AWS sends one subnet back through a dead tunnel and sends the rest of the range through the live tunnel. The campus still advertises that subnet toward the dead tunnel. BGP is up on the live tunnel. What should be withdrawn?
Select an answer to reveal the explanation.
Short Explanation
You’re seeing AWS prefer the more specific subnet advertisement that still points toward the dead tunnel. Withdraw that advertisement so the aggregate on the live tunnel can cover the subnet. Withdrawing the live aggregate would make the outage larger.
Full Explanation
Longest-match routing applies in AWS as well: the campus still advertises the subnet toward the dead tunnel, so AWS prefers that more specific path while the rest of the range uses the aggregate on the live tunnel. Withdraw the more specific subnet advertisement toward the dead tunnel; then the live tunnel’s aggregate can cover the subnet. Withdrawing the aggregate on the live tunnel would remove the working path for every other subnet, rather than fixing the stale specific route. The IKE identity on the live tunnel does not pin a BGP prefix to a dead tunnel, and the anti-replay window does not advertise routes. Exam caveat: if the subnet was advertised over the dead tunnel with a better AS path than the aggregate, withdrawing the specific advertisement lets the aggregate win; leaving the specific route in place and only raising MED may not be enough while path lengths differ. Practical check: verify that the live tunnel advertises the aggregate but not the more specific subnet, then confirm that AWS return traffic for that subnet uses the live tunnel.