AWS PayPal Top-up AWS Site-to-Site VPN Tunnel Frequently Dropping? IPsec Policy and DPD Tuning

AWS Account / 2026-08-04 15:01:51

If an AWS Site-to-Site VPN stays up for a while and then starts flapping, the root cause is usually not “AWS is unstable.” In the cases I see most often, the tunnel is being pushed down by one of four things: an IPsec proposal mismatch, DPD being too aggressive, a rekey failure, or MTU/fragmentation problems on the customer gateway side.

There is one more issue that gets overlooked: account state. If the AWS account is new, under billing review, or has payment problems, people often blame the tunnel because changes stop applying or resources disappear from the console. So before changing 20 firewall settings, it helps to check whether you are dealing with a real IPsec problem or an account/compliance problem that only looks like one.

What users usually mean by “the tunnel keeps dropping”

In practice, the symptom matters more than the generic label. Different drop patterns point to different fixes:

Disconnects every 30–60 minutes: usually Phase 2 rekey mismatch.
Disconnects after short idle periods: DPD or NAT mapping is too aggressive.
One tunnel stays up, the other keeps cycling: peer-side policy or routing issue, sometimes ISP or device asymmetry.
Works on small traffic, drops during large transfers: MTU, fragmentation, or MSS issues.
Drop happens after account or billing notice: check AWS account status before tuning IPsec.

The fastest way to save time is to match the symptom to the failure pattern instead of changing every IPsec knob at once.

First things I check before touching IPsec settings

AWS console tunnel status — confirm whether the tunnel is actually going down or only losing BGP/routing.
CloudWatch logs / tunnel logs — if enabled, they often show whether the failure is DPD, rekey, proposal mismatch, or authentication.
Customer gateway logs — compare the timestamp with AWS logs. The side that logs the first failure is usually the one with the real clue.
Routing mode — static route versus BGP. A tunnel can stay up while routes disappear, which users often describe as “VPN dropped.”
Public IP and NAT path — if the customer gateway is behind NAT, keepalive behavior becomes much more important.
AWS account status — billing issues, support restrictions, or compliance review can block configuration changes and look like a tunnel problem.

If the tunnel is flapping and you are still able to log in to AWS, check whether any recent payment failed, whether the account is under a verification review, and whether someone changed the AWS credential source, root email, or billing profile. I have seen “VPN instability” turn out to be an account access restriction rather than a crypto issue.

AWS PayPal Top-up IPsec policy tuning: the settings that usually matter most

Most tunnel drops are not fixed by “using stronger encryption.” They are fixed by making both ends agree on a narrow, stable proposal set and avoiding edge-case combinations. The less negotiation ambiguity you have, the fewer surprise rekeys.

Problem pattern	Likely cause	Practical tuning move
Drop every 50–60 minutes	Phase 2 lifetime mismatch or rekey failure	Align Phase 2 lifetime on both ends. Start with common values such as 3600 seconds and avoid letting one side use a much shorter timer.
Drop after short idle time	DPD or NAT mapping timeout	Use a less aggressive DPD timer and enable NAT-T keepalives if the gateway is behind NAT.
Frequent renegotiation failures	Too many proposals or incompatible transforms	Simplify the policy to one modern, mutually supported encryption/hash/DH combination instead of offering a long list.
Large file transfers fail or stall	MTU/fragmentation/MSS issues	Lower MTU on the tunnel path and clamp TCP MSS on the customer gateway or edge firewall.
One tunnel stable, one unstable	Peer-side asymmetry or routing imbalance	Check whether both tunnels use the same policy, same NAT behavior, and same upstream network quality.

A common mistake is to leave a very broad policy on the firewall because “it should negotiate something.” In real networks, that creates more failure modes, not fewer. A narrower policy is often more reliable, especially with AWS Site-to-Site VPN where the number of acceptable combinations is already limited compared with generic Internet VPN appliances.

What I usually standardize first

Use one encryption suite per tunnel instead of several backup proposals.
Keep both sides aligned on lifetime for Phase 1 and Phase 2.
AWS PayPal Top-up Do not mix overly aggressive DPD with unstable WAN links.
Test with a clean policy before adding legacy compatibility.

If the peer device is an enterprise firewall, I normally remove every nonessential transform and test with the shortest possible config that still matches AWS. Once the tunnel is stable, then I add the extra requirements back one by one, not the other way around.

DPD tuning: when it helps, and when it makes things worse

Dead Peer Detection is supposed to detect failure quickly. The problem is that “quickly” is not always what you want on a path with jitter, NAT, or a WAN link that pauses traffic under load.

AWS PayPal Top-up If DPD is too aggressive, the tunnel will be torn down even though the peer is actually alive. If DPD is too loose, the tunnel can look connected while traffic blackholes for too long.

For most real-world AWS VPN deployments, I start with the following approach on the customer gateway side:

Idle or branch-office links: use a moderate DPD interval and a few retries, not a tiny 5-second timer.
Busy production links: slightly faster DPD is acceptable because traffic itself helps keep state fresh.
Behind NAT: DPD alone is not enough; make sure NAT-T keepalives are also enabled.
Unstable ISP links: prefer a longer tolerance window so one brief packet loss does not trigger a full teardown.

