Automate VPN BGP Troubleshooting with AWS DevOps Agent

Overview

VPN BGP Logging gives you real-time visibility into BGP state transitions on the AWS side. By combining it with AWS DevOps Agent, you can automate the analysis entirely: the agent reads your BGP logs from CloudWatch, identifies what happened, and recommends next steps through natural language.

This article walks through the setup and shows the results.

---

Step 1: Enable BGP Logging on your VPN tunnel

1.1 Create a CloudWatch Log Group

Create a CloudWatch Logs log group to store your BGP logs (e.g., /aws/vpn/bgp-logs).

1.2 Enable BGP Logging

1. Open the Amazon VPC console.
2. In the navigation pane, choose VPN connections, then select your VPN connection.
3. Choose Actions, then choose Modify VPN tunnel options.
4. Select the VPN tunnel outside IP address for the tunnel you want to modify.
5. Select Confirm modification of a currently UP tunnel.
6. Scroll down to Tunnel BGP log and select Enable:
   • Select Enable
   • For Destination, choose Send to CloudWatch logs
   • For Amazon CloudWatch log group, select your log group
   • For Output format, choose JSON
7. Choose Save changes.

Note: The tunnel goes down temporarily (typically 1–2 minutes) during modification.

1.3 Verify logs in CloudWatch

After the tunnel recovers, open the CloudWatch console. In the navigation pane, expand Logs, choose Log Management, then choose Log groups. Select your log group and confirm that a log stream named {vpn-id}-{tunnel-outside-ip}-BGP.log has been created.

The following are examples of BGP log entries you might see:

BGP session down (reconnect attempt):

{
  "resource_id": "vpn-0a1b2c3d4e5f67890_52.10.20.30",
  "event_timestamp": 1785544668374,
  "timestamp": "2026-08-01 00:37:48.374Z",
  "type": "BGPStatus",
  "status": "DOWN",
  "message": {
    "details": "AWS-side peer is initiating a connection (via Connect) to neighbor 169.254.100.2"
  }
}

BGP session established:

{
  "resource_id": "vpn-0a1b2c3d4e5f67890_52.10.20.30",
  "event_timestamp": 1785545268385,
  "timestamp": "2026-08-01 00:47:48.385Z",
  "type": "BGPStatus",
  "status": "UP",
  "message": {
    "details": "AWS-side peer BGP session state has changed from OpenConfirm to Established with neighbor 169.254.100.2"
  }
}

---

Step 2: Set up AWS DevOps Agent

1. Open the AWS DevOps Agent console.
2. Choose Create Agent Space.
3. In the Agent Space details section, enter a name in the Agent Space Name field.
4. In the Give this Agent Space AWS resource access section, choose a role configuration method and configure an IAM role that grants the Agent Space access to resources in your account. For details, see Creating an Agent Space.
5. In the Enable web app section, choose a role configuration method and configure an IAM role for web app access. For details, see DevOps Agent IAM Permissions.
6. Choose Create.
7. After "Agent Space created successfully" appears, choose Launch web app (upper right), then choose Launch via IAM.

---

Step 3: Analyze BGP logs with DevOps Agent

In the Web App chat, ask a question in natural language. For example:

Check the CloudWatch log group /aws/vpn/bgp-logs for any BGP session
issues on VPN connection vpn-0a1b2c3d4e5f67890. Analyze the recent BGP log events
and tell me the current BGP session status.

The agent reads your CloudWatch logs and provides a structured diagnosis:

What Happened (from the agent):

The BGP session was in Idle state at 00:37:48 UTC, with AWS repeatedly attempting to reconnect every ~2 minutes for about 10 minutes. On the 6th attempt at 00:47:48 UTC, the TCP connection was accepted and the full BGP handshake completed in under 15ms: Idle → Connect → OpenSent → OpenConfirm → Established

Recommended Next Steps (from the agent):

1. Find the drop cause — Check earlier BGP logs (before 00:37 UTC) or CloudTrail for VPN/route table changes around that time.
2. Review the holdtime mismatch — A 30s hold timer on the AWS side means a missed keepalive can drop the session quickly. Consider aligning both sides.
3. Verify second tunnel — Check whether the VPN connection has a second tunnel configured and whether its BGP session is healthy.

---

Conclusion

Combining BGP Logging with DevOps Agent enables:

• Instant awareness of BGP session drops
• Root cause analysis without manual log parsing
• Specific, actionable next steps
• Self-service resolution for common BGP issues

---

Related information

• Enable VPN Tunnel Logging
• AWS DevOps Agent - Getting Started
• Creating an Agent Space (IAM Role Configuration)
• AWS DevOps Agent - Supported Regions
• DevOps Agent IAM Permissions