How to troubleshoot AWS Direct Connect SiteLink connectivity issues

Short description

AWS Direct Connect SiteLink is an optional feature that enables direct connectivity between any two Direct Connect points of presence (PoPs) in the same AWS partition using the shortest available path over the AWS network. This allows you to connect your on-premises networks without routing traffic through an AWS Region.

If you're experiencing connectivity issues with SiteLink-enabled virtual interfaces, use the troubleshooting steps below.

Note: For general Direct Connect troubleshooting (Layer 1/2/3), see Troubleshoot AWS Direct Connect.

---

Resolution

1. Verify SiteLink prerequisites and configuration

AWS side

1. Confirm SiteLink is enabled on all participating virtual interfaces. In the Direct Connect console, select each virtual interface and verify SiteLink shows as Enabled.

2. Verify supported virtual interface types. SiteLink is only supported on:

Virtual interface type	Supported
Transit virtual interface	Yes
Private VIF attached to a Direct Connect gateway (with VGW association)	Yes
Private VIF attached to a Direct Connect gateway (no VGW/TGW association)	Yes
Private VIF attached directly to a virtual private gateway	No
Public virtual interface	No

3. Confirm all VIFs are on the same Direct Connect gateway (DXGW). SiteLink-enabled VIFs must share the same DXGW to communicate.

4. Verify VIF state and BGP status. The virtual interface state must be available and BGP status must be up.

5. Confirm AWS region. SiteLink is not available in AWS GovCloud (US) or China Regions. For more information, see SiteLink.

Customer device side

Note: The CLI commands shown below are based on Cisco IOS. Actual commands may vary depending on your router vendor, operating system, and software version. Refer to your device documentation for equivalent commands.

1. Verify BGP session is Established:

show bgp neighbors <Amazon_peer_IP>

2. Verify prefix advertisement and receipt:

show bgp neighbor <Amazon_peer_IP> advertised-routes 
show bgp neighbor <Amazon_peer_IP> received-routes

---

2. Troubleshoot routing issues

AWS side

1. Check CloudWatch metrics for each virtual interface:

   • VirtualInterfaceBgpPrefixesAccepted - If 0, AWS is not accepting routes from your device.
   • VirtualInterfaceBgpPrefixesAdvertised - Should include routes from other SiteLink-enabled VIFs on the same DXGW.
   • VirtualInterfaceBgpStatus - Value 1 means up.

2. Check for duplicate route advertisements. SiteLink does not work if an on-premises router advertises the same route to AWS on multiple virtual interfaces. Each site must advertise unique prefixes, or use AS_PATH prepending to differentiate.

3. Check prefix limits. Private VIFs and transit VIFs support a maximum of 100 routes per BGP session (each for IPv4 and IPv6). SiteLink also has a separate 100 prefix limit. Exceeding this causes the BGP session to go into an idle state. For more information, see Direct Connect quotas.

Customer device side

Note: The CLI commands shown below are based on Cisco IOS. Actual commands may vary depending on your router vendor, operating system, and software version. Refer to your device documentation for equivalent commands.

1. Verify remote site prefixes are received:

show ip bgp neighbors <Amazon_peer_IP> received-routes

If remote site prefixes are missing:

• Confirm the remote site router is advertising its prefixes to AWS.
• Confirm SiteLink is enabled on both VIFs.
• Confirm both VIFs are on the same DXGW.

2. Check AS_PATH. The DXGW updates AS_PATH and NextHop when re-advertising between SiteLink VIFs. Expected AS_PATH includes:

   • Amazon-side ASN of the DXGW
   • Remote site's customer ASN

3. Verify routing table:

show ip route <remote_site_prefix>

---

3. Troubleshoot traffic flow issues

AWS side

1. Monitor traffic metrics in CloudWatch:

   • VirtualInterfaceBpsEgress / VirtualInterfaceBpsIngress
   • VirtualInterfacePpsEgress / VirtualInterfacePpsIngress

2. Check physical connection state:

   • ConnectionState - 1 means up, 0 means down
   • ConnectionErrorCount - High values indicate physical layer issues (CRC errors, etc.)

Customer device side

Note: The CLI commands shown below are based on Cisco IOS. Actual commands may vary depending on your router vendor, operating system, and software version. Refer to your device documentation for equivalent commands.

1. Verify MTU configuration. SiteLink supports jumbo frames:

   • Transit VIF: max 8500 bytes
   • Private VIF: max 9001 bytes

   Test with a packet size close to your configured MTU (subtract 28 bytes for IP/ICMP headers):

ping <remote_site_IP> size 8000 df-bit

If large packets fail but small packets succeed, check MTU on all devices in the path.

2. Check ACLs and firewall rules. Ensure no rules block traffic to or from the remote site prefixes.

3. Verify VLAN tagging. The 802.1Q VLAN ID must match the AWS console configuration.

---

4. Understand SiteLink routing behavior differences

• AS_PATH preference: With SiteLink enabled, AWS prefers the path with the shortest AS_PATH regardless of the associated Region. Without SiteLink, the path from the Region-local Direct Connect location is preferred. For more information, see SiteLink.

• SiteLink-disabled VIF prefixes: Prefixes from a SiteLink-disabled VIF are advertised only to gateway associations (VGWs/TGWs), not to other SiteLink-enabled VIFs.

• Same route on multiple VIFs: If the same prefix is advertised on multiple VIFs, SiteLink cannot determine the correct path. Ensure unique prefixes per location. For more information, see SiteLink.

---

5. When to contact AWS Support

If the above steps do not resolve your issue, open a support case with:

• Connection IDs and Virtual Interface IDs
• Direct Connect gateway ID
• BGP session status and routing table output
• CloudWatch metrics for the affected timeframe
• Network topology diagram (if available)
• Description of expected vs actual behavior

---

Related information

• AWS Direct Connect Virtual Interfaces - SiteLink
• Introducing AWS Direct Connect SiteLink (Blog)
• Monitoring Direct Connect with CloudWatch
• Troubleshoot AWS Direct Connect