AWSTemplateFormatVersion: '2010-09-09'
Description: >
  EG334S VPN #1 route-based IKEv2/BGP connection. Deploy in eu-west-1 only.
  This stack reuses the Ireland VGW and creates the dynamic customer gateway
  and dual-tunnel connection. It creates no static VPN routes.

Parameters:
  ExistingVpnGatewayId:
    Type: String
    AllowedPattern: '^vgw-[0-9a-f]+$'
    Description: Existing Ireland virtual private gateway (AWS ASN 64512).

  VirginiaCustomerGatewayIp:
    Type: String
    AllowedPattern: '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$'
    Description: Elastic IP of the Virginia strongSwan router.

  VirginiaCustomerAsn:
    Type: Number
    Default: 65000
    MinValue: 1
    MaxValue: 4294967294
    Description: Private BGP ASN used by the Virginia strongSwan router.

Resources:
  ParallelCustomerGateway:
    Type: AWS::EC2::CustomerGateway
    Properties:
      Type: ipsec.1
      IpAddress: !Ref VirginiaCustomerGatewayIp
      BgpAsn: !Ref VirginiaCustomerAsn
      DeviceName: eg334s-team2-strongswan-bgp
      Tags:
        - { Key: Name, Value: eg334s-team2-onprem-cgw-bgp-parallel }
        - { Key: Project, Value: EG334S }
        - { Key: Environment, Value: SCHOOL-DEMO }
        - { Key: ManagedBy, Value: CloudFormation }
        - { Key: RoutingMode, Value: Dynamic-BGP }

  BgpVpnConnection:
    Type: AWS::EC2::VPNConnection
    Properties:
      Type: ipsec.1
      StaticRoutesOnly: false
      CustomerGatewayId: !Ref ParallelCustomerGateway
      VpnGatewayId: !Ref ExistingVpnGatewayId
      # Route-based BGP requires the tunnel-inside 169.254/30 neighbors to be
      # protected as well as the advertised VPC prefixes. Prefix control is
      # enforced by BGP route maps on strongSwan, not by narrow phase-2 TS.
      LocalIpv4NetworkCidr: 0.0.0.0/0
      RemoteIpv4NetworkCidr: 0.0.0.0/0
      VpnTunnelOptionsSpecifications:
        - IKEVersions:
            - Value: ikev2
          Phase1EncryptionAlgorithms:
            - Value: AES256
          Phase1IntegrityAlgorithms:
            - Value: SHA2-256
          Phase1DHGroupNumbers:
            - Value: 14
          Phase2EncryptionAlgorithms:
            - Value: AES256
          Phase2IntegrityAlgorithms:
            - Value: SHA2-256
          Phase2DHGroupNumbers:
            - Value: 14
          DPDTimeoutSeconds: 30
          DPDTimeoutAction: restart
          StartupAction: start
          RekeyMarginTimeSeconds: 270
          ReplayWindowSize: 1024
        - IKEVersions:
            - Value: ikev2
          Phase1EncryptionAlgorithms:
            - Value: AES256
          Phase1IntegrityAlgorithms:
            - Value: SHA2-256
          Phase1DHGroupNumbers:
            - Value: 14
          Phase2EncryptionAlgorithms:
            - Value: AES256
          Phase2IntegrityAlgorithms:
            - Value: SHA2-256
          Phase2DHGroupNumbers:
            - Value: 14
          DPDTimeoutSeconds: 30
          DPDTimeoutAction: restart
          StartupAction: start
          RekeyMarginTimeSeconds: 270
          ReplayWindowSize: 1024
      Tags:
        - { Key: Name, Value: eg334s-team2-vpn1-bgp-parallel }
        - { Key: Project, Value: EG334S }
        - { Key: Environment, Value: SCHOOL-DEMO }
        - { Key: ManagedBy, Value: CloudFormation }
        - { Key: RoutingMode, Value: Dynamic-BGP }

Outputs:
  ParallelCustomerGatewayId:
    Description: Logical customer gateway for the parallel BGP connection.
    Value: !Ref ParallelCustomerGateway

  BgpVpnConnectionId:
    Description: Parallel dynamic-routing VPN #1 connection identifier.
    Value: !Ref BgpVpnConnection

  VirginiaCustomerAsn:
    Value: !Ref VirginiaCustomerAsn

  IrelandAwsAsn:
    Value: '64512'