A Site-to-Site VPN has two tunnels, but on-premises to VPC traffic fails intermittently.
Use AWS-side observations to identify a tunnel or route-exchange problem.
Which combination should be checked?
Check the TunnelState metric, VPN logs, and BGP routes to separate tunnel and route-exchange failures.
Detailed explanation
Adding a DNS record does not repair tunnel state or route exchange.
Adding a DNS record does not repair tunnel state or route exchange.
Storage and CDN values do not show VPN tunnel or BGP route state.
Storage and CDN values do not show VPN tunnel or BGP route state.
These observations cover tunnel liveness, negotiation details, and advertised or received routes.
These observations cover tunnel liveness, negotiation details, and advertised or received routes.
Application target health cannot establish whether the on-premises VPN path is available.
Application target health cannot establish whether the on-premises VPN path is available.
Check official documentation
Compare the following points with the official documentation.
AWS Site-to-Site VPN monitoring, logs, and BGP routesの公式説明を確認する。
What to confirm
トンネル状態、VPNログ、BGP経路の観測対象を区別できる。
Key points
- TunnelState
- VPN logs
- BGP routes
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Failure isolation
A tunnel can be up while route exchange or reachability is still incorrect.
Hybrid evidence
Metrics, logs, and route tables provide complementary views of the same hybrid path.