Check routing table in virtual private gateway


I am using VPN Site to Site and Direct Connect. Both connect to VPC through virtual private gateway. When I tracert from on premises to AWS, it routes through Direct Connect. If DX down, it routes through VPN Site to Site But when i tracert from AWS VPC to onpremises, it still routes through VPN Site to Site first. How can we check routing table in virtual private gateway and change priority to DX first when connect from AWS to onpremises

1 Answer

The route table of the Virtual Private Gateway is what you have configured in your VPC route table, there is no separate table although the VGW does have logic.

From your description it looks like you could have a static. or more specific route advertised from the VPN, that takes priority over the routes from the Direct Connect.
For Example, If Direct Connect is advertising and VPN is advertising, addresses in the will go down the VPN.

If there are not more specific routes from the VPN it could be that both the Direct Connect and the VPN are advertising the same routes via BGP. In these cases the new BGP session generally take priority. What you would need to do is implement AS_PATH to provide preference information to AWS.
For Example, set Direct Connect AS_PATH 65001 (your ASN) and VPN AS_PATH as 65001,65001 this way Direct Connect will take preference in BGP because of the shorter path.

Take a look at vpn-route-priority which explains the route preferences in more detail.
Also look at DX Routing as it shows AS_PATH and also BGP local preference tags which could also help.

profile picture
answered a year ago
profile pictureAWS
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions