SCS-C02 Question 339
Select 2Your company has deployed a site-to-site VPN connection between your on-premises data center and your AWS VPC using an AWS Virtual Private Gateway. After completing the setup, you notice that the VPN connection frequently drops and does not automatically re-establish. Which of the following could be potential reasons for this issue? (Select TWO.)
- A
The on-premises VPN device does not support Dead Peer Detection (DPD).
- B
The AWS Virtual Private Gateway is incorrectly configured to use GRE tunnels instead of IPsec.
- C
The network ACLs on the VPC subnets are blocking UDP port 500 and UDP port 4500.
- D
The on-premises VPN device is not configured to use the same pre-shared key as the AWS configuration.
- E
The AWS Virtual Private Gateway is configured to use static routing instead of dynamic routing.
Show answer and explanation
Correct answers: A, C
Explanation
The issue of frequent drops and failure to re-establish a VPN connection is often caused by misconfigurations or unsupported features on the on-premises VPN device or incorrect network configurations on AWS. Dead Peer Detection (DPD) ensures that dropped connections are detected and re-established, so a lack of support for DPD can result in dropped connections not being automatically restored. Additionally, VPN traffic relies on UDP ports 500 and 4500, and these must be allowed by the VPC network ACLs. Other options, such as GRE tunnels and routing settings, are unrelated to the described issue.
- A. Correct.
Correct. Dead Peer Detection (DPD) is a mechanism used in IPsec to detect if the other side of the VPN tunnel is still active. If the on-premises VPN device does not support DPD or it is misconfigured, the VPN connection may drop and not re-establish automatically.
- B. Incorrect.
Incorrect. AWS Virtual Private Gateways use IPsec for VPN connections, and they do not support GRE tunnels. This is not a valid reason for the issue.
- C. Correct.
Correct. The network ACLs on the VPC subnets must allow traffic for UDP port 500 (IKE) and UDP port 4500 (NAT-T) for the VPN connection to establish and function properly. Blocking these ports can cause VPN instability.
- D. Incorrect.
Incorrect. While mismatched pre-shared keys can cause a VPN connection to fail initially, they do not cause an already established VPN connection to drop intermittently.
- E. Incorrect.
Incorrect. The routing configuration (static or dynamic) does not impact the stability of an established VPN connection. This is unrelated to the issue described.