AWS - Azure Site-to-Site VPN - Only One Tunnel Up with BGP Routes (Second Tunnel Up, No BGP Routes)

This behavior is expected when connecting an AWS Transit Gateway to an Azure VPN Gateway in active-active mode. The issue stems from how Azure handles BGP peering in this configuration.

Azure VPN Gateway in active-active mode creates two separate gateway instances, each with its own public IP address. When you create a Site-to-Site VPN connection to AWS, Azure establishes one IPsec tunnel from each gateway instance. However, Azure's BGP implementation only establishes BGP peering through one of these tunnels at a time, even though both IPsec tunnels may show as UP.

This is not a misconfiguration on your part—it's an architectural characteristic of how Azure VPN Gateway operates. The second tunnel serves as a standby for IPsec connectivity, but BGP route exchange only occurs through the primary tunnel. If the first tunnel fails, Azure should fail over and establish BGP peering through the second tunnel, at which point you'd see the routes shift to tunnel 2.

For true active-active redundancy with both tunnels learning and advertising routes simultaneously, you would need to create two separate VPN connections in AWS (each with its own pair of tunnels) and configure Azure to peer with both connections. This way, each Azure gateway instance would have its own dedicated AWS VPN connection, allowing BGP to run actively on multiple tunnels concurrently.

Your current setup does provide redundancy—just not in an active-active BGP fashion. The second tunnel will take over route advertisement if the first fails, ensuring continuity of your connectivity.