Connection with AWS Vpc

Question

Connection with AWS Vpc

Rai Shehroz 0

So I have established the connection with AWS VPC using VPN Gateway .It shows the tunnel has been established but when our resources try to communicate with each other it can not be done

Mythreya Asnala 0 Reputation points Microsoft External Staff Moderator

2026-08-07T10:51:39.4766667+00:00
Hello Rai,

Thank you for the update.

As you prefer not to use BGP, we can focus on validating the Site-to-Site VPN configuration using static routing.

Since the VPN tunnel is already showing as Connected, the issue is likely related to routing or traffic filtering rather than the tunnel establishment itself.

Could you please help verify the following:

Confirm that the Azure Local** Network **Gateway is configured with the correct AWS VPC address prefixes and that the AWS VPN configuration contains the correct Azure VNet address prefixes.

Verify that the Azure VNet and AWS VPC address spaces do not overlap.

Ensure that the required static routes are configured on both Azure and AWS so that traffic destined for the remote network is forwarded through the VPN tunnel.

Check whether any security controls are blocking the traffic, including:

Azure Network Security Groups (NSGs)

Azure Firewall (if applicable)

AWS Security Groups

AWS Network ACLs (NACLs)

If possible, please provide the results of connectivity tests (Ping/TCP test) between resources in Azure and AWS.

Additionally, please share the following details to help us narrow down the issue:

Azure VNet address space

AWS VPC address space

Screenshots of the VPN connection status from both Azure and AWS

Any custom route tables configured in Azure or AWS

3 answers

Your answer

Mythreya Asnala 0 Reputation points Microsoft External Staff Moderator

2026-08-07T10:51:39.4766667+00:00

Hello Rai,

Thank you for the update.

As you prefer not to use BGP, we can focus on validating the Site-to-Site VPN configuration using static routing.

Since the VPN tunnel is already showing as Connected, the issue is likely related to routing or traffic filtering rather than the tunnel establishment itself.

Could you please help verify the following:

Confirm that the Azure Local** Network **Gateway is configured with the correct AWS VPC address prefixes and that the AWS VPN configuration contains the correct Azure VNet address prefixes.

Verify that the Azure VNet and AWS VPC address spaces do not overlap.

Ensure that the required static routes are configured on both Azure and AWS so that traffic destined for the remote network is forwarded through the VPN tunnel.

Check whether any security controls are blocking the traffic, including:

Azure Network Security Groups (NSGs)

Azure Firewall (if applicable)

AWS Security Groups

AWS Network ACLs (NACLs)

If possible, please provide the results of connectivity tests (Ping/TCP test) between resources in Azure and AWS.

Additionally, please share the following details to help us narrow down the issue:

Azure VNet address space

AWS VPC address space

Screenshots of the VPN connection status from both Azure and AWS

Any custom route tables configured in Azure or AWS

Answer 1

Welcome to Microsoft Q&A

Hello @Rai Shehroz , I hope you are doing well.

Since you've confirmed that the VPN tunnel is established and you don't want to use BGP, the issue is likely related to the static routing or traffic configuration, rather than the VPN tunnel itself.

Please verify the following:

Ensure both the Azure Local Network Gateway and the AWS Customer Gateway/VPN configuration contain the correct static address prefixes for each network.
Confirm that the Azure and AWS virtual network/VPC address spaces do not overlap.
Verify that the required routes exist on both sides so that traffic is forwarded through the VPN tunnel.
Check that NSGs, Azure Firewall (if used), AWS Security Groups, and Network ACLs allow traffic between the Azure VNet and the AWS VPC.
Use Network Watcher Connection Troubleshoot or IP Flow Verify to confirm whether traffic is being allowed or blocked within Azure. review logs too

If the tunnel is Connected but traffic does not pass, it is typically due to routing or security rules, rather than the VPN Gateway itself.

References:

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions..

Answer 2

Rai Shehroz 0

i dont want to do it with bgp settings

0 comments

Answer 3

If the VPN shows Connected but traffic does not pass between Azure and AWS resources, check the Azure-to-AWS BGP VPN configuration end to end.

Verify the required topology.
- For this Azure-to-AWS BGP design, Azure should use a VPN gateway with active-active and BGP enabled.
- AWS uses two site-to-site VPN connections, each with two tunnels, for a total of four tunnels.
- In Azure, there should be four local network gateways and four connections to receive those four AWS tunnels.
- An active-passive Azure VPN gateway supports only one custom BGP APIPA, so it is not sufficient for multiple AWS tunnels.
Check Azure connection status.
- In Azure portal, open the virtual network gateway.
- Go to Connections.
- Confirm that all 4 connections show Connected.
Check Azure BGP peer status.
- In the same virtual network gateway, go to BGP Peers.
- Confirm that all peers show Connected and that routes are being exchanged.
- If BGP peers are not connected, traffic will not route even if the tunnel appears established.
Check AWS tunnel status.
- In the Amazon VPC console, open Site-to-Site VPN Connections.
- Select each connection and open Tunnel Details.
- Verify both tunnels show UP.
- Verify the tunnel details show one or more BGP routes.
Validate the Azure and AWS BGP settings.
- On AWS, the customer gateways for Azure should use BGP ASN 65000 if that is the ASN configured on the Azure VPN gateway.
- The AWS customer gateways should point to the first and second public IP addresses of the Azure VPN gateway.
- In Azure, the Custom BGP Address must match the AWS tunnel APIPA configuration used for that connection.
- For connections to Azure instance 0, only the Primary Custom BGP Address is used.
- For connections to Azure instance 1, only the Secondary Custom BGP Address is used.
Confirm the inside tunnel CIDRs and preshared keys match.
- AWS tunnel inside CIDRs must align with the APIPA configuration selected for the Azure side.
- The Shared key (PSK) in Azure must match the preshared key configured for the corresponding AWS tunnel.
Check for traffic selector or prefix mismatch.
- A tunnel can come up while traffic still fails if the prefixes advertised on AWS do not match what Azure expects.
- One documented case showed the issue was on the AWS side because AWS advertised a broader prefix than expected, causing a traffic selector mismatch.
- If this applies, update AWS to advertise the correct specific subnet or use wildcard traffic selector pairs that align with Azure.

A good minimum validation is:

Azure Connections: all 4 are Connected
Azure BGP Peers: all peers are Connected and exchanging routes
AWS Tunnel Details: all tunnels are UP and showing BGP routes
Azure/AWS PSK, ASN, APIPA, and prefixes all match exactly

References: