AWS Site-to-Site VPN · IPsec hybrid connectivity
Establish IPsec tunnels from your on-premises router or firewall to AWS. Each connection comes with two tunnels and exchanges routes with static routing or BGP. The same model covers everything from internet-based VPN to encryption over Direct Connect.
ikev1ikev2AES128AES256AES128-GCM-16AES256-GCM-16SHA1SHA2-256SHA2-384SHA2-512214–242514–24P1 28800sP2 3600s40sclearnonerestartaddstartSet per tunnel. Highlighted values are defaults.
Monthly uptime SLA per VPN connection
IPsec tunnels per connection
Max bandwidth per tunnel · standard tunnel 1.25 Gbps, Large Bandwidth Tunnel 5 Gbps
Tunnel MTU (bytes) · MSS 1406
Why Site-to-Site VPN
Use it right away, even while a dedicated circuit is being provisioned, and at low-traffic sites such as branches. Alongside Direct Connect, it serves as a backup path or as an encryption layer over the dedicated circuit.
Any router, firewall or software appliance that supports IPsec can be the customer gateway. Download device-specific configuration files from the console.
Every connection includes two tunnels for high availability. Configure both, and the connection stays up when one tunnel goes down for maintenance or a failure.
Connect to a virtual private gateway for one VPC, a transit gateway for many VPCs, or Cloud WAN for a global network.
Tunnel build-up
Each tunnel builds a security association with IKE, wraps traffic in IPsec, and exchanges routes over its inside addresses. Troubleshoot in the same order.
Each tunnel uses a /30 inside address from 169.254.0.0/16. Dynamic connections run BGP sessions over these addresses; static connections forward only the prefixes you specify.
inside CIDR /30IPv6 /126 (fd00::/8)eBGPstatic routesESP encrypts the actual traffic. The Phase 2 lifetime is 900–3600 seconds and must be shorter than Phase 1. NAT-T lets customer gateways behind NAT devices connect.
ESPNAT-Tlifetime ≤ 3600sreplay window 64–2048The peers authenticate with a pre-shared key or certificate and exchange keys. By default the customer gateway initiates negotiation; set Startup action to start to have AWS initiate.
IKEv1 / IKEv2PSK 8–64 charslifetime 900–28800sDPD ≥ 30sRouting
You choose the routing type when you create the connection. If the same route exists on a virtual private gateway as both static and BGP, the static route is preferred.
Recommended if your device supports BGP. Routes are exchanged automatically, and traffic fails over to the other tunnel if one fails.
For devices that don't support BGP. You register on-premises prefixes on the connection directly.
Features
Acceleration
AWS Global Accelerator receives traffic at the edge location nearest the customer gateway and carries it over the AWS global network. Available on Transit Gateway connections (not VGW), and can be enabled only at connection creation.
Over Direct Connect
Build IPsec tunnels with private IPs over a transit VIF and DX gateway. Encrypts dedicated-circuit traffic without public IPs.
Bandwidth
Up to 5 Gbps per tunnel on Transit Gateway or Cloud WAN connections. Both tunnels use the same bandwidth, and it can't be combined with Accelerated VPN. Existing connections can switch between standard and Large while keeping tunnel IPs and settings.
Observability
Send IKE, IPsec and DPD activity logs and BGP status and route change logs to Amazon CloudWatch Logs. Find the cause of negotiation failures without device logs.
Dual stack
On Transit Gateway and Cloud WAN, combine IPv4 and IPv6 for outer tunnels and inner traffic. Virtual private gateways support IPv4 only.
Many sites
Connect up to 100 small sites of up to 100 Mbps each to Transit Gateway through a single concentrator. The concentrator appears as one Transit Gateway attachment, and sites share a total of 5 Gbps. BGP routing only.
Termination
Choose where to attach the VPN connection based on the size of the network you're connecting and the features you need.
| Termination | Scope | Tunnel bandwidth | IPv6 · acceleration | Best for |
|---|---|---|---|---|
| Virtual Private Gateway VGW |
One VPC | 1.25 Gbps (standard) | IPv4 only · no Accelerated VPN | Simply connecting one VPC to on-premises |
| Transit Gateway TGW |
Multiple VPCs in a Region plus on-premises | 1.25 · 5 Gbps, aggregated with ECMP | IPv4 · IPv6 · Accelerated VPN supported | Routing many VPCs through a hub and scaling bandwidth |
| AWS Cloud WAN Core network |
Core network segments across Regions (BGP routing only) | 1.25 · 5 Gbps | IPv4 · IPv6 supported | Attaching sites to a policy-managed global network |
Reference architecture
The branch builds two tunnels over the internet to the transit gateway and exchanges routes over BGP. The data center reaches the same transit gateway through a transit VIF and DX gateway, and adds encryption on top with a Private IP VPN.
On narrow screens, swipe the diagram sideways.
Getting started
Create a customer gateway with your on-premises device's public IP (or certificate) and BGP ASN.
Attach a virtual private gateway to the VPC, or prepare a transit gateway or Cloud WAN.
Choose the routing type and tunnel options and, if needed, acceleration and tunnel bandwidth.
Download the configuration file for your device vendor and configure both tunnels.
Enable route table propagation, then check tunnel status, BGP sessions and received routes.
Pricing
The base cost is the hours a VPN connection is provisioned plus the data transferred through it. Acceleration, termination point and logging add charges from other services.
| Charge | Billed by | Notes |
|---|---|---|
| VPN connection hours | Per hour the VPN connection is provisioned and available | Billed even with no traffic. 5 Gbps (Large Bandwidth Tunnel) connections have a separate rate. |
| VPN Concentrator | Per concentrator hour, plus VPN connection hours for each attached site | The per-site connection rate differs from a regular VPN connection. |
| Accelerated VPN | Hourly charge for two Global Accelerator accelerators per connection, plus DT-Premium (per GB) | Non-accelerated connections have no Global Accelerator charges. |
| Data transfer | Standard AWS data transfer rates on data sent over the VPN connection | Follows EC2 data transfer pricing. |
| Public IPv4 addresses | Public IPv4 addresses used by tunnels | Each connection uses unique public IPv4 addresses, billed at the standard public IPv4 rate. |
| Transit Gateway · Cloud WAN | Per attachment hour, plus per GB of data processed | Billed separately under each service. Private IP VPN traffic incurs no TGW data processing charge beyond the underlying DX attachment charge. |
| Tunnel logs | CloudWatch Logs ingestion and storage | VPN itself charges nothing extra for enabling logs. |
Rates vary by Region and usage. For current rates, see the AWS VPN pricing page.
Next step
Bring your site count, bandwidth needs, current equipment and whether you use Direct Connect, and we'll review termination points and routing design together.