How to Make AWS Start a Site-to-Site VPN Tunnel
Startup action and DPD timeout action answer different questions. Set the one that makes AWS initiate, then check the peer address and the app's route.
By default, an AWS Site-to-Site VPN waits for the customer gateway to start the negotiation. That default is a setting, not a law, and the setting is called Startup action. Before you reach for it, separate two questions that get merged constantly: who establishes the tunnel, and whether the packets you care about have a route through it. Only the first one lives in the tunnel options.
Separate startup action from DPD timeout action
Two per-tunnel options govern two different events, and setting one says nothing about the other.
| Event | Option | Useful values |
|---|---|---|
| A new or modified VPN connection needs a tunnel | Startup action | add waits for the peer; start asks AWS to initiate |
| Dead peer detection times out | DPD timeout action | clear ends the session, restart reinitiates, none does nothing |
If AWS should bring up a new or changed tunnel, choose start. If AWS should also restart negotiation after a DPD timeout, configure restart for that event separately. Neither option is an application retry policy, and neither one is a rekey interval: DPD checks whether the peer is alive, while rekeying replaces security associations on a live tunnel.
An application that times out while the tunnel still reports up is a data-path problem. Shortening the DPD timer will not fix it, and it may add churn you have to explain later.
Check that AWS has somewhere to send the negotiation
AWS-side initiation is IKEv2 only, and AWS needs the customer gateway's public address to know where to send the proposal. A certificate-authenticated customer gateway resource created without an address is the case that bites: AWS documents creating a new customer gateway resource with the address and then modifying the VPN connection to point at it.
A certificate proves who the peer is. It does not tell AWS where the peer is, and those are different requirements. That is why the remedy is a new customer gateway resource rather than a new certificate. Swapping the certificate leaves AWS with the same missing destination.
If the customer gateway sits behind NAT, AWS also needs a configured responder identity, IDr, so the peer's identity matches what the device expects. Confirm that value and the firewall path that admits IKE traffic before you blame the option you just changed. Choosing start cannot make an unreachable or misidentified peer accept a proposal.
Apply the change to one tunnel and expect an interruption
A VPN connection has two tunnels with independent options, so confirm which one you are editing by its outside address. AWS allows modifying one tunnel at a time, and connectivity over the selected tunnel can be interrupted for several minutes.
- Select the Site-to-Site VPN connection and open Modify VPN tunnel options.
- Pick the tunnel by outside IP address and confirm its IKE version and customer gateway resource.
- Set the startup and DPD actions you actually want, then save during a window you control.
- Confirm the modified tunnel establishes, and check the other tunnel and routing before the next change.
One behaviour deserves attention before maintenance. With AWS initiation enabled there is no timeout: AWS keeps trying until the tunnel comes up, and it reinitiates when the customer gateway sends a delete-SA message. If you take the peer down deliberately, AWS will keep knocking, and the peer's logs will show it.
Verify the application path, not just the tunnel state
A tunnel reporting up is not the same as a working request. A VPC-attached Lambda function still needs a subnet route to the customer's prefix, security-group and network ACL rules that permit the traffic, name resolution that returns the right address, and a return path on the customer side.
Test with a real request from the application context once, then read the flow logs if it fails. Keepalive traffic is a legitimate option when AWS initiation is off and an idle tunnel needs packets to stay up, but it should be a monitoring decision you can name, not an unexplained ping loop bolted onto a function.
Choose who establishes the tunnel first, then diagnose the remaining failure at its own layer. The AWS initiation documentation covers the address, identity and retry requirements in more detail than the console hints do.