Why doesn't my Site-to-Site VPN traffic flow through my Transit Gateway even though the tunnel is UP?

Short description

A VPN tunnel that shows as UP means that IPsec negotiation succeeded. For dynamic routing VPNs, it also means that the Border Gateway Protocol (BGP) session established. However, you must configure correct routing in the transit gateway route table, the VPC subnet route table, and the on-premises customer gateway device.

Resolution

Verify transit gateway route table configuration

If you didn't route the transit gateway route table to the destination, then a VPN tunnel can be UP when the transit gateway drops traffic. To resolve, take the following actions.

Check the route in the VPN attachment route table

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Transit Gateway Route Tables.
3. Select the route table that's associated with your VPN attachment.
4. Choose the Routes tab.
5. Verify that a route for the destination VPC CIDR block exists and points to the correct VPC attachment.

Check the route in the VPC attachment route table

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Transit Gateway Route Tables.
3. Select the route table that's associated with your VPC attachment.
4. Choose the Routes tab.
5. Verify that a route for the on-premises CIDR block exists and points to the correct VPN attachment.

If routes are absent in either route table, then activate route propagation or add a static route that points to the correct attachment.

Note: If no route table is associated with an attachment, then all traffic from that attachment is dropped. To associate a route table, choose the Associations tab, and then create an association for the attachment.

To confirm routing issues, check Amazon CloudWatch. If the PacketDropCountNoRoute metric on the transit gateway is greater than zero, then the transit gateway drops traffic because no route exists.

Activate route propagation

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Transit Gateway Route Tables.
3. Select the route table that's associated with your VPN attachment.
4. Choose the Propagations tab, and then verify that the VPC attachment appears. If absent, then choose Actions, choose Create propagation, and then select the VPC attachment.
5. In the Transit Gateway Route Tables, select the route table that's associated with your VPC attachment.
6. Choose the Propagations tab, and then verify that the VPN attachment appears. If absent, then choose Actions, choose Create propagation, and then select the VPN attachment.

Note: If Default route table propagation is deactivated on the transit gateway, then you must explicitly activate propagation for every attachment.

Verify VPC subnet route table configuration

The VPC subnet route table must have a route for the on-premises CIDR that points to the transit gateway. Without this route, traffic destined for the on-premises network doesn't reach the transit gateway.

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Route Tables.
3. Select the route table that's associated with the subnet that contains your source or destination resource.
4. Verify that a route for the on-premises CIDR block exists and points to the transit gateway.
5. If a route doesn't exist, then choose Edit routes and choose Add route. Enter the on-premises CIDR as destination, and then select your transit gateway as the route target.

Note: A transit gateway doesn't propagate routes into VPC subnet route tables. You must manually add static routes. If you recently migrated from a virtual private gateway, then verify that the route table points to the transit gateway.

If you have multiple subnets, then verify that each subnet route table has the correct route to the transit gateway.

Verify that return traffic from on-premises reaches AWS

If you correctly configured the transit gateway and VPC route tables but connectivity still fails, then verify the on-premises routing.

Take the following actions:

• Check that the customer gateway device has a route for the Amazon VPC CIDR block that points to the VPN tunnel interface.
• If the customer gateway device has multiple routing paths, then verify that traffic destined for the Amazon VPC CIDR block doesn't route through a different path.
• Verify that the customer gateway device permits asymmetric routing (traffic uses different tunnels or paths in each direction). If the device doesn't permit asymmetric routing, then configure routing to prefer a single tunnel.
• Check the traffic counters on the VPN tunnel interface of the customer gateway device to verify that traffic flows in both directions.

Note: If all routing configurations are correct but traffic still doesn't reach the destination resource, then verify that the resources allow traffic. To verify, confirm that the security group associated with the resource allows traffic from the on-premises CIDR. Then, check that the access control list (network ACL) allows traffic to and from the on-premises CIDR.

Related information

Why can't I connect to Amazon VPC when I use a Site-to-Site VPN that terminates on a transit gateway?

How do I troubleshoot issues with traffic routing over Site-to-Site VPN?

Transit gateway route tables in AWS Transit Gateway

How AWS Transit Gateway works