Title:
Client VPN Subnet Associations Repeatedly Stuck in "Associating" Status - eu-west-1
Problem Description:
I'm experiencing repeated failures with Client VPN subnet associations in the eu-west-1 region. Associations that should complete in 2-5 minutes are getting stuck in "associating" status for extended periods.
Timeline:
8:48 AM UTC today: Three subnet associations got stuck in "associating" status for over 50 minutes
Current: After disassociating and retrying, new association is also stuck
Affected Resources:
Client VPN Endpoint: cvpn-endpoint-0f86a460dccddaf53
Region: eu-west-1
VPC: vpc-dbcfefbf
Current Stuck Association: cvpn-assoc-002765790f5a8f441
Target Subnet: subnet-4380fa1b
Previous Failed Associations:
cvpn-assoc-07d3c2207863418d6 (subnet-4380fa1b)
cvpn-assoc-0904e166abdbd362b (subnet-146c5f70)
cvpn-assoc-01f0f343985fb08a2 (subnet-fe724e88)
Investigation Completed:
Subnet Configuration (✅ Verified Correct):
Available IPs: 242 out of 256 (sufficient capacity)
Type: Private subnet in AZ eu-west-1c
CIDR: 10.0.3.0/24
Route Table: Main route table with NAT Gateway (proper configuration)
Network ACL: Default permissive rules (allows all traffic)
Security Group Configuration (✅ Verified Correct):
Security Group: sg-00a53e5459a011b5f
Inbound: TCP 443 from 0.0.0.0/0 (correct for VPN)
Outbound: All traffic allowed (correct)
Recent Changes Analysis:
CloudTrail review: No VPC configuration changes in last 4 days
Only activity: Normal EC2 launches and target group creation
No subnet, route table, security group, or Network ACL modifications
Client VPN Endpoint Configuration:
Client CIDR: 10.20.0.0/22
Transport: UDP port 443
Authentication: Federated (SAML with Azure AD)
Split Tunnel: Enabled
Connection Logging: Enabled
Expected vs Actual Behavior:
Expected: Subnet association completes in 2-5 minutes
Actual: Associations stuck in "associating" status indefinitely
Troubleshooting Steps Taken:
✅ Verified subnet has sufficient IP addresses
✅ Confirmed security group rules are appropriate
✅ Checked Network ACL configuration (permissive)
✅ Verified route table configuration (proper NAT Gateway routing)
✅ Reviewed recent VPC changes (none found)
✅ Successfully disassociated stuck associations
✅ Attempted fresh association (also stuck)
✅ Verified SAML provider certificate is still valid
Conclusion:
All configuration appears correct. The repeated failures across multiple subnets and associations, combined with no recent infrastructure changes, suggests this is an AWS Client VPN service issue in the eu-west-1 region rather than a configuration problem.
Question:
Has anyone else experienced similar Client VPN subnet association issues in eu-west-1? Is there a known service issue or recommended workaround for stuck subnet associations?
Tags: client-vpn, subnet-association, eu-west-1, vpc, networking
Incidentally, no issues were recorded in the Health dashboard. https://health.aws.amazon.com/health/status
I can confirm that "AssociateClientVpnTargetNetwork" was successful for both our attempts today to associate but still it is stuck, the for the client handler Pending-associate and for the network associating.
Does the response to the following command include any error messages? If there are no errors, it's likely an AWS issue rather than a user issue, and you'll probably need to contact AWS support. https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-client-vpn-target-networks.html
Please also check whether we are in compliance with the limitations described in the following documentation.
https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is-best-practices.html