The Rules of Uninterrupted AWS Site-to-Site VPN Operations: Preventing Maintenance Outages with BGP and Lifecycle Control

AWS Site-to-Site VPN provides 2 IPsec tunnels per connection for high availability, and each tunnel runs on an independent physical host in a different Availability Zone (AZ). AWS continuously performs maintenance on tunnel endpoints to improve performance, and during this process the corresponding tunnel goes down temporarily.

The main cause of outages experienced by many users is the use of Static routing. Static routing is not aware of the actual state of the tunnel, causing a blackhole phenomenon where traffic continues to be forwarded to a tunnel undergoing maintenance.

On the other hand, using BGP (Border Gateway Protocol) offers the following benefits.

• Automatic path switching: When a tunnel failure is detected, the path is automatically switched by the BGP Hold Timer.
• Proactive traffic control: Before maintenance, AWS safely terminates the BGP session and switches traffic to the other tunnel first to minimize service loss.

For stable operations, it is essential to use BGP instead of Static routing, and when configuring BGP, the use of attributes such as Weight and Local Preference, which take precedence over AWS's MED attribute, should be avoided.