AWS transit gateway with redundant tunnels¶

Connect a Vipilink network to your Amazon VPCs through an AWS transit gateway, with two IPsec tunnels: one from each of two Vipilink gateways. If one tunnel or gateway goes down, traffic keeps flowing through the other.

BGP runs over both tunnels. The transit gateway learns the Vipilink routes from BGP, so you don't add static routes to it. You still add one static route in your VPC and one in Vipilink.

How it fits together¶

Example used on this page¶

Replace these with your own values.

All the AWS pages used below are in the VPC console, in the left menu under Virtual private network (VPN) and Transit gateways.

Step 1: Create two customer gateways¶

Each customer gateway represents one Vipilink gateway. If you already created them, for example on the AWS virtual private gateway with redundant tunnels page, reuse them and go to Step 2.

1. In the Vipilink console, open your network and note the public IP of each gateway.

2. In the AWS console, go to Virtual private network (VPN) → Customer gateways and click Create customer gateway.

   

3. Create the first customer gateway:

   Field	Value
   Name tag	vipilink-gw-new-jersey
   BGP ASN	64520
   IP address	Public IP of the first Vipilink gateway

   

4. Repeat for the second gateway, for example vipilink-gw-miami, with BGP ASN 64520 and the public IP of the second Vipilink gateway.

   

Step 2: Create a transit gateway and attach your VPC¶

If you already have a transit gateway attached to your VPC, for example from the AWS transit gateway page, reuse it and go to Step 3.

1. Create the transit gateway as described in AWS transit gateway, Step 2. Keep VPN ECMP support, Default route table association and Default route table propagation selected.
2. Attach your VPC as described in AWS transit gateway, Step 3.

Step 3: Create two Site-to-Site VPN connections¶

Create one VPN connection for each customer gateway. When the target is a transit gateway, AWS also creates the transit gateway attachment for each connection, so you don't create attachments yourself.

1. Go to Virtual private network (VPN) → Site-to-Site VPN connections and click Create VPN connection.

   

2. Fill in the form:

   Field	Value
   Name tag	vipilink-vpn-new-jersey
   Target gateway type	Transit gateway
   Transit gateway	vipilink-tgw
   Customer gateway	Existing
   Customer gateway ID	vipilink-gw-new-jersey
   Routing options	Dynamic (requires BGP)

   Leave the other fields, including Tunnel 1 options and Tunnel 2 options, at their defaults.

   

3. Click Create VPN connection.

4. Repeat for the second customer gateway, with the name vipilink-vpn-miami and the customer gateway vipilink-gw-miami.

Wait until both connections show Available. This can take a few minutes. The Transit gateway column shows your transit gateway.

Step 4: Name the VPN attachments¶

1. Go to Transit gateways → Transit gateway attachments. You see one new attachment of type VPN for each VPN connection. The Resource ID shows which VPN connection it belongs to.
2. For each one, point to its empty Name cell, click the pencil icon and enter a name, for example vipilink-tgw-vpn-new-jersey and vipilink-tgw-vpn-miami.

Step 5: Download both configuration files¶

1. Go to Virtual private network (VPN) → Site-to-Site VPN connections. Select the first VPN connection (1) and click Download configuration (2).

   

2. Choose these options and click Download:

   Field	Value
   Vendor	Generic
   Platform	Generic
   Software	Vendor Agnostic
   IKE version	ikev2

   

3. Repeat for the second VPN connection. Rename the files so you know which gateway each one belongs to, for example add _new-jersey and _miami to the names.

Step 6: Route VPC traffic to the transit gateway¶

The transit gateway learns the Vipilink routes from BGP once the tunnels are up, so it needs no static route. Your VPC still needs one.

1. Go to Virtual private cloud → Route tables (1) and select the route table used by your VPC subnets (2).

2. Open the Routes tab (3) and click Edit routes (4).

   

3. Click Add route:

   • Destination: your Vipilink network subnet, for example 10.14.0.0/16
   • Target: Transit Gateway, then choose vipilink-tgw
4. Click Save changes.

If your VPC subnets use more than one route table, add the route to each of them.

Step 7: Add the dual tunnel in Vipilink¶

1. In the Vipilink console, open your network. On either gateway card, click the ... menu and choose Add Tunnel.

   

2. Choose IPsec Site-to-Site Tunnel (1) and click Continue. Then choose Dual-Tunnel (2) and click Continue.

   

   Tip

   Dual-Tunnel is only available when the network has at least two gateways.

