Why does IPsec/Phase 2 for Site-to-Site VPN fail to establish a connection?

Resolution

If an IPsec/Phase 2 connection fails, then check the following configurations:

• Confirm that the Site-to-Site VPN Phase 2 parameters on your customer gateway device match the tunnel settings for your VPN.
  Note: You can download an example configuration file for your VPN and then compare that file to the tunnel settings for the customer gateway. However, if your VPN tunnels have customized settings, then the example configuration file might not match the Phase 2 parameters of the VPN tunnels.
• Confirm that the Phase 2 parameters for Internet Key Exchange (IKE) v1 and IKEv2 follow the best practices for your customer gateway device.
  The following example parameters for a customer gateway device follow best practices:
  IKEv1 Encryption: AES-128, AES-256, AES128-GCM-16, AES256-GCM-16
  IKEv1 Data Integrity: SHA-1, SHA2-256, SHA2-384, SHA2-512
  IKEv1 DH groups: 2, 5, and 14-24
  Lifetime: 3600 seconds
  Diffie-Hellman Perfect Forward Secrecy (PFS): Active
  AWS Phase 2 parameters: AES128, SHA1, Diffie-Hellman group 2
  AWS GovCloud (US) Phase 2 parameters: AES128, SHA2, Diffie-Hellman group 14
• Confirm that Diffie-Hellman PFS is active and uses Diffie-Hellman groups for key generation. For more information, see Tunnel options for your Site-to-Site VPN connection.
• Confirm that the security associations and traffic selectors match on the customer gateway and AWS. For more information, see How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?
• If the connection uses IKEv2 Identification – Initiator (Idi) Identification with both Initiator and Identification – Responder (IDr) Identification, then confirm that you correctly configured the responder parameter. For more information, see Internet Key Exchange Protocol Version 2 (IKEv2) on the Internet Engineering Task Force (IETF) website.
• Check that the Site-to-Site VPN connection options that you configured for both remote and local IP addresses match the security associations on the customer gateway. For more information, see How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?
• Confirm that your customer gateway initiates inbound traffic. For more information, see Site-to-Site VPN tunnel initiation options.
  Note: By default, Site-to-Site VPN works in responder mode.
• Activate Site-to-Site VPN Tunnel activity logs, then review the logs for errors that correspond with your connection failure. After you review, troubleshoot your connection errors.

Debug encryption algorithm errors

Check for encryption algorithm errors. If you encounter encryption algorithm errors, then use the Site-to-Site VPN Tunnel activity logs for your tunnel to debug them. Tunnel activity logs include IKE logs, by default. View your Tunnel activity logs in the Amazon CloudWatch console.

The following example IKE log entries show the proposals for encryption algorithm AES256:

• For Phase 1 SA encryption:
  ""details": "Selected proposals for Phase 1 SA: Encryption: AES256 Hash: SHA2-256 PRF: SHA2-256 DH Group(s): 14"
• For Phase 2 SA encryption:
  ""details": "Selected proposals for Phase 2 SA: Encryption: AES256 Hash: SHA2-256 DH Group(s): None PFS: None"

In the details field, check that the listed encryption algorithm matches the expected configuration on both the AWS VPN tunnel and the customer gateway device. If the algorithms don't match, then update your customer gateway configuration to match your AWS VPN tunnel settings. Or, update the VPN tunnel options to match the customer gateway.

Related information

Downloadable dynamic routing configuration files for Site-to-Site VPN customer gateway device

Downloadable static routing configuration files for an Site-to-Site VPN customer gateway device