Site-to-Site VPN suddenly stopped routing /16 network, but works with individual /32 routes

This behavior typically indicates an IPsec Phase 2 Traffic Selector (Proxy ID) mismatch or a routing conflict (Longest Prefix Match).

Since the tunnel is UP, adding a /32 static route in AWS forces a new, highly specific Phase 2 Security Association (SA) proposal. The FortiGate is successfully negotiating this /32 SA, which means the underlying issue is isolated to the /16 Phase 2 negotiation failing, or being overridden elsewhere.

Recommended checks:

• Review the FortiGate IPsec logs for Phase 2 negotiation errors, specifically looking for Traffic Selector mismatches regarding the 10.104.0.0/16 subnet.
• Verify the AWS VPC Route Table to ensure no newly introduced overlapping routes (e.g., from a Transit Gateway or VPC Peering) are intercepting the /16 traffic.

Reference: AWS Site-to-Site VPN Troubleshooting (Check Phase 2 errors): https://docs.aws.amazon.com/vpn/latest/s2svpn/Troubleshooting.html

That sudden loss of routing for your /16 CIDR while /32 routes still work is a known behavior tied to how AWS Site‑to‑Site VPN handles static route propagation and prefix validation. It usually occurs after a backend update or when the customer gateway (FortiGate) stops advertising the aggregate prefix correctly.

https://docs.aws.amazon.com/vpn/latest/s2svpn/Troubleshooting.html

https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-edit-static-routes.html

https://docs.fortinet.com/document/fortigate/8.0.0/administration-guide/604285/phase-2-configuration

Hello @grokz Here are some steps you can take to troubleshoot and potentially resolve the issue:

1. Check Route Propagation and Advertisement Ensure that the routes are correctly propagated and advertised between AWS and the FortiGate.

FortiGate Configuration: Verify that the FortiGate is still advertising the 10.104.0.0/16 route to AWS. Check the FortiGate’s route table and VPN configuration to ensure it hasn’t changed. AWS Route Table: Confirm that the 10.104.0.0/16 route is still present in the AWS VPC route table and is associated with the Virtual Private Gateway. 2. Verify VPN Tunnel Configuration Ensure that both VPN tunnels are healthy and passing traffic.

AWS VPN Console: Check the AWS Management Console for the VPN connection status. Look for any recent changes or error messages. FortiGate VPN Monitor: Check the FortiGate’s VPN monitor to ensure both tunnels are up and passing traffic. 3. Examine Security Devices Sometimes security devices (like firewalls or IDS/IPS systems) can start blocking traffic due to policy changes or updates.

FortiGate Firewall Policies: Review the firewall policies on the FortiGate to ensure they haven’t changed or become more restrictive. AWS Security Groups/NACLs: Double-check that there haven’t been any inadvertent changes to Security Groups or NACLs that could be blocking the traffic. 4. Check for Route Flaps or Blackholing Route flaps or blackholing can cause intermittent connectivity issues.

FortiGate Route Monitoring: Use FortiGate’s route monitoring tools to check for any flapping routes. AWS CloudWatch: Look at CloudWatch metrics for any unusual activity or errors related to the VPN connection. 5. Test MTU and Fragmentation MTU (Maximum Transmission Unit) mismatches or issues with IP fragmentation can sometimes cause connectivity problems.

Path MTU Discovery: Ensure that Path MTU Discovery is working correctly. You can test this by sending large ping packets with the "Don't Fragment" bit set and adjusting the MTU accordingly. FortiGate MTU Settings: Check the MTU settings on the FortiGate and ensure they match the AWS side.