Applies toAWS Site-to-Site VPN (virtual private gateway or Transit Gateway), customer gateway devices
1. Tunnel status
aws ec2 describe-vpn-connections --vpn-connection-ids vpn-0abc \
--query "VpnConnections[].VgwTelemetry[].{ip:OutsideIpAddress,status:Status,msg:StatusMessage,routes:AcceptedRouteCount,changed:LastStatusChange}" --output table
DOWNwithIPSEC IS DOWN→ phase 1 or phase 2 negotiation is failing.UPbutAcceptedRouteCount: 0→ BGP is up without routes, or BGP itself is down (dynamic VPN).- Status flips every few minutes → DPD or rekey problems.
2. Turn on tunnel logs
Enable Site-to-Site VPN logs to CloudWatch Logs on each tunnel's options. They show IKE and IPsec negotiation messages:
| Log message mentions | Cause |
|---|---|
No proposal chosen | Encryption, integrity, DH group or IKE version mismatch |
AUTHENTICATION_FAILED | Pre-shared key mismatch |
Peer is not responding / DPD timeout | Customer gateway unreachable, UDP 500/4500 blocked, or NAT-T issues |
TS_UNACCEPTABLE | Traffic selector (local/remote network) mismatch |
3. Compare configuration
Download the vendor-specific configuration from the console (Download configuration) and compare it line by line with the device. Key points:
- Both tunnels are configured on the device. AWS maintenance moves traffic between tunnels.
- IKE version and phase 1/2 algorithms are within what the tunnel options allow.
- Pre-shared keys match exactly.
- The customer gateway's public IP matches the CGW resource. If it's behind NAT, NAT-T (UDP 4500) must be allowed.
- For a policy-based device, use one security association (
0.0.0.0/0 ↔ 0.0.0.0/0) or carefully matched selectors. Multiple SAs are a common cause of flapping.
4. Flapping tunnels
- Set DPD timeout action and the device's DPD so they agree. Aggressive DPD on a lossy link drops the tunnel.
- Have the customer gateway start negotiation (
startup action: startin tunnel options), so a quiet tunnel isn't left down. - Keep traffic flowing, or use the AWS keepalive behavior: idle tunnels can go down if the device doesn't rekey.
5. Up but no traffic
- Static VPN: the static routes on the VPN connection cover the on-premises prefixes.
- BGP: the device advertises the prefixes, and
AcceptedRouteCountis above 0. - VPC route tables have route propagation turned on from the VGW, or TGW route tables have the attachment propagated.
- Security groups and NACLs allow the on-premises CIDRs.
- On-premises firewalls allow the VPC CIDRs back.
Prevent it next time
- Alarm on the
TunnelStatemetric (0 = down) per tunnel, not only on the connection. - Use BGP with both tunnels active, or Transit Gateway with ECMP, for resilience.