How do I troubleshoot issues with traffic routing over Site-to-Site VPN?

Resolution

The following issues cause traffic routing errors over Site-to-Site VPN:

• An incorrectly configured route table
• Dynamic routing errors
• Static routing errors
• An incorrect configuration between AWS and your on-premises device
• An intermittent or unstable VPN connection
• Traffic that isn't routed or doesn't reach its destination
• Your Site-to-Site VPN exceeded a quota

Download the example configuration file that corresponds with your gateway device and use the file to troubleshoot routing issues.

Make sure that the customer gateway device's firewall policy allows traffic between AWS and your on-premises device.

Troubleshoot incorrectly configured route tables

On the AWS Transit Gateway route tables or Amazon Virtual Private Cloud (Amazon VPC) route tables, check that the on-premises prefixes match the VPN connection's gateway type.

If you use a Transit Gateway, then check that you associated the Transit Gateway route table with the traffic source and the Site-to-Site VPN attachment. The Transit Gateway route table must contain routes for the on-premises prefixes that point towards the Site-to-Site VPN connection and the Amazon VPC attachment.

Troubleshoot dynamic routing errors

If the connection uses dynamic routing, then complete the steps in the To enable tunnel BGP logging on an existing Site-to-Site VPN connection section of Enable AWS Site-to-Site VPN logs. Then, use your BGP logs findings to troubleshoot errors with Site-to-Site VPN tunnels.

To troubleshoot dynamic routing errors, check the following configurations:

• Check that the customer gateway advertises the on-premises prefixes from the Border Gateway Protocol (BGP) session on the Site-to-Site VPN tunnel.
• Check that the route maps on the customer gateway device allow the on-premises prefixes that the BGP session advertises.
• Check that the connection prioritizes AWS Direct Connect routes over the Site-to-Site VPN routes.

If you correctly set up the preceding configurations but the BGP still fails, then troubleshoot your BGP connection over Site-to-Site VPN.

Troubleshoot static routing errors

If the connection uses a Virtual Private Gateway, then check that the Site-to-Site VPN connection includes a static route for the on-premises network.

Make sure that the customer gateway has static routes for the Amazon VPC CIDR block that point to the correct virtual tunnel interface.

If you use an accelerated Site-to-Site VPN connection, then check that you activated NAT-traversal (NAT-T) on the customer gateway device. For instructions, see the Verify NAT-traversal activation on the customer gateway device section of How can I troubleshoot issues with my accelerated Site-to-Site VPN connection?

If you use a route-based VPN that's configured for static routing, then avoid asymmetric routing.

Use one of the following methods to activate Amazon VPC Flow Logs on the destination:

• Publish flow logs to CloudWatch Logs
• Publish flow logs to Amazon S3
• Publish flow logs to Amazon Data Firehose

Then, in your VPC Flow Logs, check that the destination receives traffic.

Troubleshoot incorrect configurations between AWS and your on-premises device

Check that you correctly configured the routes to and from AWS and your on-premises device.

If there's a policy-based VPN on the customer gateway side, then check the following configurations:

• Check that the local IPv4 network CIDR and remote IPv4 network CIDR tunnel options on AWS and your on-premises device match.
• Check that the encryption domain includes the necessary traffic.

Use Amazon CloudWatch to monitor the TunnelDataIn and TunnelDataOut tunnel metrics.

Troubleshoot intermittent or unstable VPN connections

AWS limits the number of security associations (SAs) to a single pair for inbound and outbound SAs. If the VPN connection requires multiple networks, then summarize the local and remote CIDR on the VPN connections to use one SA.

If the status of both tunnels is Active, then check that the customer gateway device supports asymmetric routing.

Troubleshoot traffic that isn't routed or doesn't reach its destination

Check that the VPC security group and subnet network access control list (network ACL) of the VPC allow the necessary traffic.

If the connection uses a Transit Gateway, then check that the Transit Gateway attachment's subnet network ACLs allow the necessary traffic. Use Transit Gateways flow logs to check that the traffic routes correctly. Avoid asymmetric routing and return traffic issues.

Troubleshoot a VPN that reaches its Virtual Private Gateway quota

If you use a Virtual Private Gateway, then be sure not to exceed the following default quotas:

• 5 Virtual private gateways per AWS Region
• 10 Site-to-Site VPN connections per virtual private gateway
• 50 Site-to-Site VPN connections per Region

If you exceed one of the proceeding quotas, then you can't create more VPN connections or Virtual Private Gateways. For a full list of Site-to-Site VPN quotas, see AWS Site-to-Site VPN quotas.

Note: You can attach only one Virtual Private Gateway to a VPC at a time.

The following error messages show that you exceeded your quota:

• "The maximum number of virtual private gateways has been reached"
• "The maximum number of vpnConnections has been reached (errorCode: Client.VpnConnectionLimitExceeded)"

If you receive one of the preceding error messages, then complete the following steps:

1. Check your current quota usage in the Service Quotas console.
2. Under Amazon EC2, review your Virtual private gateways per region and VPN connections per VGW quotas.
3. If you need more connections or gateways, request a quota increase.

If your architecture requires more VPN connections than the Virtual Private Gateway quota allows, then migrate to a Transit Gateway. Transit Gateways support up to 5,000 attachments, including VPC and VPN attachments. Transit Gateways aren't subject to the VPN connections for each Virtual Private Gateway limitation. You don't need to delete your VPN connections when you migrate from a Virtual Private Gateway to a Transit Gateway. For more information, see Modify a Site-to-Site VPN connection's target gateway.

Note: Accelerated and Unassociated connections count towards the total Site-to-Site VPN connections for each Region quota. However, Site-to-Site VPN connections on Transit Gateways count towards the total Transit Gateway attachments quota.

Related information

How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?

AWS Site-to-Site VPN customer gateway devices

Transit gateway flow logs records in Amazon CloudWatch Logs