The discouragement in the AWS documents against overriding MED with Local_Pref or AS path prepending is for use cases where the IPSec VPN terminates on a VGW. In that case only one of the two tunnels is active and via MED we effectively indicate which of the two that is. With Transit Gateway you are not facing that issue and you can safely consider this guidance out of scope.
AWS Site-to-Site VPN terminating on TGW supports ECMP and Multi-Exit-Discriminator across tunnels in the same and different connections. Therefore you have multiple options:
- MED: Use MED to indicate your preference for traffic from AWS to on-prem over the primary VPN tunnel(s) (lower MED value) vs. the secondary VPN tunnel(s) (higher MED value) towards AWS. This assumes the same prefix is announced over all tunnels. In the opposite traffic direction (On-Prem -> AWS) use Local_Pref.
- AS Path Prepending: Use AS Path Prepending to artificially lengthen the path over the secondary VPN tunnels for traffic from AWS to on-prem. In the opposite traffic direction (On-Prem -> AWS) use Local_Pref.
- Is it possible to set up a dynamic routing connection to AWS through a site-to-site VPN via a vendor?Accepted Answerasked 3 years ago
- How can I resolve asymmetric routing issues when I create a VPN as a backup to Direct Connect in a transit gateway?AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 3 months ago
- AWS OFFICIALUpdated 2 months ago
- How do I set up an Active/Active or Active/Passive Direct Connect connection to AWS from a public virtual interface?AWS OFFICIALUpdated 2 years ago