I have an AWS Direct Connect gateway with a primary connection to my on-premises network, and a backup VPN connection for failover. However, traffic routes through the backup VPN connection instead of the primary AWS Direct Connect connection.
Resolution
Traffic from customer gateway to AWS
For VPN connections with a static route, configure your customer gateway to use routes that are less specific than your Direct Connect connection.
VPN connections with a dynamic route must be the same or less specific than the Direct Connect gateway's allowed prefixes. Direct Connect has a maximum of 200 allowed prefixes. The customer gateway prefers the path with the most specific route. If you add summarized routes to cover all prefixes, then your VPN routes might be more specific than the Direct Connect transit virtual interface. When you advertise the same routes through VPN and Direct Connect, the customer gateway prefers the Direct Connect connection.
If you have a dynamic route, then take the following actions:
- Check the routes in the transit gateway route table for your VPN attachment.
- Filter out specific routes that the AWS Site-to-Site VPN advertises in your customer gateway.
- Verify that the route table for the Site-to-Site VPN attachment matches the allowed prefixes on the Direct Connect gateway to transit gateway association.
Traffic from AWS to the customer gateway
Verify that the transit gateway route table displays the correct preferred route. AWS Transit Gateway selects routes in the following order:
- The most specific route for the destination address
- Routes with the same CIDR block and from different attachment types
For routes with the same CIDR block and different attachment types, Transit Gateway prioritizes routes in the following order:
- Static routes
- Prefix list referenced routes
- Direct Connect gateways with propagated routes
- Private IP Site-to-Site VPN connections
- Site-to-Site VPN connections
Note: Transit Gateway shows only preferred routes. When you advertise the same routes through Direct Connect gateway and Site-to-Site VPN, Transit Gateway shows only the Direct Connect gateway route as preferred. The Site-to-Site VPN route appears only when Direct Connect gateway stops advertising the route.
Related information
How Amazon VPC Transit Gateways work
How do I configure Direct Connect and VPN failover with Transit Gateway?