machines
will use to connect to our VPN.
This is the architecture that we're going to implement
in this stage and the following stage of this demo series.
So Stages 3 and 4 are related.
In Stage 3, we're going to create the VPN endpoint,
and in Stage 4, we're going to configure
the VPN endpoint as well as the association.
So at this point, we need to move across to the VPC console.
So click in the Search box at the top,
type "VPC".
Locate VPC, right-click,
and open that in a new tab and then move to that tab.
Again, the step-by-step instructions for this
and every other stage are contained in the instructions
attached to this lesson.
Now in the menu on the left, scroll down.
And under Virtual private network,
click on Client VPN Endpoints.
Then click on Create client VPN endpoint.
Under Name tag, go ahead and enter A4L Client VPN.
Then we need to specify the IP version 4 CIDR
that our clients are going to use.
So in our case,
we're going to use 192.168.12.0/22.
So this is a range that's not used
as part of the Animals4Life VPC.
In production usage,
you would need to pick something appropriate
but for this demo lesson,
we can go ahead and use this.
Scroll down and under Authentication information,
under Server certificate ARN,
click in the dropdown and select the certificate
that you just provisioned.
Under Authentication options,
we can select to Use user-based authentication,
so this is identity based;
or you can use mutual authentication
which uses certificates.
We're going to use user-based authentication.
And once we check that box,
we'll need to pick an identity source.
Now we're going to use Active directory authentication
and we're going to use the simple AD
that we created earlier.
So click in this Directory ID dropdown
and select the directory that you created
in an earlier stage.
Now, if this were a production deployment,
you'd probably want to log any client connection details
within CloudWatch logs.
But for this demo lesson, to keep it simple,
we're going to select, no, we don't want to do that.
Scroll down.
We won't pick anything from the Client connect handler,
we don't want to use any of those features.
What we do need to do is specify
the DNS servers that will be presented
to the clients that connect to our client VPN.
No default DNS service are provided to clients
and so in order for our clients
to be able to resolve anything within the VPC,
we need to provide some DNS servers.
Now what we can do is use the Directory Service
for this functionality.
So move back to the Directory Service tab.
Click on the Directory ID.
Scroll down and you'll see two DNS addresses.
Go ahead and copy the first one into your clipboard.
Move back to this client VPN screen and paste that in.
Go back to Directory Service,
copy the second IP address into your clipboard.
Move back and then paste that into this second box.
And this will mean that our clients
are given the IP addresses of our Directory Service
as their DNS.
And that's what we want.
Now we do want our clients to be able to access
any local resources or any internet resources
without using the VPN.
We only want the VPN to be used for VPC resources.
So we're going to use split-tunnel VPN.
So check that box.
If you recall, I did discuss this within the theory lesson.
Now we need to pick the Animals4Life VPC,
so click in the VPC dropdown
and select the A4L-VPC.
Now we need to decide on what security groups
we apply to the endpoint.
So go ahead and make sure that default is selected
as well as the one that says GeneralSG.
So pick the one that says GeneralSG.
Don't worry if it says IP version 6,
you can ignore that naming.
Just make sure that you pick both
the default and the A4L-General.
Scroll down and check Enable self-service portal.
This is a feature that allows users to log in
and download their own configuration.
So check Enable self-service portal.
And once you've done all of that,
go ahead and click on Create client VPN endpoint.
You'll see that it says
"Client VPN endpoint successfully created"
and the status should be Pending-associate.
And that's everything that you need to do
in this stage of the demo series.
So the state of this client VPN endpoint
should be Pending-associate,
and that's fine because we need to associate this
with a subnet within our VPC.
This is the subnet where the interfaces for the client VPN
will be created within.
And it's this interface or any traffic from our clients
going towards the VPC will exit from,
and any traffic destined for our clients
from within the VPC will enter.
Now we need to create these
but we're going to do that in the next stage
of this demo lesson.
At this point, you've done everything
that you need to in this part.
So go ahead and complete this video.
And when you're ready,
I'll look forward to you joining me
in the next part of this demo series.