Study guide

Technical reference and lesson notes

AWS Site-to-Site VPN: Architecture, Routing, and Tunnel Configuration

Purpose of This Lesson

AWS Site-to-Site VPN provides an AWS-managed, IPsec-based encrypted connection between a VPC and an on-premises or corporate network. This lesson focuses on the components involved, routing choices, tunnel configuration, route propagation, and how the virtual private gateway selects among competing routes.

Key Concepts

Virtual private gateway (VGW): The VPN concentrator on the AWS side. It is attached to a VPC and provides the AWS endpoint for the VPN connection.
Customer gateway device: The physical device or software application located in the customer’s on-premises network. It terminates the VPN connection on the customer side.
Customer gateway resource: An AWS resource that represents the on-premises customer gateway device. Creating this resource does not place the physical device in AWS.
VPN connection: The encrypted connection between the VGW or transit gateway and the customer gateway device.
Two VPN tunnels: Each Site-to-Site VPN connection provides two tunnels for redundancy between the AWS endpoint and the customer gateway.
Static routing: Routes are configured explicitly for the remote network.
Dynamic routing: BGP is used to advertise routes between the customer gateway and AWS. The customer gateway device must support BGP advertising.
Route propagation: A VPC route table can be configured to automatically receive routes known by the virtual private gateway.
Longest prefix match: When multiple routes apply, the most specific matching CIDR block is preferred.

Site-to-Site VPN Architecture and Traffic Flow

A typical connection contains these elements:

A VPC on AWS with a virtual private gateway attached to it.
A customer gateway resource configured in AWS to represent the on-premises VPN device.
A physical or software-based customer gateway device in the corporate data center.
The internet or another private network path between the two endpoints.
An encrypted VPN connection containing two tunnels.

For an instance in a private subnet to reach the corporate network, the VPC route table must contain a route whose destination is the corporate network CIDR and whose target is the VGW. The customer-side routing configuration must also contain the corresponding route back to the VPC so that communication is bidirectional.

A route pointing to the VGW does not, by itself, guarantee connectivity. The remote device must know how to return traffic, and the VPN must know the relevant remote prefixes through either static configuration or BGP advertisements.

Routing, Reachability, and Path Selection

Static and dynamic routing

With static routing, routes to the remote network are manually configured. The VPC route table must point the remote CIDR to the VGW, and the customer-side device must be configured with a route to the VPC network.

With dynamic routing, BGP exchanges route information between the customer gateway and AWS. The customer gateway must support BGP advertising, and the relevant prefixes must be advertised or otherwise known to the VPN endpoint.

Route propagation can be enabled on a VPC route table so that routes learned by the VGW are automatically added to the table. This reduces manual route-table maintenance, but the resulting route set still determines which destinations can receive traffic.

Prefix restrictions

The virtual private gateway only accepts traffic for prefixes that are known through one of the following mechanisms:

BGP advertisements
Static route entries
The VPC’s attached CIDR range

The VGW does not route arbitrary traffic to destinations outside the prefixes it knows from these sources.

Virtual private gateway route preference

The VGW uses path selection when it receives multiple possible routes. The longest prefix match is evaluated first, so the most specific CIDR wins. If matching prefixes are the same, the preference order described in the lesson is:

BGP-propagated routes from AWS Direct Connect
Manually added static routes for a Site-to-Site VPN connection
BGP-propagated routes from a Site-to-Site VPN connection

When matching prefixes are learned through multiple BGP-based Site-to-Site VPN connections, the path with the shortest AS path is preferred.

VPN Tunnel Configuration Options

A Site-to-Site VPN tunnel can be configured with several security and network parameters:

Dead peer detection timeout: Determines the timeout behavior for detecting an unavailable peer.
IKE versions: Specifies which Internet Key Exchange versions are permitted.
Inside tunnel IPv4 or IPv6 CIDR range: Defines the internal address range used within the VPN tunnel.
Local IPv4 or IPv6 network CIDR: Identifies the customer-side network range.
Remote IPv4 or IPv6 network CIDR: Identifies the AWS-side network range.
Encryption algorithms: Algorithms can be selected for the different phases of VPN negotiation.
Pre-shared key: The default method identified in the lesson for establishing the initial IKE security association.
Private certificate: A private certificate from AWS Certificate Manager can be used instead of the default pre-shared-key approach.

The tunnel’s security settings and address ranges must be compatible with the customer gateway device. Configuration mismatches can prevent tunnel establishment even when the network routes are correct.

