3

Apologies if this isn't the place.

I have an AWS VPC VPN issue whereby I am getting a notification in the site-to-site VPN tab under VPC stating that I have new non-redundant VPN connections (please see attached image).

The reason I am confused is that we only have one VPN connection defined with 2 redundant tunnels as set up by default. The primary link is up and has been for quite a while whilst the secondary one is down and hasn't been initialised since 2016 (when it was created) - as I understand this is expected behaviour of the AWS VPC VPN setup.

I guess what I am asking is - is this notification normal? is this a bug? and has AWS got any logs I can access to figure out if any issues are present?

Any help is much appreciated and thank you in advance for your time.

enter image description here

  • 2
    You can ignore it. You're tunnel is redundant if you're using a device that supports having a fail-over peer defined (such as a Cisco ASA). The reason it's giving you that warning is because both peer IPs are not up simultaneously, which some other types of devices support. I have no idea why AWS only just began giving that warning and never did in the past. – Jesse P. Feb 11 at 14:19
  • Thank you so much for this! I can breathe a sigh of relief at last! :) It's only because AWS are doing work to some infrastructure affecting one of our VPN peers tomorrow that I have been urgently trying to make sure all is OK before they do as I don't want any downtime. Then I saw this notification and panic stations set in. – CrazyHorse019 Feb 11 at 14:24
  • 2
    Sure. If you're using devices in an Active/Standby setup, only one of those tunnels will be up at any time. If you're using Active/Active, you COULD configure them to both be up at the same time. – Jesse P. Feb 11 at 14:26
  • 2
    Either way, if AWS takes one peer down the other will come up. – Jesse P. Feb 11 at 14:27
  • AWS takes peers down for maintenance all the time but they have a promise that they will never take down both peers at the same time, so they won't break your tunnels. – Jesse P. Feb 11 at 14:28
3

Converting the above comments to an Answer so it can be marked.

You can ignore it. Your tunnel is redundant if you're using a device that supports having a fail-over peer defined (such as a Cisco ASA). The reason it's giving you that warning is because both peer IPs are not up simultaneously, which some devices support (such as Cisco ASAs running in Active/Active mode).

If you're using devices in an Active/Standby setup, only one of those tunnels will be up at any time. If you're using Active/Active, you COULD configure them to both be up at the same time. If AWS takes one peer down, the other will come up. AWS takes peers down for maintenance all the time but they have a promise that they will never take down both peers at the same time, so they won't break your tunnels.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.