S-to-S VPN comes up but no connectivity for exactly one hour

Question

We have a Site to Site VPN setup though a Virtual Private Gateway. Everything works great but if we make changes that cause the tunnel to re-negotiate it will take exactly one hour before any of our endpoints can connect. We see traffic going to AWS but not coming back. Then after one hour everything works perfectly. We used all the defaults on the IPSec settings. do you have any idea what settings could be causing this or what diagnostics we should run? We are Using Cisco ASA on our Datacenter side for the connection to AWS.

Munkhbat_T · Answer

Hi GregL,

Thanks for your question.

Let me start with some information regarding AWS S2S VPN - AWS VPN is Route-Based solution  [[1](https://docs.aws.amazon.com/vpn/latest/s2svpn/your-cgw.html#:~:text=The%20Site%2Dto%2DSite%20VPN%20service%20is%20a%20route%2Dbased%20solution.%20If%20you%20are%20using%20a%20policy%2Dbased%20configuration%2C%20you%20must%20limit%20your%20configuration%20to%20a%20single%20security%20association%20(SA).)] and it supports single IPSec Security Associations(SA) for Policy-based implementation. So if you are implementing policy-based VPN on your Customer Gateway(CGW) configuration you will need to limit the SA to be single SA, otherwise there will be connectivity issues. You can also find the related information from AWS VPN FAQs page here [[2](https://aws.amazon.com/vpn/faqs/#:~:text=Q%3A%20How%20many%20IPsec%20security%20associations%20can%20be%20established%20concurrently%20per%20tunnel%3F)].

Your explanation of the current behaviour is highly likely to be related to multiple SAs for policy-based VPN implementation on your CGW device(Cisco ASA). The policy-based configuration is most likely to be multi-entry extended ACLs for example like below:

* Allow ip `on-prem-subnet-1` `VPC-CIDR`
* Allow ip `on-prem-subnet-2`  `VPC-CIDR` and etc

In the above configuration each line from the extended ACL generates separate IPSec SA for communication over the Tunnels, hence to avoid this multiple SA scenario try to summarize the on-prem subnets into single or use 0.0.0.0/0 for on-prem network and control the traffic with routing. This way you can ensure to create single IPSec SA and to avoid intermittent connectivity issues from your on-prem subnets.

Hope this helps and looking forward to your feedback!

Thanks

S-to-S VPN comes up but no connectivity for exactly one hour

Relevant content