Exam- or Assessment-Relevant Takeaways

Distinguish the VGW, which is the AWS-side VPN concentrator, from the customer gateway device, which is deployed on-premises.
A customer gateway resource is created in AWS, but it only represents the actual customer gateway device; it is not the physical device itself.
A Site-to-Site VPN connection provides two tunnels for redundancy.
Choose static routing when routes are explicitly configured, and BGP dynamic routing when the customer gateway supports route advertisements.
For VPC-to-on-premises traffic, the VPC route table needs a route to the remote CIDR with the VGW as its target.
Return routing on the customer side is required for bidirectional connectivity.
Route propagation can automatically add routes learned by the VGW to a VPC route table.
The VGW only routes traffic for known prefixes; it is not a general-purpose route to arbitrary destinations.
Apply longest prefix match before considering route preference.
For equal prefixes, remember the stated preference order: Direct Connect BGP, VPN static, then VPN BGP. For equal-prefix BGP VPN paths, the shortest AS path is preferred.

Tool / Feature Decision Guide

Requirement or situation	Appropriate choice	Reason
The remote device does not support BGP	Static routing	Routes are explicitly defined rather than learned dynamically.
The organization needs dynamic route exchange	BGP dynamic routing	The customer gateway advertises prefixes to AWS, assuming the device supports BGP.
The route table should receive VGW-learned routes automatically	Route propagation	AWS can propagate known VGW routes into the VPC route table.
A connection must tolerate failure of one VPN path	Use the Site-to-Site VPN’s two tunnels	The connection includes two tunnels for redundancy.
A remote network must access a VPC private subnet	Add a route for the remote CIDR with the VGW target and configure return routing	Both AWS-side and customer-side routing are required.
Multiple routes match the same destination	Evaluate longest prefix, then the stated preference order	Specificity is considered before route-source preference.
Equal-prefix routes come from multiple BGP VPN connections	Compare AS paths	The shortest AS path is preferred.

Common Traps / Misconceptions

Confusing the customer gateway resource with the customer gateway device: The AWS resource is a representation and configuration object; the actual device or software runs in the customer network.
Assuming the VGW automatically routes all destinations: It only routes prefixes known through BGP, static routes, or the attached VPC CIDR.
Adding only the AWS route: The customer gateway also needs a route back to the VPC for bidirectional communication.
Treating two tunnels as two unrelated VPN connections: The two tunnels belong to the same Site-to-Site VPN connection and provide redundancy.
Assuming route propagation eliminates all routing work: Propagation can populate the VPC route table, but customer-side routing and correct prefix advertisements still matter.
Choosing a routing mode without checking the device: Dynamic routing requires a customer gateway device that supports BGP advertising.
Ignoring CIDR specificity: When routes overlap, the longest prefix match is evaluated before the stated route-source preference.
Treating encryption settings as independent of the customer device: IKE versions, algorithms, keys or certificates, tunnel CIDRs, and related settings must be compatible at both ends.

Real-World Engineer / Analyst Notes

When troubleshooting a Site-to-Site VPN, separate the problem into layers:

Tunnel establishment: Check IKE versions, encryption algorithms, authentication material, tunnel address ranges, and dead peer detection settings.
Route learning: Confirm that static routes or expected BGP advertisements exist.
VPC route-table selection: Verify that the destination CIDR points to the VGW or that route propagation has installed the expected route.
Customer-side return path: Confirm that the on-premises device has a route back to the VPC CIDR.
Competing routes: If connectivity follows an unexpected path, compare prefix lengths first, then route source and AS path where applicable.

The presence of an established tunnel does not prove that application traffic can flow. Tunnel status, route knowledge, route-table targets, and return routing all need to align.

Quick Reference Summary

AWS Site-to-Site VPN is an AWS-managed IPsec VPN.
The VGW is the AWS-side endpoint and VPN concentrator attached to a VPC.
The customer gateway device is on-premises; the customer gateway resource in AWS represents it.
Each VPN connection provides two tunnels for redundancy.
Routing can be static or dynamic through BGP.
VPC routes to on-premises CIDRs target the VGW.
Route propagation can automatically add VGW-known routes to a VPC route table.
Only known prefixes are routable through the VGW.
Longest prefix match takes precedence.
For equal prefixes, the stated order is Direct Connect BGP, VPN static, and VPN BGP; equal-prefix BGP VPN paths use the shortest AS path.

Flashcards

Q: An on-premises network must reach instances in a VPC private subnet over Site-to-Site VPN. What AWS-side route is required?

A: The private subnet’s route table needs a route for the on-premises CIDR with the virtual private gateway as the target. The customer-side device also needs a return route to the VPC.

