Overview

Shield provides isolated networks for Cloud Platform applications. Subscriber deployments in an isolated network environment are separated from other subscriber deployments at the network level.

Benefits of using Shield¶

Shield combines the benefits of Cloud Platform-as-a-service with extra security benefits and capabilities, giving you a greater degree of isolation for your Cloud Platform instances.

Shield includes the following product features:

Shield access management: Provides self-service IP allowlisting for occasions when you must manage SSH access to the environments in your subscription. This feature is available only for Cloud Platform subscribers and not for Site Factory.
Private IP range with optional VPN connection: Adds an optional Virtual Private Network (VPN) hosted by Cloud Platform to connect between Cloud Platform and your private network. The VPN connection ensures you have secure bi-directional interaction between your websites and your internal IT systems (such as a CRM). Packaged in the price of Shield is the VPN configured to connect Cloud Platform with one subscriber-defined gateway device point. Added virtual private cloud (VPC) peering connections are available for a fee.
To enable the VPN, you must first buy a subscription to Cloud Platform.
If you change endpoints during the Subscription Term, you will incur added fees of $250 per hour of work. For Acquia to enable the VPN connection, you must meet the technical requirements described in the Amazon VPC FAQs.
AWS VPC Peering Connection: Enables a VPC peering connection between your Shield VPC and another AWS VPC. You can enable added VPC peering connections for a fee.

Using Shield¶

To use Shield, you must buy Shield with your Cloud Platform or Site Factory subscription. Acquia provisions your servers in your dedicated network.

Using Shield with VPN

Using Shield with VPC Peering

To use Shield with VPN, you must buy Shield with VPN and use it with your Cloud Platform or Site Factory subscription. To configure Shield with VPN:

Buy and deploy a VPN device.
Provide detailed information of your VPN device and network to Acquia.

Acquia provisions and configures a dedicated section for your applications. In addition, Acquia provides you the Internet Protocol Security (IPSec)/ Internet Key Exchange information so that you can properly configure your VPN.

For more information, visit:

Network information¶

For Acquia to configure Shield, you must provide Acquia with the following information:

Contact information for the members of your internal network team. This includes name, phone, and email.
VPN device details, including but not limited to:
- VPN device type (vendor and model)
- Gateway IP address of the subscriber VPN device
Confirm that your VPN device meets the requirements.
Network details, including but not limited to:
- A network diagram showing the systems where Shield must connect.
Maintenance plan or schedule for your network services and hardware
CIDR IP blocks
Note
Shield requires a private, non-routable /16 or /20 private address space conforming with RFC 1597. Shield can use private, non-routable /16 or /20 CIDR blocks from the 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges. Blocks of this size provide resources for Acquia-controlled servers (such as Elastic Load Balancers) and other elastic scaling needs, and also provide expansion space for your application’s future needs.
Subnet allocations
A list of networks requiring traffic statically routed to them
(Optional) A name for the Acquia VPN. If you have various VPNs, providing a name to Acquia may be useful for later communication.

For more information, contact your Acquia account manager.

VPN device requirements¶

To connect to Shield with VPN, your network must use a VPN (a secure Internet gateway) using IPsec. The gateway devices listed here are compatible with Shield with VPN. Other devices may work, but Acquia does not support them.

You must properly configure your network’s gateway to connect to Shield with VPN. After provisioning your dedicated section, Acquia will provide you with the configuration and VPN details containing the Pre-Shared Key (PSK) information you must use to properly configure your VPN. Using SSH, you will access the information stored in a secure location.

Shield uses Dead Peer Detection (DPD), exchanging UDP packets between VPN peers to ensure that both ends are available. If no traffic crosses the VPN tunnel in ten seconds, Shield sends a request. Three successive requests without a response will cause Shield to close the VPN tunnel.

Initiating your Shield tunnel¶

After Acquia provisions Shield and provides connection information to you, it’s your responsibility to configure your VPN device, establish the secure tunnel, and keep the network connection alive.

You must also confirm your secondary tunnel is configured properly in case your primary tunnel becomes unavailable. When properly configured, your gateway must fail over to the secondary tunnel in your Shield tunnel pair, if needed.

Changing your IP addresses¶

Moving an existing application hosted by Cloud Platform or Site Factory to Shield with VPN changes your IP address. You cannot move IP addresses into or out of a VPC. However, EIPs are retained if VPC provisioning is in the same region.

