Client VPN availability question

Question

The Client VPN examples at https://aws.amazon.com/blogs/networking-and-content-delivery/using-aws-client-vpn-to-scale-your-work-from-home-capacity/ use this as an example for a failover (?) setup between two AZs:

![Enter image description here](/media/postImages/original/IMs7uxqNEgTjib9fvgmkEeyQ)

Is that enough to ensure connectivity between "remote workers" and VPC B/C/D in case of a problem in AZ A or AZ B? Is there any way I could realistically simulate a failure of one AZ?

I have the recommended setup for TGW attachments in their own /28. My AZ A and AZ B in this case are not the subnets with the TGW attachment, because the CVPN endpoint doesn't allow association with a subnet smaller than /27 - would it be a better/worse idea or make any difference at all if I used /27 subnets for the TGW attachments so I could associate the CVPN endpoints with the same subnets?

Thanks,
Marc

Accepted Answer

The way you have setup is correct, as long as you have TGW ENIs in 2 dedicated /28 subnets in 2 different Availability Zones will give you AZ level redundancy and thats what is mentioned in the [TGW Best practice](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-best-design-practices.html) guidance.

Similarly as long as you associate 2 subnets from 2 different AZs to the ClientVPN endpoints the setup will give you AZ level redundancy.

CVPN endpoints and TGW ENIs don't need to be in the same subnet, it sounds like the way you have done the setup is correct.

Answer

hi 
The best practice is to use multiple Availability Zone.

https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/disaster-recovery-resiliency.html

Multiple target networks for high availability
You associate a target network with a Client VPN endpoint to enable clients to establish VPN sessions. Target networks are subnets in your VPC. Each subnet that you associate with the Client VPN endpoint must belong to a different Availability Zone. You can associate multiple subnets with a Client VPN endpoint for high availability.
While there is not a specific solution to simulate  Client VPN failover
the documentation below might provide some guidance on how to think about it

https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#disrupt-connectivity

https://www.wellarchitectedlabs.com/reliability/300_labs/300_testing_for_resiliency_of_ec2_rds_and_s3/7_failure_injection_az/

Answer

Thank you both for your replies, much appreciated.

Client VPN availability question

Relevant content