Transit Gateway RPF check on Traffic Received via VPN Tunnel attachment

when a TGW VPN attachment receives traffic from the VPN tunnel but the source of that traffic is not advertised via BGP from the VPN peer, the behavior will depend on the specific configuration of your TGW. TGW does not implement a strict RPF check in the same way that traditional routers might. This means that traffic can still flow through the TGW even if the source prefix isn't explicitly advertised via BGP back to the Tgw.

Note that TGW primarily makes forwarding decisions based on the destination of the packets, not the source. The key factor is whether the Transit Gateway knows how to route the return traffic back to the source. If the route to the source network isn't advertised via BGP (or configured statically), then while the initial traffic may flow through the Transit Gateway, the return traffic might not have a valid path back.

Copied from doc below :.................................................. A transit gateway scales elastically based on the volume of network traffic. Routing through a transit gateway operates at layer 3, where the packets are sent to a specific next-hop attachment, based on the destination IP addresses.

Doc : https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

I have added the doc above. Please see it and let me know if that answers your question ?

And layer3 devices perform RPF check.

Not Transit Gateway :). and it doesn't implement traditional RPF checks like conventional network equipment does. Instead, it primarily makes forwarding decisions based on destination addresses rather than source verification, which allows for more flexible routing topologies but requires additional security measures to be implemented elsewhere in the network.

I have this behavior where traffic arrives at the TGW VPN attachment- captured on the on prem VPN device. But I do not see it at the VM NIC. security groups are open and the VPN attachment has a static route to the target VPC.

Looking at the traffic as described here it seems like this has nothing to do with TGW ? Source (AWS) -> TGW -> VPN attachment -> On-prem VPN device (seen) -> On-prem VM NIC (not seen)

• Check any internal firewalls between VPN device and VM
• VM host firewall settings
• Verify the VM subnet knows how to reach the source network and the VLAN it's connect to.