For more information, see How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?

Verify whether the configured Site-to-Site VPN connection options, including remote and local IP addresses, match the security association specified on the customer gateway device.

Verify that there is no security association or traffic selector mismatch between AWS and the customer gateway device.

For more information, see the Use Diffie-Hellman Perfect Forward Secrecy section.

Verify that Diffie-Hellman Perfect Forward Secrecy (PFS) is active and is using Diffie-Hellman groups for key generation.

IKEv1 Data Integrity: SHA-1, SHA2-256, SHA2-384, SHA2-512ĭiffie-Hellman Perfect Forward Secrecy: Enabled Note: The example IKEv1 and IKEv2 Phase 2 and IKEv2 Child_SA parameters specify the minimum requirements for a Site-to-Site VPN connection of:ĪWS Phase 2 parameters: AES128, SHA1, Diffie-Hellman group 2ĪWS GovCloud (US) Phase 2 parameters: AES128, SHA2, Diffie-Hellman group 14

Verify that the supported Phase 2 parameters for IKEv1 and IKEv2 are configured correctly:.

To do so, compare your settings against the VPN configuration file that you downloaded from the Site-to-Site VPN console.

Verify that the Site-to-Site VPN Phase 2 parameters are configured correctly on your customer gateway device.

If your Site-to-Site VPN Internet Protocol security (IPsec/Phase 2) fails to establish a connection, then try the following steps to resolve the problem:

Ipsecuritas not starting