Why is Transit Gateway prioritizing my backup VPN connection over my primary Direct Connect gateway?

Resolution

Traffic from customer gateway to AWS

For VPN connections with a static route, configure your customer gateway to use routes that are less specific than your Direct Connect connection.

VPN connections with a dynamic route must be the same or less specific than the Direct Connect gateway's allowed prefixes. Direct Connect has a maximum of 200 allowed prefixes. The customer gateway prefers the path with the most specific route. If you add summarized routes to cover all prefixes, then your VPN routes might be more specific than the Direct Connect transit virtual interface. When you advertise the same routes through VPN and Direct Connect, the customer gateway prefers the Direct Connect connection.

If you have a dynamic route, then take the following actions:

• Check the routes in the transit gateway route table for your VPN attachment.
• Filter out specific routes that the AWS Site-to-Site VPN advertises in your customer gateway.
• Verify that the route table for the Site-to-Site VPN attachment matches the allowed prefixes on the Direct Connect gateway to transit gateway association.

Traffic from AWS to the customer gateway

Verify that the transit gateway route table displays the correct preferred route. AWS Transit Gateway selects routes in the following order:

• The most specific route for the destination address
• Routes with the same CIDR block and from different attachment types

For routes with the same CIDR block and different attachment types, Transit Gateway prioritizes routes in the following order:

• Static routes
• Prefix list referenced routes
• Direct Connect gateways with propagated routes
• Private IP Site-to-Site VPN connections
• Site-to-Site VPN connections

Note: Transit Gateway shows only preferred routes. When you advertise the same routes through Direct Connect gateway and Site-to-Site VPN, Transit Gateway shows only the Direct Connect gateway route as preferred. The Site-to-Site VPN route appears only when Direct Connect gateway stops advertising the route.

Related information

How Amazon VPC Transit Gateways work

How do I configure Direct Connect and VPN failover with Transit Gateway?