Enable Nomis access from Global protect VPN

[davidkelliott]

User Story

• RAM share PTTP Transit Gateway with modernistation platforms core-networking-account
• Within core-network-services account:
• Create a routing vpc in core-network-services account
• Create two routing subnets each connected to a different TGW
• Create TGW attachments for both subnets
• Create a common vpc routing table to direct the traffic to the relevant TGW attachement
• Create a TGW routing table for pttp ingress traffic

• Update live-data and non-live-data TGW routing tables to direct traffic for Global Protect to the vpc routing vpc

• on PTTP Tgw side:
  • accept the Transit Gateway attachment
  • create a mod platform TGW routing table
  • add route for Global Protect CIDR (10.180.92.0/22)

  • add route HMPPS CIDR (10.235.16.0/21) to Global Protect TGW routing table

• amend Network ACLs on our end for Nomis test
• run tests

  Value

This is a work around solution to join TGWs in both Modernisation Platform and PTTP production. AWS do not support peering Transit Gateways that are in the same region, there is AWS work in place to resolve this.

Questions / Assumptions

Definition of done

• [x] RAM shared PTTP Transit Gateway with modernistation platforms core-networking-account
• Within core-network-services account:
  • [x] created a routing vpc in core-network-services account
  • [x] created two routing subnets each connected to a different TGW
  • [x] created TGW attachments for both subnets
  • [x] created a common vpc routing table to direct the traffic to the relevant TGW attachement
  • [x] created a TGW routing table for pttp ingress traffic
  • [x] updated live-data and non-live-data TGW routing tables to direct traffic for Global Protect to the vpc routing vpc
• on PTTP Tgw side:
  • [x] accepted the Transit Gateway attachment
  • [x] created a mod platform TGW routing table
  • [x] added routes to relevant TGW route tables for access to Nomis test
• [ ] amended Network ACLs on our end for Nomis test
• [ ] tested end to end connection

Reference

How to write good user stories

[donmasters]

updated Dod checklist with current progress, next steps are sign off on Mod Platform work, then ask pttp team to carry out tasks on their side

[donmasters]

Created a PR for changes to remote PTTP Transit Gateway

[donmasters]

PTTP configuration is now in place.

Next steps are to identify an endpoint and ensure NACLs and Security Groups are open, then complete a full end to end test.

[donmasters]

This ticket is now complete. Another ticket will be raised to carry out specific network testing and access configuration using NACLs and Security Groups.