How do I manage VPN tunnel maintenance notifications and schedules in Site-to-Site VPN?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Turn on tunnel endpoint lifecycle control

After you turn on tunnel endpoint lifecycle control, you receive advance visibility into scheduled tunnel endpoint replacements through AWS Health Dashboard notifications and the Amazon VPC console.

Note: You must turn on tunnel endpoint lifecycle control separately for each tunnel. By default, when you turn on this feature for an existing VPN connection, a tunnel endpoint replacement starts immediately. To turn on the feature without an immediate replacement, use the skip tunnel replacement option.

Use the Amazon VPC console to turn on tunnel endpoint lifecycle control

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Site-to-Site VPN Connections.
3. Select your VPN connection.
4. Choose Actions, and then choose Modify VPN tunnel options.
5. Select the tunnel that you want to update by choosing the appropriate VPN tunnel outside IP address.
6. Under Tunnel Endpoint Lifecycle Control, select Enable.
7. (Optional) Select Skip tunnel replacement to turn on the feature without an immediate endpoint replacement.
8. Choose Save changes.

Use the AWS CLI to turn on tunnel endpoint lifecycle control

To turn on tunnel endpoint lifecycle control, run the modify-vpn-tunnel-options command:

aws ec2 modify-vpn-tunnel-options \
    --vpn-connection-id VPN-CONNECTION-ID \
    --vpn-tunnel-outside-ip-address 203.0.113.17 \
    --tunnel-options EnableTunnelLifecycleControl=true  
    --skip-tunnel-replacement \  
    --region REGION

Note: Replace VPN-CONNECTION-ID with your VPN connection ID, 203.0.113.17 with your tunnel's outside IP address, and REGION with your AWS Region. Remove --skip-tunnel-replacement if you want an immediate endpoint replacement.

Verify that tunnel endpoint lifecycle control is turned on

Use the Amazon VPC console to verify

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Site-to-Site VPN Connections.
3. Select your VPN connection.
4. Choose the Tunnel details tab.
5. Confirm that Lifecycle control shows On for the tunnel.

Use the AWS CLI to verify

To verify that tunnel endpoint lifecycle control is turned on, run the describe-vpn-connections command:

aws ec2 describe-vpn-connections \
    --vpn-connection-ids VPN-CONNECTION-ID \
    --query "VpnConnections[].Options.TunnelOptions[].{OutsideIpAddress:OutsideIpAddress,EnableTunnelLifecycleControl:EnableTunnelLifecycleControl}"  
    --region REGION

Note: Replace VPN-CONNECTION-ID with your VPN connection ID and REGION with your AWS Region.

In the output, confirm that EnableTunnelLifecycelControl is set to true:

{
    "VpnConnections": [
        {
            "Options": {
                "TunnelOptions": [
                    {
                        "OutsideIpAddress": "203.0.113.17",
                        "EnableTunnelLifecycleControl": true
                    },
                    {
                        "OutsideIpAddress": "203.0.113.18",
                        "EnableTunnelLifecycleControl": false
                    }
                ]
            }
        }
    ]
}

Check for available maintenance updates

Use the Amazon VPC console to check for updates

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Site-to-Site VPN Connections.
3. Select your VPN connection.
4. Choose the Tunnel details tab.
5. In the Tunnel state table, check the Pending maintenance column. This column also displays the Maintenance auto applied after deadline.

Use the AWS CLI to check for updates

To check for available maintenance updates, run the get-vpn-tunnel-replacement-status command:

aws ec2 get-vpn-tunnel-replacement-status \
    --vpn-connection-id VPN-CONNECTION-ID \
    --vpn-tunnel-outside-ip-address 203.0.113.17  
    --region REGION

Note: Replace VPN-CONNECTION-ID with your VPN connection ID, 203.0.113.17 with your tunnel's outside IP address, and REGION with your AWS Region.

Accept maintenance updates

Apply available maintenance updates before the Maintenance auto applied after deadline. If you don't apply updates before this deadline, then AWS automatically performs the tunnel endpoint replacement.

Note: When you accept a maintenance update, the tunnel goes down until it re-establishes. After the replacement completes, the tunnel re-establishes automatically. If you configured your customer gateway device with static tunnel IP addresses, then update your device configuration with the new outside IP address. For more information, see Site-to-Site VPN tunnel endpoint replacements.

Use the Amazon VPC console to accept maintenance updates

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Site-to-Site VPN Connections.
3. Select your VPN connection.
4. Choose Actions, and then choose Replace VPN tunnel.
5. Select the tunnel that you want to replace by choosing the appropriate VPN tunnel outside IP address.
6. Choose Replace.

Use the AWS CLI to accept maintenance updates

To accept a maintenance update, run the replace-vpn-tunnel command:

aws ec2 replace-vpn-tunnel \
    --vpn-connection-id VPN-CONNECTION-ID \
    --vpn-tunnel-outside-ip-address 203.0.113.17 \
    --apply-pending-maintenance

Note: Replace VPN-CONNECTION-ID with your VPN connection ID, 203.0.113.17 with your tunnel's outside IP address, and REGION with your AWS Region.

Important: Tunnel endpoint lifecycle control manages only scheduled maintenance. In rare circumstances, AWS might apply critical updates to tunnel endpoints immediately.

Related information

Why did I get a notification that Site-to-Site VPN replaced my tunnel endpoints?