AWS BGP VPN Routing issues

Based on your description, you're experiencing an asymmetric routing issue with your AWS Site-to-Site VPN connection, where traffic from your on-premises network reaches AWS, but return traffic isn't coming back through the same tunnel.

This is a common issue with BGP-based VPN connections and could be caused by several factors:

1. BGP Route Advertisement: Verify that your customer gateway device is properly advertising your on-premises prefixes (including 10.10.100.0/24) through the BGP session on the affected tunnel. Check if any route maps on your customer gateway device might be filtering or modifying the prefixes advertised over BGP.

2. Transit Gateway Route Tables: If you're using AWS Transit Gateway, check that the route tables for your VPC attachment contain the correct routes for your on-premises network that point toward the VPN connection. The transit gateway might be preferring the alternate tunnel (Tunnel.21) for return traffic.

3. Route Prioritization: AWS Direct Connect routes are prioritized over Site-to-Site VPN routes by default. If you have a Direct Connect connection alongside your VPN, this could be causing the asymmetric routing.

4. Asymmetric Routing Configuration: For an Active/Active VPN configuration, you need to activate asymmetric routing on your virtual tunnel interfaces. Without this, return traffic might be forced through a different tunnel than the one that received the initial traffic.

5. VPC Route Tables: Verify that the route tables in your VPC are correctly configured to route traffic back to your on-premises network through the appropriate VPN connection.

To resolve this issue:

• Check if both tunnels are in an "Active" or "Established" BGP state
• Verify that your customer gateway device is correctly advertising your on-premises prefixes
• If using an Active/Active configuration, ensure asymmetric routing is enabled on your virtual tunnel interfaces
• Review the transit gateway route tables to ensure proper propagation of routes
• Check for any overlapping IP address ranges between your VPC and on-premises network

If these steps don't resolve the issue, you might need to examine your transit gateway flow logs to see exactly where the return traffic is being directed.
Sources
Troubleshoot VPN routing issues | AWS re:Post
Troubleshoot AWS Site-to-Site VPN connectivity when using Border Gateway Protocol - AWS Site-to-Site VPN
Troublehsoot connectivity between SIte-to-Site VPN and VPC | AWS re:Post
Troubleshoot VPN tunnel connectivity | AWS re:Post