VPN tunnel switching setting


Local firewall and VPC set up VPN, the ip of tunnel 1 is first prority and ip of tunnel 2 is second prority in the Local firewall When there is a problem with the ip of tunnel 1, AWS will failover to the tunnel 2 to keep communicate with local firewall. But when tunnel 1 is restored, AWS will not switch back to tunnel 1 to communicate with the firewall, but will continue to remain in tunnel 2. How to set up when tunnel 1 is restored, aws can also switch back to tunnel 1 to communicate with the local firewall

  • Are you using Static route based VPN or BGP based Dynamic VPN?

asked 2 years ago400 views
2 Answers
Accepted Answer


Simply put, the VPN tunnel is randomly chosen by AWS and is called the preferred tunnel. If your AWS VPN connection (static route type) has an active/active configuration (both tunnels are up), you cannot configure your preferred specific tunnel in AWS to send traffic.

But, for dynamic AWS VPN connections (Active/Active), you can set the customer gateway device to prefer one VPN tunnel over the other by leveraging the order of preference criteria:

  1. Advertising more specific prefix over preferred tunnel
  2. Advertising shorter ASPATH over the preferred tunnel
  3. Setting lower MED values over the preferred tunnel

Hope this helps

profile pictureAWS
answered 2 years ago


See this Knowledge center article:


Note also below from our documentation

We recommend that you use BGP-capable devices, when available, because the BGP protocol offers robust liveness detection checks that can assist failover to the second VPN tunnel if the first tunnel goes down. Devices that don't support BGP may also perform health checks to assist failover to the second tunnel when needed.

profile pictureAWS
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions