Connect an on-premises network to AWS with Site-to-Site VPN.
Dynamically use the other tunnel when one tunnel fails.
Which design is most appropriate?
Use two VPN tunnels with BGP dynamic routing so reachability changes can select the surviving path.
Detailed explanation
Redundant tunnels and BGP allow routes to be exchanged and adjusted when a tunnel fails.
Redundant tunnels and BGP allow routes to be exchanged and adjusted when a tunnel fails.
There is no alternate path when the single tunnel fails.
There is no alternate path when the single tunnel fails.
S3 resource policies do not define network routes.
S3 resource policies do not define network routes.
DNS records do not exchange VPN routing information.
DNS records do not exchange VPN routing information.
Check official documentation
Compare the following points with the official documentation.
AWS Site-to-Site VPNのトンネルと動的ルーティングの公式説明を確認する。
What to confirm
VPNトンネル冗長性とBGPの役割を説明できる。
Key points
- Site-to-Site VPN
- BGP
- Redundant tunnels
Notes
- Environment: AWS公式VPNドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Path redundancy
Two tunnels provide an alternate path, while BGP can withdraw or prefer routes as state changes.
Routing versus naming
VPN routing operates at the network path layer; DNS records do not replace it.