S2S VPN tunnel IKE initiation when using Static routing with Policy-Based VPN



I'm trying to understand the options available when configuring s2s VPN with static routing and policy-based VPN enabled on the customer gateways side.

I can't find clear documentation around the IKE initiation option, and what is the supported startup action?

By default, the customer gateway is responsible for IKE initiation; if changing to AWS, will this be supported with a Policy-Based configuration, given that my customer gateway has a static IP address assigned?

I went through the following [1]. I can't see any limitations that apply to Policy Based.

[1] https://docs.aws.amazon.com/vpn/latest/s2svpn/initiate-vpn-tunnels.html

asked 10 months ago381 views
2 Answers

If you change the IKE initiation option so that AWS VPN endpoint bring the tunnel UP, you would have to use IKEv2 + Change "Startup action" from Add to Start.

Note that this is valid for when establishing a new VPN tunnel OR when you modify the VPN tunnel, for instance, if the tunnel goes down for some reason, then AWS VPN endpoint would not try to bring the tunnel UP, it would be the CGW responsibility to initiate the IKE negotiation.

Now IKE initiation and policy-based configuration are two different things, but Yes IKE initiation is supported with policy-based configuration or routed-based configuration as long as you use IKEv2.

Make sure you configure a single encryption domain (proxy id) on your CGW (Firewall) when using policy-based, because AWS is route-based VPN and only supports a single Security Association (SA), and each CIDR you put in the proxy id field on the firewall would great a security associations, so if you put three CIDRs (for instance,,, and then that would great three SAs, and here you may experience intermittent connectivity where only a single CIDR out of three would work at a time.

profile pictureAWS
answered 10 months ago
  • Does setting the DPD timeout action to Restart help with a VPN tunnel going down and force IKE initiation from the AWS side?

  • Yes, it does. It will restart the IKE session by having AWS try to initiate the IKE negotiation.


Policy based VPN works but has SA limitations, see this re:Post article:


As for IKE initiation, IKE initiation (startup action) from the AWS side of the VPN connection is supported for IKEv2 only.

It is documented here:


profile pictureAWS
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions