All checks

Medium EC2 · regional

Both VPN tunnels for an AWS Site-to-Site VPN connection should be up

Checks that both tunnels of the Site-to-Site VPN connection are UP; each ends in a different Availability Zone, so two keep the connection available when one fails. A tunnel is usually down because the customer gateway device is off or on a new IP, a firewall drops UDP 500, UDP 4500 or ESP, or its pre-shared key or IKE proposals no longer match.

service: EC2
severity: Medium
scope: evaluated in every region

How to fix it

Interrupts service: Saving tunnel options interrupts traffic over that tunnel for up to several minutes, so change one tunnel at a time and make any EC2.171 or EC2.183 change in the same save.

In the console

VPC → Site-to-Site VPN connections → the connection → Tunnel details

Details: AWS's reason a tunnel is DOWN; read it first, as most point at the customer gateway device
Actions → Modify VPN tunnel options → Startup action: Start, so AWS brings an idle tunnel up itself; IKEv2 only, and the customer gateway needs an IP address

See which of your accounts this check is failing on.

Book a live scan