Both tunnels of an AWS VPN connection are up. Encrypt counters rise on tunnel 1 and decrypt counters rise on tunnel 2. A campus firewall requires the return on the same tunnel and is dropping the flow. What is the mismatch?
Select an answer to reveal the explanation.
Short Explanation
You leave through one tunnel and AWS answers through the other. Both are up, which is why one counter encrypts and the other decrypts. Your firewall demands the same tunnel in both directions and drops the flow, which is asymmetry rather than a dead security association.
Full Explanation
AWS can use either tunnel of a VPN connection for return traffic. Here the campus encrypts on tunnel 1 and the decrypt counter on tunnel 2 is the return. Both SAs are up. A firewall that requires the same tunnel for both directions drops the flow. The repair is to accept both tunnels, or to steer AWS's return onto tunnel 1 with BGP policy such as AS-path prepending, depending on what the firewall can be changed to allow. Counters would not rise on a down SA. The virtual private gateway does not run OSPF to hash directions onto tunnels. A pre-shared key that matched on only one tunnel would leave the other SA down. Both are up, so both keys worked. Exam caveat: forcing symmetry with BGP is a policy choice. If the firewall can allow the pair, that is simpler than pinning AWS to one tunnel and losing the second as a live return path. Operational check: a capture should show the request on tunnel 1 and the reply on tunnel 2, and after the firewall or the BGP policy changes, the session should complete.