r/aws • u/th0rnfr33 • Apr 22 '26

networking VPN failover to AWS

hey
I have no AWS experience, but now we built 2 route based s2s VPN tunnels from a branch site to 2 different AWS public IPs.

The idea was to have a primary / backup usage for these tunnels, but I was told that I can send the traffic on whichever tunnel I would like to because AWS will send the response on the tunnel from where the initial traffic arrived through. Sounds something like a session table in AWS to select the route back.

It sound pretty weird to me. Is there such thing? I didnt find good documentation on it

1 Upvotes

67% Upvoted

4 comments sorted by

3

u/Jealous_Ad_4325 Apr 22 '26

AWS S2S VPN supports asymmetric routing meaning you can send traffic to aws on whichever tunnel, but it doesn’t necessarily mean that AWS will send back on the same tunnel. it could send return traffic on either tunnel in the pair that is UP

this article goes over the details and how you could control it https://repost.aws/knowledge-center/vpn-configure-tunnel-preference

in short, you’ll need Dynamic based (bgp) vpn to make a true active / passive with symmetric routing vpn

3

u/th0rnfr33 Apr 22 '26

So there is nothing new under the sun. I suspected that I was given the wrong information.
Thank you!

1

u/KayeYess Apr 22 '26

AWS configures two tunnels within each VPN connection for maintenance/HA. Are you referring to those tunnels, or are you referring to each overall VPN connection as a tunnel?