Question

A company has a single on-premises data center with one customer gateway device connecting to an AWS Site-to-Site VPN attached to a Transit Gateway. The VPN connection automatically provides two tunnel endpoints, but the network team has configured BGP on only the first tunnel; the second tunnel remains administratively down. During a recent AWS-scheduled endpoint maintenance event, the entire connection dropped, causing an outage. The team wants to implement the AWS-recommended configuration to survive endpoint maintenance without purchasing additional hardware or a second circuit. What should they do?

Accepted Answer

Configure BGP on both tunnels of the existing VPN connection so the customer gateway maintains active sessions to both tunnel endpoints simultaneously.

Answer

Create a second Site-to-Site VPN connection to a second Transit Gateway in another Region and use Route 53 failover between them.

Answer

Enable Accelerated Site-to-Site VPN so AWS Global Accelerator eliminates the need for a second tunnel.

Answer

Attach a virtual private gateway in addition to the Transit Gateway so the second tunnel terminates on the VGW for redundancy.