How do I troubleshoot a failed BGP connection between Site-to-Site VPN and Direct Connect?

Resolution

Check the connection between Direct Connect and Site-to-Site VPN

To check the connection between Direct Connect and Site-to-Site VPN, complete the following steps:

1. Check that the Direct Connect connection is Available and UP.
2. Check that the virtual interface is UP.
3. If the connection uses a public or transit virtual interface, then check that the BGP peer IP addresses are within the specified CIDR range.
4. Check that the VPN tunnels are UP and that they share BGP routes.
5. If the tunnels are UP but the BGP is DOWN, then troubleshoot the Site-to-Site VPN connection.

Check the number of routes

Important: 100 is the maximum number of routes that a BGP session supports. If the number of routes exceeds the quota, then the status of BGP changes from Established to Idle. For more information, see Troubleshooting AWS Site-to-Site VPN customer gateway device.

On the customer gateway, check that fewer than 100 routes are advertised over the BGP session. If the number of routes exceeds the quota, then take one of the following actions:

• Advertise a default route to AWS.
• Summarize the routes so that the number of routes received is less than 100.
• Migrate your Site-to-Site VPN connection to an AWS Transit Gateway.
  Note: A Transit Gateway supports up to 1,000 routes being advertised to AWS at a time, and up to 5000 routes being advertised to the customer gateway at a time from AWS.
• For a full list of Site-to-Site VPN quotas, see AWS Site-to-Site VPN quotas.

Check the BGP configuration and status

To check the status and configuration of BGP, complete the following steps:

1. If the status of BGP is DOWN, then check that the virtual interface's status is UP.

2. If the virtual interface is DOWN, then make sure that you correctly configured Open Systems Integration layer 2 and BGP.

3. If the BGP is flapping or its status changes from UP to DOWN in the idle state, then troubleshoot the Direct Connect connection.

   Note: Make sure that layers 1 and 2 establish connections. If the layers establish a connection but BGP is flapping, then troubleshoot the BGP session.

4. If you use a hosted connection, then check with the host provider whether they're experiencing issues that prevent the BGP connection.

5. If BGP's status is UP, then check that the routes propagate.

Check that the routes propagate

On the Transit Gateway and Amazon Virtual Private Cloud (Amazon VPC) route tables, check that the routes propagate from the customer gateway to the virtual interface. If the routes don't propagate correctly, then reconfigure the route tables.

Check the customer gateway device configurations

To check the configurations of the customer gateway device, complete the following steps:

1. On the route table of the customer gateway device, check that the routes propagate through BGP.
2. Make sure that the firewalls of the customer gateway device allow inbound and outbound traffic.
3. Confirm that you correctly configured the BGP community tags.
4. If the Direct Connect connection has a partner or last-mile service provider, then check with them that a maintenance event doesn't match the failed connection.

Use logs to monitor traffic and troubleshoot your connection

Use Amazon Virtual Private Cloud (Amazon VPC) Flow Logs and Transit Gateway Flow Logs to monitor traffic over Direct Connect. Monitor logs for timestamps that correspond with your error to troubleshoot your connection.

Complete the steps in the To enable tunnel BGP logging on an existing Site-to-Site VPN connection section of Enable AWS Site-to-Site VPN logs to activate BGP logging. Then, use your BGP logs to troubleshoot errors with Site-to-Site VPN tunnels.

Related information

AWS Site-to-Site VPN customer gateway devices