By using AWS re:Post, you agree to the Terms of Use

How can I stablished connection to AWS tunnel successfully (VPC)


Flow of traffic: source AWS VPC -- site to site to FortiGate -- destination

Source cannot reach the destination

  • Are you using route based VPN or Policy based VPN? if route based is it Static route or BGP VPN? From the description it appears AWS is source of the traffic, are you seeing traffic reach Fortigate FW (in the logs)

  • I'm using route based, it is static route. I'm not seeing traffic going to FortiGate

  • Is the Tunnel itself Up (Phase 1 & Phase2)? Also clarify if you are using VGW or a TGW.

  • Yes both phase 1 and 2 tunnel are up. It is VGW

  • I have another test environment instance that uses both phase 1 and 2, and it is working perfectly fine. I don't know how to check the instance that is configured on my prod environment.

1 Answer
Accepted Answer

By default, your customer gateway device must bring up the tunnels for your Site-to-Site VPN connection by generating traffic and initiating the Internet Key Exchange (IKE) negotiation process. You can configure your VPN tunnels to specify that AWS must initiate or restart the IKE negotiation process instead. This is supported on IKEv2 only.

  • Startup action: The action to take when establishing the VPN tunnel for a new or modified VPN connection. By default, your customer gateway device initiates the IKE negotiation process to bring the tunnel up. You can specify that AWS must initiate the IKE negotiation process instead.

Suggest changing the Start-up Action, reference.

Also make sure that the VPC route table has routes pointing towards VGW/TGW as well.

profile picture
answered a month ago
profile picture
reviewed 22 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions