Constant Tunnel endpoint replacement notification notifications - ca-central-1

Question

Starting on June 10th we began receiving VPC tunnel endpoint replacement notifications every 4 hours, for the last 5 days we receive a notification that "ca-central-1 Region had a momentary lapse of redundancy as one of two tunnel endpoints was replaced.". I don't see any open maintenance notices for this region, yet every 4 hours we receive another notification.

I do see in my firewall logs that the primary IPSEC connection to our VPC is indeed going down about 2/3 times each day per firewall, the secondary tunnel is remaining up. I'm curious as to why no maintenance notification has been published given that this has been going on for 5 days now, we'd love to know when the maintenance will be completed.

Answer

Hello,

I suggest opening case with Support to check why that particular Tunnel is bouncing. It is possible that there was a version upgrade and/or there is an underlying issue with the VPN tunnel endpoint.

Please note AWS Site-to-Site VPN is a managed service, and periodically applies updates to your VPN tunnel endpoints. These updates happen for a variety of reasons, such as:

* To apply general upgrades, such as a patches, resiliency improvements, and other enhancements

* To retire underlying hardware

* When automated monitoring determines that a VPN tunnel endpoint is unhealthy

https://docs.aws.amazon.com/vpn/latest/s2svpn/endpoint-replacements.html

One workaround would be to delete the VPN connection and recreate it, this will essentially spin up new VPN endpoints so that would rule out endpoint specific issues.

Lastly, please note, you can opt-out of tunnel endpoint related notifications, you would need to contact AWS support for the opt-out as well.

One good thing is that you have built HA - One VPN connection = 2 Tunnels so if there are issues with 1 Tunnel you have a backup path available.

Hope this helps.

Constant Tunnel endpoint replacement notification notifications - ca-central-1

関連するコンテンツ