You have Direct Connect plus two VPN tunnels to the same VPC. How does AWS pick a path, and how do you steer it?
Show the answer
Say this first
Longest prefix match comes first. For the same prefix on a virtual private gateway, AWS prefers Direct Connect BGP routes, then static VPN routes, then BGP VPN routes. Between BGP VPN paths it takes the shortest AS path, then the lowest MED. So I steer AWS's return traffic with prefix length and AS path prepending on the backup, and I steer my outbound traffic with local preference on my own routers.
Go deeper
AWS side (traffic from the VPC to on-prem)
- Most specific prefix wins. Advertising
10.20.0.0/16over DX and10.0.0.0/8over VPN keeps traffic on DX until the/16is withdrawn. - Same prefix: Direct Connect BGP, then VPN static, then VPN BGP.
- Between VPN BGP routes: shortest AS path, then lowest MED.
To make tunnel 2 the backup, advertise the same prefixes on it with a prepended AS path:
route-map AWS-TUN2-OUT permit 10
set as-path prepend 65010 65010
!
router bgp 65010
address-family ipv4
neighbor 169.254.20.1 route-map AWS-TUN2-OUT outYour side (traffic from on-prem to AWS)
Your routers choose. Set a higher local preference on routes learned over DX, and keep the VPN routes at the default 100 so they are used only when DX disappears.
Transit gateway is different
A TGW can ECMP across VPN tunnels when the paths are equal and ECMP is enabled. That is a feature for bandwidth, and a trap when you wanted active-standby: then make the paths unequal on purpose.
They will ask next
Traffic leaves on-prem over DX but returns over the VPN. Why is that bad?
Asymmetric routing through stateful firewalls on-prem breaks sessions, and the VPN may not have the bandwidth. Make the AWS side prefer DX, usually by advertising the same prefixes on both and letting DX win, or more specific prefixes on DX.
Why can a static VPN route beat your BGP VPN route?
Static VPN routes rank above BGP VPN routes for the same prefix. A forgotten static route on the VPN connection can pin traffic to one tunnel and ignore BGP failover logic.
Traps
- Using local preference to influence AWS. It never leaves your AS; AWS cannot see it.
- Advertising a more specific prefix over the VPN by accident and pulling all traffic off DX.