For troubleshooting: What happens if you create an EC2 instance on the same subnet as the Lambda function is using? It's much easier to troubleshoot connectivity issues from an interactive console of some sort.
I would also (at least temporarily) remove the NACLs - they are often the cause of much time being used in troubleshooting. Only add them back in if they are necessary and once the connection is up and running. Also consider relaxing the security group rules for the same reason.
You should also check to see if there is anything else on the customer's network that you can test connectivity with. A common problem here is that the remote VPN/firewall device has NAT enabled for traffic over the VPN connection which causes things to fail.
Since you mentioned you are using VGW and both tunnels are UP, make sure you don't have asymmetric routing issue, asymmetric routing is where traffic from on-prem to AWS is using one tunnel, but the return traffic is using the other tunnel. To check if you have asymmetric routing issue check CloudWatch TunnelDataIn and TunnelDataOut metrics, both of those two must have traffic for the same tunnel, if you see TunnelDataIn on tunnel 1 and TunnelDataOut on tunnel 2, then this is asymmetric routing and traffic will be dropped (most likely), both TunnelDataIn and TunnelDataOut must be for the same tunnel.
To quickly see if you're having asymmetric routing, disable one of the tunnels and then test the connectivity, if it starts working them this is asymmetric routing.
Below are some guides on how to troubleshoot VPN connection issues.
You don’t mention how your lambda is configured. Have you configured the VPC part of your lambda function to connect to your VPC?
Have you configured the security group on your lambda function with the correct outbound rules?
- asked 7 months ago
- Why is my AWS Site-to-Site VPN connection in the DOWN IPSEC UP status when the customer gateway is UP?AWS OFFICIALUpdated 6 months ago
- Why can't I connect to my VPC when using an AWS Site-to-Site VPN that terminates on a transit gateway?AWS OFFICIALUpdated 6 months ago
- AWS OFFICIALUpdated 4 months ago
- AWS OFFICIALUpdated 7 months ago