AWS re:Post Knowledge Center Feedback Survey

Help us improve the AWS re:Post Knowledge Center by sharing your feedback in a brief survey. Your input can influence how we create and update our content to better support your AWS journey.

How do I check the current status of my VPN tunnel?

2 minute read

I don't see traffic that goes to and from my Amazon Virtual Private Cloud (Amazon VPC) through an AWS Site-to-Site VPN connection. I want to check the status of my VPN tunnel.

Resolution

Check the tunnel's current status

Prerequisite: Check whether you use static or dynamic AWS Site-to-Site VPN routing. If your VPN device doesn't support Border Gateway Protocol (BGP), then you must use static routing.

If you use a static VPN, then complete the following steps to check the VPN tunnel status:

Open the Amazon VPC console.
In the navigation pane, choose Site-to-Site VPN connections.
Select your VPN connection.
Choose Tunnel details.
Check the Status field.
If the tunnel status is UP, then choose Static routes.
Note: Make sure to specify all private networks that are behind your on-premises firewall.
If the tunnel status is DOWN, then verify that you correctly configured your on-premises firewall.
Activate route propagation in your VPC route table.

If you use a dynamic VPN with BGP, then complete the following steps to check the VPN tunnel status:

Open the Amazon VPC console.
In the navigation pane, choose Site-to-Site VPN connections.
Select your VPN connection.
Choose Tunnel details.
Check the Status field.
If the tunnel status is UP, then verify that the Details column lists at least one BGP route.
If the tunnel status is DOWN, but in the Details column, IPsec is UP, then configure BGP on your firewall. For more information, see Configure dynamic routing for an AWS Virtual Private Network customer gateway device.
Verify that the security groups of Amazon Elastic Compute Cloud (Amazon EC2) instances in your VPC allow the required access.
Verify that your local firewall allows the same service in its access control lists (ACLs) and firewall policies. For more information, see Troubleshooting AWS Site-to-Site VPN customer gateway device.