Home / AWS

AWSRunbookAdvanced

Sev1: AWS Direct Connect down — connection, virtual interface and BGP checks

Troubleshoot a Direct Connect outage from the physical connection up through the virtual interface, BGP session, advertised prefixes and the Direct Connect or transit gateway, and confirm VPN failover works.

Deepak Bhardwaj2 min read

Applies toAWS Direct Connect (dedicated and hosted), private and transit virtual interfaces, Direct Connect gateway, Transit Gateway

Symptoms

  • On-premises to VPC traffic fails, or moves to the backup VPN with higher latency.
  • CloudWatch ConnectionState = 0 or VirtualInterfaceBgpStatus down.

1. Connection layer

aws directconnect describe-connections \
  --query "connections[].{id:connectionId, name:connectionName, state:connectionState, loc:location, bw:bandwidth}" --output table
connectionState Meaning
available Physical/logical link up
down Layer 1/2 problem: cross-connect, optics, provider circuit
ordering / requested / pending Not provisioned yet (hosted connections need acceptance)
deleted / rejected Someone removed it or didn't accept

down → check your router interface, light levels on the optics, and open a case with your colocation/provider. AWS Health may show maintenance at the location.

2. Virtual interface and BGP

aws directconnect describe-virtual-interfaces \
  --query "virtualInterfaces[].{vif:virtualInterfaceId, type:virtualInterfaceType, state:virtualInterfaceState, vlan:vlan, asn:asn, bgp:bgpPeers[].bgpStatus}" --output table
Finding Check
VIF down, connection available VLAN tag mismatch on your router
BGP down Peer IPs, your ASN, MD5 auth key, TCP 179 not filtered
BGP up, no traffic Advertised prefixes, route propagation, prefix limits 
aws directconnect describe-virtual-interfaces --virtual-interface-id dxvif-abc123 \
  --query "virtualInterfaces[0].{amazonAddress:amazonAddress, customerAddress:customerAddress, authKey:authKey, routeFilterPrefixes:routeFilterPrefixes}"

Compare with your router config. A changed MD5 key on one side is a classic cause after maintenance.

3. Prefix limits

If you advertise more prefixes than the virtual interface allows, the BGP session goes down (idle). Check the current Direct Connect quotas for routes per BGP session on private and transit VIFs, count what you advertise, and summarise.

router# show ip bgp neighbors 169.254.10.1 advertised-routes | count

4. Gateway and VPC routing

aws directconnect describe-direct-connect-gateway-attachments --direct-connect-gateway-id <dxgw-id> --output table
aws ec2 describe-route-tables --filters Name=vpc-id,Values=vpc-0123 \
  --query "RouteTables[].Routes[?GatewayId!='local'].[DestinationCidrBlock,GatewayId,TransitGatewayId,State,Origin]" --output table
  • VGW route propagation must be enabled on VPC route tables (private VIF via VGW).
  • For a transit VIF, check the Transit Gateway route table has the on-prem prefixes and the allowed prefixes on the DX gateway association include your VPC CIDRs.

5. Failover

With a second connection at another location, check both BGP sessions and that your router prefers the healthy one. With a VPN backup, AWS prefers Direct Connect routes over VPN for the same prefix; when DX is down, confirm VPN tunnels are UP and that more specific routes aren't still pointing at the dead path.

aws ec2 describe-vpn-connections --query "VpnConnections[].VgwTelemetry[].[OutsideIpAddress,Status,StatusMessage]" --output table

Prevent it next time

  • Two connections at two locations for critical workloads (the AWS resiliency recommendations).
  • CloudWatch alarms on ConnectionState and VirtualInterfaceBgpStatus.
  • Use BFD for faster failover and test failover twice a year.

Related fixes