Dx Vpn Diagnostics

Direct Connect & Site-to-Site VPN Diagnostics

When to use

Any Direct Connect or Site-to-Site VPN investigation where the console alone is insufficient — connection failures, VIF provisioning, BGP session debugging, VPN tunnel establishment, IKE/IPsec negotiation, routing propagation, failover validation, Transit Gateway integration, encryption, or performance troubleshooting.

Investigation workflow

Step 1 — Collect and triage

aws directconnect describe-connections
aws directconnect describe-virtual-interfaces
aws ec2 describe-vpn-connections
aws ec2 describe-vpn-gateways
aws ec2 describe-customer-gateways
aws directconnect describe-lags
aws directconnect describe-direct-connect-gateways

Step 2 — Domain deep dive

aws ec2 describe-transit-gateways
aws ec2 describe-transit-gateway-attachments
aws ec2 describe-transit-gateway-route-tables
aws ec2 describe-route-tables --filters Name=route.origin,Values=EnableVgwRoutePropagation
aws cloudwatch get-metric-statistics --namespace AWS/DX --metric-name ConnectionState --dimensions Name=ConnectionId,Value=<dxcon-id> ...
aws cloudwatch get-metric-statistics --namespace AWS/VPN --metric-name TunnelState --dimensions Name=VpnId,Value=<vpn-id> ...
aws cloudwatch get-metric-statistics --namespace AWS/DX --metric-name ConnectionBpsIngress --dimensions Name=ConnectionId,Value=<dxcon-id> ...

Read references/dx-vpn-guardrails.md before concluding on any Direct Connect or VPN issue.

Tool quick reference

Gotchas: Direct Connect & Site-to-Site VPN

• DX is NOT encrypted by default. Traffic traverses a dedicated line but is unencrypted. Use MACsec (802.1AE) for Layer 2 encryption on supported connections (10 Gbps and 100 Gbps) or run a VPN over DX for IPsec encryption.
• BGP session establishment requires matching ASN, BGP auth key, and correct VLAN tagging. AWS provides the BGP peer IP addresses — the customer router must be configured to peer with the AWS-side IP.
• VIF types matter: Private VIF connects to a single VPC via VGW, Public VIF accesses AWS public services (S3, DynamoDB endpoints), Transit VIF connects to Transit Gateway for multi-VPC access.
• DX failover to VPN requires proper BGP configuration. The VPN route must have a longer AS path or lower local preference so DX is preferred. Without correct BGP attributes, failover may not work as expected.
• VPN tunnel has a 1.25 Gbps limit per tunnel. This is a hard AWS limit. For higher throughput, use multiple VPN connections with ECMP on Transit Gateway.
• VPN uses two tunnels for redundancy — both should be UP. AWS performs maintenance on one tunnel at a time. If only one tunnel is configured, connectivity is lost during maintenance.
• LAG (Link Aggregation Group) requires all member connections to have the same bandwidth and terminate at the same AWS Direct Connect location. Mixing speeds or locations is not supported.
• DX Gateway enables multi-VPC and multi-region connectivity over a single DX connection. Without a DX gateway, each VPC requires its own VIF.
• Transit VIF vs Private VIF for Transit Gateway: Transit VIF connects DX to TGW for scalable multi-VPC routing. Private VIF connects to a single VPC via VGW. Use Transit VIF when connecting to multiple VPCs.

VIF type comparison

VPN tunnel limits

Anti-hallucination rules

1. Always cite specific connection states, BGP peer status, tunnel status, or CloudWatch metrics as evidence.
2. DX is NOT encrypted by default. Never claim DX provides encryption without MACsec or VPN overlay.
3. VPN has a 1.25 Gbps per-tunnel hard limit. Never suggest a single VPN tunnel can exceed this.
4. Both VPN tunnels should be UP. Never dismiss a single-tunnel-down state as acceptable for production.
5. LAG members must have the same speed and location. Never suggest mixing connection speeds in a LAG.
6. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

28 runbooks