How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?

Short description

AWS VPN supports one inbound and one outbound security association at a time. If a policy-based VPN on the customer gateway device that connects to an endpoint has more than one pair of security associations, then new connections with different associations cause previous connections to drop.

Resolution

To troubleshoot connection problems between a VPN endpoint and a policy-based VPN, complete the following actions:

Limit the encryption domains

1. Review the current encryption domains that access your VPC. For more information, see Modify Site-to-Site VPN connection options.
2. Verify that each encryption domain on the customer gateway device has only one pair of inbound and outbound security associations. For more information, see Your customer gateway device.

Use the AWS Management Console to modify the VPN connection

1. Configure your customer gateway to set the Local IPv4 Network's Classless Inter-Domain Routing (CIDR) to:

   0.0.0.0/0

2. Set the remote IPv4 Network's CIDR to:

   0.0.0.0/0

Match the configuration on the customer gateway device

1. Set the local subnet to:

   0.0.0.0/0

2. Set the remote subnet to:

   0.0.0.0/0

3. If 0.0.0.0/0 isn't supported, then use the specific ranges that correspond with your use case on both sides of the connection. See the following example values:

   VPC

   10.34.0.0/16

   On-premises

   172.16.0.0/16

Route summarization for multiple subnets

Use a wider subnet that encompasses all the smaller subnets on the customer gateway.

Turn on traffic filters

1. Configure security groups to block unwanted traffic on the customer gateway.
2. Define network access control lists (network ACLs) to control traffic to your subnets.
3. If the customer gateway supports traffic filters, then set filters on the device to allow only required traffic to and from the VPC.

Related information

Why is IKE (phase 1 of my VPN tunnel) failing in Amazon VPC?

Why is IPsec/Phase 2 for AWS Site-to-Site VPN failing to establish a connection?