Both tunnels of one AWS VPN connection leave through the same internet provider. A second provider is already installed and unused. One provider failure should leave a tunnel up. What should change?
Select an answer to reveal the explanation.
Short Explanation
Both spare lanes leave through the same toll booth, so one failure closes them together. You send one tunnel across the second internet provider you already have. A third tunnel on the first provider dies with that provider.
Full Explanation
The two tunnels of an AWS VPN connection protect against a tunnel or endpoint problem only if their underlay can fail independently. This design sends both through one internet provider, so that provider's failure takes both. Move one tunnel's route to the outside address across the second provider. A third tunnel on the first provider adds nothing when that provider is the failure. A longer IKE lifetime does not make a dead provider forward packets. Putting both tunnels on one provider address removes the split you need. Exam caveat: the second provider has to be able to reach the AWS outside address, and NAT, if any, has to present a source AWS expects. A new underlay that AWS rejects is not a backup. Operational check: shut the first provider and confirm one tunnel stays up over the second, with the VPC prefix still installed.