1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
# VyOS High Availability (HA) Deployment on AWS
This document describes how to deploy VyOS in a High Availability (HA) configuration on AWS using Terraform and a VPC Route Server to provide sub-second failover.
## Why Use HA on AWS?
This solution helps organizations achieve **high availability** routing with dynamic connectivity to multiple AWS VPCs or hybrid environments.
Key Advantages:
- Utilizes **AWS VPC Route Server** to manage BGP routes dynamically.
- Deploys two VyOS EC2 instances as BGP peers connected to the Route Server. Although both participate, one is typically preferred as the next-hop.
- Employs **Bidirectional Forwarding Detection (BFD)** for rapid failure detection.
- On failure:
- Withdraws the failed peer’s routes from the RIB.
- Recomputes the optimal path in the FIB.
- Updates VPC route tables to point to the active instance.
- Enables **sub-second failover** (< 1 s), outperforming AWS API-based route table failover.
This architecture supports:
- Cloud edge routing with failover.
- Hybrid cloud resiliency.
- Rapid recovery during instance crashes, upgrades, or network disruptions.
- Continuity for mission-critical operations.
## HA Architecture Diagram
:::{figure} /_static/images/cloud-aws-ha-architecture.png
:alt: VyOS HA topology diagram
:::
## Terraform Automation
To streamline and standardize the process, we developed a Terraform project that automates the deployment of VyOS in High Availability (HA) mode on AWS.
This Terraform project automates the deployment of:
- Two VyOS instances in HA mode.
- VPC Route Server.
- Transit Gateway.
- A Transit VPC and a Data VPC containing a test Amazon Linux EC2 instance for connectivity validation.
To integrate with existing AWS infrastructure:
- Remove the Data VPC, its subnets, and EC2 test instance.
- Update `main.tf`, `network.tf`, `transit_gateway.tf`, `variables.tf`, and `outputs.tf` accordingly.
## Prerequisites
AWS Environment:
- Active AWS account with permissions for EC2, VPC, Transit Gateway, Route Server, and IAM (for keypair and role management).
Local Environment:
- AWS CLI installed: <https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html>
- Terraform installed: <https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli>
Set AWS credentials in your shell:
```none
export AWS_ACCESS_KEY_ID="<AWS_ACCESS_KEY_ID>"
export AWS_SECRET_ACCESS_KEY="<AWS_SECRET_ACCESS_KEY>"
export AWS_SESSION_TOKEN="<AWS_SESSION_TOKEN>"
export AWS_DEFAULT_REGION="<AWS_REGION>" # e.g., us-east-1
```
Obtain VyOS AMI ID and Owner ID:
Subscribe to VyOS via AWS Marketplace. Then run:
```none
aws ec2 describe-images \
--owners aws-marketplace \
--filters "Name=product-code,Values=8wqdkv3u2b9sa0y73xob2yl90" \
--query 'Images[*].[ImageId,OwnerId,Name]' \
--output table
```
Alternatively, set the `vyos_ami_id` variable directly in `variables.tf`.
Generate an SSH keypair (or use the included demo key):
```none
ssh-keygen -b 2048 -t rsa -m PEM -f keys/vyos_custom_key.pem
chmod 400 keys/vyos_custom_key.pem
```
## Usage
Configure variables in `variables.tf`, including instance type, region, and `vyos_ami_id`.
Terraform Workflow:
```none
terraform init
terraform fmt
terraform validate
terraform plan
terraform apply
```
On completion, run:
```none
terraform output
```
This displays the management IP and connectivity test results.
To clean up:
```none
terraform destroy
```
## Management
SSH into VyOS:
```none
ssh vyos@<vyos_public_ip> -i keys/vyos_custom_key.pem
```
## GitHub Repository
You can clone or download the Terraform project and use them in your environment:
<https://github.com/vyos/vyos-automation/tree/main/Terraform/AWS/ha-instances-with-configs>
|