3. Enter a Tunnel Name, for example AWSTransitHA. Use letters and numbers only, up to 13 characters. Vipilink names the two tunnels AWSTransitHA 1 and AWSTransitHA 2.

   

4. Open the first tunnel section. Click Upload and select the first configuration file. Then make sure Gateway shows the Vipilink gateway that file belongs to.

   

5. Open the second tunnel section, upload the second file and check Gateway the same way.

   

   Vipilink fills in the pre-shared key, internal IPs, remote public IP, remote AS number and remote ID from each file. To enter them by hand instead, see Enter the tunnel values by hand.

   Match each file to its gateway

   Each file belongs to the customer gateway of one Vipilink gateway. The Customer Gateway outside IP in the file is the public IP of that Vipilink gateway. If a file is paired with the wrong gateway, that tunnel will not come up.

6. In Shared Settings, keep Vipilink Side Subnets and Remote Side Subnets set to Any. The Vipilink ASN is fixed at 64520.

   

7. Keep the Advanced Settings defaults: IKE V2, IKE lifetime 8h, tunnel lifetime 1h, DPD 10s / 30s, aes256, sha256 and group 14. AWS accepts them.

8. Click Add Tunnel. The tunnel cards show Deploying Tunnel with a progress bar until the tunnels are set up.

Enter the tunnel values by hand¶

If you can't upload the files, copy the values from them. Each file has two sections, IPSec Tunnel #1 and IPSec Tunnel #2. Use IPSec Tunnel #1 only. The file calls the AWS side Virtual Private Gateway, even for a transit gateway.

This is the part of the file you need, with the values replaced by placeholders:

IPSec Tunnel #1
================================================================================
#1: Internet Key Exchange Configuration
  - Pre-Shared Key           : <pre-shared key>                      [1]
  ...

#3: Tunnel Interface Configuration
Outside IP Addresses:
  - Customer Gateway                  : <Vipilink gateway public IP>  [2]
  - Virtual Private Gateway           : <AWS tunnel public IP>        [3]

Inside IP Addresses
  - Customer Gateway                  : 169.254.70.66/30              [4]
  - Virtual Private Gateway           : 169.254.70.65/30              [5]
  ...

#4: Border Gateway Protocol (BGP) Configuration:
  - Customer Gateway ASN              : 64520
  - Virtual Private Gateway ASN       : 64512                         [6]

Customer Gateway ASN must be 64520, the Vipilink ASN. If it isn't, the customer gateway was created with the wrong ASN. See Step 1.

Do the same with the second file for the second tunnel section.

Step 8: Route Vipilink traffic to the VPC¶

1. On the network card, click the ... menu and choose Route Table.

   

2. Click Add Routes, choose the dual tunnel, enter the VPC CIDR (for example 10.50.0.0/16) and click Add Routes. If you attached more VPCs to the transit gateway, enter each VPC CIDR.

   

3. The route appears in the table with the type Manual. It covers both tunnels.

   

Step 9: Check the connection¶

1. In the Vipilink console, both tunnel cards show Up.

   

2. In the AWS console, open Tunnel details for each VPN connection. Tunnel 1 shows Up, and Details shows the number of BGP routes received.

   

   Tunnel 2 shows Down

   This is expected. AWS creates two tunnels for every VPN connection, and each Vipilink gateway uses one of them. AWS also shows a banner saying the connection is not using both tunnels. Redundancy comes from the two VPN connections and the two Vipilink gateways.

3. Go to Transit gateways → Transit gateway route tables, select the route table and open the Routes tab. You see the routes the transit gateway learned from Vipilink, all with the route type Propagated:

   • Your Vipilink network subnet (1), through 2 Attachments: both tunnels can carry it.
   • Smaller ranges (2), each through one VPN attachment. Each Vipilink gateway announces the ranges that belong to it, so replies to a user go back through the gateway that user is connected to.

   

   If one Vipilink gateway or tunnel goes down, its routes disappear from this table and traffic uses the other tunnel.

4. Connect a device to the network with the Vipilink agent and reach a resource in the VPC, for example with ping or SSH to a private IP.

   

Troubleshooting¶