As a result, when you configure your application in Shield with VPN, you must point the DNS records of your application to the new IP address in the VPC. For more information, see Configuring DNS records for your application.

Watch our video for an overview of Acquia's Product Resources and Enablement

Benefits of using Shield

Shield combines the benefits of Cloud Platform-as-a-service with extra security benefits and capabilities, giving you a greater degree of isolation for your Cloud Platform instances.

Shield includes the following product features:

Shield access management: Provides self-service IP allowlisting for occasions when you must manage SSH access to the environments in your subscription. This feature is available only for Cloud Platform subscribers and not for Site Factory.

Private IP range with optional VPN connection: Adds an optional Virtual Private Network (VPN) hosted by Cloud Platform to connect between Cloud Platform and your private network. The VPN connection ensures you have secure bi-directional interaction between your websites and your internal IT systems (such as a CRM). Packaged in the price of Shield is the VPN configured to connect Cloud Platform with one subscriber-defined gateway device point. Added virtual private cloud (VPC) peering connections are available for a fee.

To enable the VPN, you must first buy a subscription to Cloud Platform.

If you change endpoints during the Subscription Term, you will incur added fees of $250 per hour of work. For Acquia to enable the VPN connection, you must meet the technical requirements described in the Amazon VPC FAQs.

AWS VPC Peering Connection: Enables a VPC peering connection between your Shield VPC and another AWS VPC. You can enable added VPC peering connections for a fee.

Using Shield

To use Shield, you must buy Shield with your Cloud Platform or Site Factory subscription. Acquia provisions your servers in your dedicated network.

Using Shield with VPN

Using Shield with VPC Peering

To use Shield with VPN, you must buy Shield with VPN and use it with your Cloud Platform or Site Factory subscription. To configure Shield with VPN:

Buy and deploy a VPN device.
Provide detailed information of your VPN device and network to Acquia.

For more information, visit:

Network information¶

For Acquia to configure Shield, you must provide Acquia with the following information:

Contact information for the members of your internal network team. This includes name, phone, and email.
VPN device details, including but not limited to:
- VPN device type (vendor and model)
- Gateway IP address of the subscriber VPN device
Confirm that your VPN device meets the requirements.
Network details, including but not limited to:
- A network diagram showing the systems where Shield must connect.
Maintenance plan or schedule for your network services and hardware
CIDR IP blocks
Note
Shield requires a private, non-routable /16 or /20 private address space conforming with RFC 1597. Shield can use private, non-routable /16 or /20 CIDR blocks from the 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges. Blocks of this size provide resources for Acquia-controlled servers (such as Elastic Load Balancers) and other elastic scaling needs, and also provide expansion space for your application’s future needs.
Subnet allocations
A list of networks requiring traffic statically routed to them
(Optional) A name for the Acquia VPN. If you have various VPNs, providing a name to Acquia may be useful for later communication.

For more information, contact your Acquia account manager.

VPN device requirements¶

Initiating your Shield tunnel

After Acquia provisions Shield and provides connection information to you, it’s your responsibility to configure your VPN device, establish the secure tunnel, and keep the network connection alive.

Changing your IP addresses

Watch our video for an overview of Acquia's Product Resources and Enablement

Company

Partners

Support

Benefits of using Shield¶

Using Shield¶

Using Shield with VPN

Using Shield with VPC Peering

Network information¶

VPN device requirements¶

Initiating your Shield tunnel¶

Changing your IP addresses¶

Did not find what you were looking for?

Benefits of using Shield¶

Using Shield¶

Using Shield with VPN

Using Shield with VPC Peering

Network information¶

VPN device requirements¶

Initiating your Shield tunnel¶

Changing your IP addresses¶

Did not find what you were looking for?

Loading...

Company

Partners

Support

Loading...

Benefits of using Shield¶

Using Shield¶

Using Shield with VPN

Using Shield with VPC Peering

Network information¶

VPN device requirements¶

Initiating your Shield tunnel¶

Changing your IP addresses¶

Did not find what you were looking for?

Overview

Benefits of using Shield¶

Using Shield¶

Using Shield with VPN

Using Shield with VPC Peering

Network information¶

VPN device requirements¶

Initiating your Shield tunnel¶

Changing your IP addresses¶

Did not find what you were looking for?