Q: What is the difference between a virtual private gateway and a customer gateway device?

A: The VGW is the AWS-side VPN concentrator attached to the VPC. The customer gateway device is the physical device or software application deployed in the on-premises network.

Q: What does the customer gateway resource created in AWS represent?

A: It represents the customer gateway device in the on-premises network. Creating the AWS resource does not create or move the physical customer device into AWS.

Q: When should static routing be selected instead of BGP routing?

A: Use static routing when routes should be explicitly configured or the customer gateway does not support BGP advertising. BGP requires a customer gateway device capable of dynamic route exchange.

Q: What is the operational benefit of enabling route propagation on a VPC route table?

A: Routes known by the virtual private gateway can be automatically added to the route table, reducing manual route-entry maintenance.

Q: What happens if the VGW receives traffic for a prefix that is not known through BGP, a static route, or the attached VPC CIDR?

A: The VGW does not route that traffic because the destination prefix is outside its known routes.

Q: How many tunnels does a Site-to-Site VPN connection provide, and why?

A: It provides two VPN tunnels to provide redundancy between the AWS VPN endpoint and the customer gateway.

Q: When multiple routes match a destination, what routing rule is evaluated first?

A: Longest prefix match is evaluated first, so the most specific matching CIDR is preferred.

Q: For equal prefixes, which route sources are preferred according to the lesson?

A: The order is BGP-propagated Direct Connect routes, manually added VPN static routes, and VPN BGP-propagated routes.

Q: Two BGP-based Site-to-Site VPN connections advertise the same prefix. Which path is preferred?

A: The path with the shortest AS path is preferred when the matching prefixes are the same.

Q: What configuration categories can be specified for a VPN tunnel?

A: Examples include dead peer detection timeout, IKE versions, inside tunnel CIDRs, local and remote network CIDRs, encryption algorithms, and authentication using a pre-shared key or private AWS Certificate Manager certificate.

Q: A tunnel is established, but traffic only works in one direction. What should be checked first?

A: Check the customer-side return route to the VPC and verify that the AWS route table has the correct route to the customer CIDR through the VGW.

Practice Questions

Question 1

A company’s on-premises VPN appliance does not support BGP. The company needs connectivity to a VPC over Site-to-Site VPN. Which routing approach is appropriate?

A. Use BGP because Site-to-Site VPN requires dynamic routing

B. Use static routes on both the AWS and customer sides

C. Use route propagation without configuring any customer-side routes

D. Use Direct Connect BGP instead of VPN

Correct answer: B

Explanation: Static routing is supported and does not require the customer gateway device to support BGP. Both sides still need routes for bidirectional connectivity.

Question 2

A private-subnet instance can send traffic toward an on-premises CIDR, but responses never arrive. The VPN tunnels are established. Which issue is the most likely cause?

A. The VGW has only one tunnel

B. The customer gateway lacks a return route to the VPC CIDR

C. The VPC route table must target the customer gateway resource

D. The VPN cannot carry traffic from private subnets

Correct answer: B

Explanation: An established tunnel does not ensure bidirectional routing. The customer-side device must know how to return traffic to the VPC.

Question 3

A VPC route table should automatically receive routes learned through BGP from a virtual private gateway. Which feature should be enabled?

A. Route propagation

B. Dead peer detection

C. IKE version negotiation

D. Customer gateway replacement

Correct answer: A

Explanation: Route propagation automatically propagates network routes known to the VGW into the VPC route table.

Question 4

A VGW has two matching routes for a destination: one learned through VPN BGP with a broader CIDR and one manually configured VPN static route with a more specific CIDR. Which route should be preferred?

A. The VPN BGP route because dynamic routes always win

B. The VPN static route because static routes always win

C. The more specific route because longest prefix match is evaluated first

D. Neither route because a VGW cannot use overlapping prefixes

Correct answer: C

Explanation: Longest prefix match takes precedence over route-source preference. The more specific CIDR is selected before comparing equal-prefix route types.

WordPress Metadata

Suggested Slug:
aws-site-to-site-vpn-routing-tunnel-configuration

Meta Description:
Study AWS Site-to-Site VPN architecture, gateways, routing modes, tunnel options, route propagation, and virtual private gateway path selection for the SOA-C03 exam.

Tags:
AWS Site-to-Site VPN, AWS Certified CloudOps Engineer, SOA-C03, VPN routing, Virtual Private Gateway, Customer Gateway, BGP, AWS Direct Connect, VPC route tables, IPsec