diff --git a/reference-architectures/deploy-arch-ibm-slz-vpn.md b/reference-architectures/deploy-arch-ibm-slz-vpn.md new file mode 100644 index 000000000..43c48ed57 --- /dev/null +++ b/reference-architectures/deploy-arch-ibm-slz-vpn.md @@ -0,0 +1,87 @@ +--- +copyright: + years: 2025 +lastupdated: "2025-03-05" + +keywords: + +subcollection: deployable-reference-architectures + +authors: + - name: "Andrej Kocbek" + +# The release that the reference architecture describes +version: 2.1.3 + +# Whether the reference architecture is published to Cloud Docs production. +# When set to false, the file is available only in staging. Default is false. +production: false + +# Use if the reference architecture has deployable code. +# Value is the URL to land the user in the IBM Cloud catalog details page +# for the deployable architecture. +# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button +deployment-url: https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-client-to-site-vpn-1b824983-263f-4191-bfcd-c1d1b2220aa3-global + +docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-connect-landingzone-client-vpn + +image_source: https://github.com/terraform-ibm-modules/terraform-ibm-client-to-site-vpn/blob/main/reference-architectures/c2s-basic.drawio.svg + +related_links: + - title: "VPC landing zone - Standard variation" + url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vsi-ra" + description: "A deployable architecture that is based on the IBM Cloud for Financial Services Framework reference and that provides virtual servers in a secure VPC for your workloads." + +use-case: Cybersecurity +industry: Banking,FinancialSector +compliance: FedRAMP + +content-type: reference-architecture + +--- + +{{site.data.keyword.attribute-definition-list}} + +# Cloud automation for Client-to-Site VPN +{: #vpn-ra} +{: toc-content-type="reference-architecture"} +{: toc-industry="Banking,FinancialSector"} +{: toc-use-case="Cybersecurity"} +{: toc-compliance="FedRAMP"} +{: toc-version="2.1.0"} + +This deployable architecture pattern configures client-to-site VPN secure and encrypted server connectivity within an existing management VPC using only a few required inputs. After it's been deployed, you can install an OpenVPN client application on the devices that you wish to use for VPN access, and import a profile from the VPN server. The configuration also allows you to specify a list of users that can have access to the private network, with access control managed by IBM Cloud Identity and Access Management. + +## Architecture diagram +{: #ra-vpn-ext-architecture-diagram} + +![Architecture diagram for adding client-to-site VPN to a landing zone deployable architecture](c2s-basic.drawio.svg "Architecture diagram for adding client-to-site VPN to a landing zone deployable architecture"){: caption="Figure 1. client-to-site VPN on existing landing zone" caption-side="bottom"}{: external download="c2s-basic.drawio.svg"} + +## Design requirements +{: #ra-vpn-ext-design-requirements} + +![Design requirements for VPN on management VPC landing zone](heat-map-deploy-arch-slz-vpn "Design requirements"){: caption="Figure 2. Scope of the design requirements" caption-side="bottom"} + +## Components +{: #ra-vpn-components} + +### Client-to-site VPN architecture decisions +{: #ra-vpn-components-arch} + +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| Set up secure client-to-site VPN | VPN | | | +| Store private certificate in existing Secrets Manager | Secrets Manager | Create and store private certificate to ensure secure communication and authentication between public network and the private VPC | | + +### Network security architecture decisions +| Requirement | Component | Reasons for choice | Alternative choice | +|-------------|-----------|--------------------|--------------------| +| Load VPN configuration to simplify VPN setup | VPNs | Open following ports by default: 53 (DNS service), 443 (https) | | +| Create two subnets to achieve high availability | VPC | Distributing resources across two subnets allows for load balancing between them, ensuring that no single point of failure affects the performance or availability of client-to-site VPN | | +| * Create connection to isolated existing management VPC and allow only a limited number of network connections \n * All other connections from or to existing management VPC are forbidden | ACL and security group rules in client-to-site VPN| | More ports might be opened in preset or added manually after deployment | +{: caption="Table 2. Network security architecture decisions" caption-side="bottom"} + +## Next steps +{: #ra-vpn-ext-next-steps} + +- See the landing zone [deployment guide](https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-overview). diff --git a/reference-architectures/heat-map-deploy-arch-slz-vpn.svg b/reference-architectures/heat-map-deploy-arch-slz-vpn.svg new file mode 100644 index 000000000..dff68acb2 --- /dev/null +++ b/reference-architectures/heat-map-deploy-arch-slz-vpn.svg @@ -0,0 +1,4 @@ + + + +
Application
integration
Mobile
Bare metal servers
Primary storage
Enterprise
connectivity
Build & test
Data security
Backup & restore
Monitoring
Edge
Blockchain
Enterprise
applications
Data Ops
Data analytics
Data storage
Business intelligence
Virtual servers
Virtualization
Containers
Cloud Foundry
Serverless
Backup
Archive
Data migration
BYOIP/Edge gateways
Load balancing
Cloud native connectivity
Isolation
Content delivery network
Domain name service
Identity & access
Application security
Infrastructure & endpoints
Threat detection & response
Governance, risk & compliance
Delivery pipeline
Code repository
Disaster recovery
High availability
Logging
Auditing/tracking
Alerting
Event management
Automated deployment
Management/
orchestration
Domain
Aspect
Application
platforms
Data
Compute
Storage
Networking
Security
DevOps
Resiliency
Service
management
Included in this architecture
Artificial intelligence
 \ No newline at end of file