Shield provides isolated networks for Cloud Platform applications. Subscriber deployments in an isolated network environment are separated from other subscriber deployments at the network level.
Shield combines the benefits of Cloud Platform-as-a-service with extra security benefits and capabilities, giving you a greater degree of isolation for your Cloud Platform instances.
Shield includes the following product features:
Private IP range with optional VPN connection: Adds an optional Virtual Private Network (VPN) hosted by Cloud Platform to connect between Cloud Platform and your private network. The VPN connection ensures you have secure bi-directional interaction between your websites and your internal IT systems (such as a CRM). Packaged in the price of Shield is the VPN configured to connect Cloud Platform with one subscriber-defined gateway device point. Added virtual private cloud (VPC) peering connections are available for a fee.
To enable the VPN, you must first buy a subscription to Cloud Platform.
If you change endpoints during the Subscription Term, you will incur added fees of $250 per hour of work. For Acquia to enable the VPN connection, you must meet the technical requirements described in the Amazon VPC FAQs.
Shield and internal DNS
Currently, Shield does not support resolution to your internal DNS servers. While Shield gives you access to your internal network through a VPN gateway, your network systems are only accessible through IP. Therefore, if you have a service or site in your internal network that changes IP addresses and resolves to an internal-only DNS, the system does not resolve the domain for that service or site.
Shared Services
While Acquia Shield provides network isolation for your production and non-production servers and environments, Cloud Platform shared services are not hosted in your Shield VPC. This includes, but is not limited to:
Git, which is your code repository
Acquia Search
CD and IDE environments
Any SaaS offerings
To use Shield, you must buy Shield with your Cloud Platform or Site Factory subscription. Acquia provisions your servers in your dedicated network.
To use Shield with VPN, you must buy Shield with VPN and use it with your Cloud Platform or Site Factory subscription. To configure Shield with VPN:
Acquia provisions and configures a dedicated section for your applications. In addition, Acquia provides you the Internet Protocol Security (IPSec)/ Internet Key Exchange information so that you can properly configure your VPN.
Shield supports Internet Key Exchange version 1 (IKEv1) and Internet Key Exchange version 2 (IKEv2).
For more information, visit:
For Acquia to configure Shield, you must provide Acquia with the following information:
VPN device details, including but not limited to:
Confirm that your VPN device meets the requirements.
Shield requires a private, non-routable /16 or /20 private address space conforming with RFC 1597. Shield can use private, non-routable /16 or /20 CIDR blocks from the 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges. Blocks of this size provide resources for Acquia-controlled servers (such as Elastic Load Balancers) and other elastic scaling needs, and also provide expansion space for your application’s future needs.
For more information, contact your Acquia account manager.
After Acquia provisions Shield and provides connection information to you, it’s your responsibility to configure your VPN device, establish the secure tunnel, and keep the network connection alive.
You must also confirm your secondary tunnel is configured properly in case your primary tunnel becomes unavailable. When properly configured, your gateway must fail over to the secondary tunnel in your Shield tunnel pair, if needed.
Moving an existing application hosted by Cloud Platform or Site Factory to Shield with VPN changes your IP address. You cannot move IP addresses into or out of a VPC. However, EIPs are retained if VPC provisioning is in the same region.
As a result, when you configure your application in Shield with VPN, you must point the DNS records of your application to the new IP address in the VPC. For more information, see Configuring DNS records for your application.
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Shield provides isolated networks for Cloud Platform applications. Subscriber deployments in an isolated network environment are separated from other subscriber deployments at the network level.
Shield combines the benefits of Cloud Platform-as-a-service with extra security benefits and capabilities, giving you a greater degree of isolation for your Cloud Platform instances.
Shield includes the following product features:
Private IP range with optional VPN connection: Adds an optional Virtual Private Network (VPN) hosted by Cloud Platform to connect between Cloud Platform and your private network. The VPN connection ensures you have secure bi-directional interaction between your websites and your internal IT systems (such as a CRM). Packaged in the price of Shield is the VPN configured to connect Cloud Platform with one subscriber-defined gateway device point. Added virtual private cloud (VPC) peering connections are available for a fee.
To enable the VPN, you must first buy a subscription to Cloud Platform.
If you change endpoints during the Subscription Term, you will incur added fees of $250 per hour of work. For Acquia to enable the VPN connection, you must meet the technical requirements described in the Amazon VPC FAQs.
Shield and internal DNS
Currently, Shield does not support resolution to your internal DNS servers. While Shield gives you access to your internal network through a VPN gateway, your network systems are only accessible through IP. Therefore, if you have a service or site in your internal network that changes IP addresses and resolves to an internal-only DNS, the system does not resolve the domain for that service or site.
Shared Services
While Acquia Shield provides network isolation for your production and non-production servers and environments, Cloud Platform shared services are not hosted in your Shield VPC. This includes, but is not limited to:
Git, which is your code repository
Acquia Search
CD and IDE environments
Any SaaS offerings
To use Shield, you must buy Shield with your Cloud Platform or Site Factory subscription. Acquia provisions your servers in your dedicated network.
To use Shield with VPN, you must buy Shield with VPN and use it with your Cloud Platform or Site Factory subscription. To configure Shield with VPN:
Acquia provisions and configures a dedicated section for your applications. In addition, Acquia provides you the Internet Protocol Security (IPSec)/ Internet Key Exchange information so that you can properly configure your VPN.
Shield supports Internet Key Exchange version 1 (IKEv1) and Internet Key Exchange version 2 (IKEv2).
For more information, visit:
For Acquia to configure Shield, you must provide Acquia with the following information:
VPN device details, including but not limited to:
Confirm that your VPN device meets the requirements.
Shield requires a private, non-routable /16 or /20 private address space conforming with RFC 1597. Shield can use private, non-routable /16 or /20 CIDR blocks from the 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges. Blocks of this size provide resources for Acquia-controlled servers (such as Elastic Load Balancers) and other elastic scaling needs, and also provide expansion space for your application’s future needs.
For more information, contact your Acquia account manager.
After Acquia provisions Shield and provides connection information to you, it’s your responsibility to configure your VPN device, establish the secure tunnel, and keep the network connection alive.
You must also confirm your secondary tunnel is configured properly in case your primary tunnel becomes unavailable. When properly configured, your gateway must fail over to the secondary tunnel in your Shield tunnel pair, if needed.
Moving an existing application hosted by Cloud Platform or Site Factory to Shield with VPN changes your IP address. You cannot move IP addresses into or out of a VPC. However, EIPs are retained if VPC provisioning is in the same region.
As a result, when you configure your application in Shield with VPN, you must point the DNS records of your application to the new IP address in the VPC. For more information, see Configuring DNS records for your application.
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Shield