Why is IKE (phase 1 of my VPN tunnel) failing in Amazon VPC?

Last updated: 2020-12-21

Check the AWS Virtual Private Network (AWS VPN) configuration to confirm that it:

• Meets all customer gateway requirements.
• Uses the appropriate IKE version for your use case (AWS supports both IKEv1 and IKEv2).
• Uses the appropriate lifetime in seconds for IKE (phase1) for your IKE version. To configure tunnel options based on your requirements, see Tunnel options for your Site-to-Site VPN connection.
• Has a customer gateway device that's configured with the correct pre-shared key (PSK) or valid certificates.
• Can successfully ping AWS Virtual Private Network (AWS VPN) endpoints from your customer gateway.

If acceleration is enabled for an AWS Site-to-Site VPN connection, then be sure that NAT-Traversal is enabled on the customer gateway device.

If the customer gateway device is behind a network address translation (NAT) device, be sure that:

• UDP packets on port 500 (and port 4500, if NAT-traversal is used) are allowed to pass between your network and the AWS VPN endpoints.
• The intermediate internet service providers (ISPs) aren't blocking UDP port 500 (or port 4500, if NAT-Traversal is used).

If your customer gateway isn't behind a port address translation (PAT) device, then it's a best practice to disable NAT-traversal.