One practical rule: if the tunnel dies during a 30–60 second quiet period but comes back immediately when traffic resumes, the problem is often not “real failure.” It is a DPD/NAT timing mismatch. That is very different from a lifetime mismatch, which usually happens on a predictable schedule like every 1 hour or every 8 hours.

On some firewalls, the vendor labels these options differently: “DPD action,” “keepalive,” “rekey margin,” or “liveness check.” The name is less important than the behavior. If the device supports it, choose a mode that restarts negotiation gracefully instead of instantly clearing the SA on the first missed probe.

When the tunnel is stable until traffic gets heavy

Large packet flows often expose hidden problems that basic ping tests do not. If your tunnel stays up for hours but breaks during file sync, database replication, or batch jobs, I would look at:

Path MTU — fragmentation across the IPsec tunnel often causes silent drops.
MSS clamping — especially important for TCP-heavy applications.
Asymmetric routing — traffic leaves one tunnel and returns through another path the firewall does not expect.
ISP packet loss — a few lost packets can trigger DPD on a sensitive configuration.

It is common to see a customer gateway that “passes ping tests” but still fails under real application traffic. Pings are too small to reveal MTU problems. If your issue only appears under load, reduce MTU and clamp MSS before you start rotating IPsec algorithms.

AWS account buying, KYC, and why they matter for a VPN issue

Strictly speaking, you should not buy a pre-registered AWS account from a third party. That is where many later problems begin: billing disputes, verification blocks, access recovery failures, and compliance review when AWS detects abnormal account ownership patterns.

If this VPN belongs to a newly opened company account, check the following before treating the tunnel as a pure network issue:

Billing identity matches the legal entity — company name, billing address, and tax profile should be consistent.
Payment method is valid and can be charged internationally — expired or blocked cards often lead to account restrictions.
Root contact and MFA are set correctly — if the root email is inaccessible, support recovery becomes slow.
No outstanding verification request — some accounts are limited until ownership or payment proof is reviewed.

In practice, AWS does not usually “partially break” a VPN because of payment issues. What happens more often is this: the account enters a restricted state, the team cannot modify the VPN, a tunnel replacement fails, or the support case stalls because billing approval is missing. The networking team sees a tunnel problem, but the real bottleneck is account control.

Payment method differences that affect operational speed

Payment method	Operational impact	Typical risk
Corporate credit card	Fastest to activate for self-service accounts	Charge failure if bank blocks cross-border or recurring cloud charges
Personal card used for business	Usually works initially	High risk of billing dispute, ownership mismatch, and later compliance review
Invoice / enterprise billing	Best for larger environments with procurement controls	Approval lag if the account owner and finance team are not aligned
Third-party reseller payment	Can simplify procurement in some regions	Renewal and access depend on the reseller’s own credit and control process

If you are managing a production VPN, make sure the billing contact is not a single person who may leave the company. I have seen renewals and card expirations trigger account reviews at the exact moment a tunnel needs a change, and that becomes a much bigger outage than the IPsec issue itself.

AWS PayPal Top-up Cost comparison: what you actually pay for

When people ask whether to keep a direct Site-to-Site VPN or move to a different architecture, the real cost is not just the tunnel charge. The bigger expense is usually the operational overhead: troubleshooting time, extra appliances, and hidden routing complexity.

Option	Main cost drivers	Best fit	Tradeoff
AWS Site-to-Site VPN only	Hourly VPN charge, normal data transfer charges, customer gateway device cost	Simple branch or DC connectivity	Least expensive to start, but sensitive to peer configuration quality
Site-to-Site VPN + Transit Gateway	VPN charge plus TGW attachment and data processing costs	Multiple VPCs and centralized routing	Cleaner routing at scale, but more expensive and easier to misconfigure
VPN via EC2 appliance	Instance cost, EIP, storage, patching, data transfer	Custom routing or legacy requirements	More control, more maintenance, more failure points
Managed partner appliance	Vendor subscription plus cloud charges	Teams that want vendor support for the VPN stack	Higher recurring cost, but easier if your firewall team is small

For most teams, the direct AWS VPN cost is not the part that hurts. The real cost shows up when the tunnel drops often enough that someone has to spend hours tracing logs and re-testing policies. If your current design needs constant DPD tweaking, the cheapest solution on paper may be the most expensive in operations.

A real troubleshooting pattern from the field

A mid-size company had a tunnel between an on-prem firewall and AWS that dropped almost exactly every 55 minutes. The team kept changing DPD, but the issue remained. The reason was simple: Phase 2 lifetime mismatch. AWS and the firewall were not rekeying at the same moment, and the peer’s policy was so broad that it negotiated a different transform after every renewal. Once we narrowed the policy to one stable suite, aligned the lifetime, and reduced the number of proposals, the tunnel stayed up for weeks.

In a second case, the tunnel only dropped during lunch breaks. That one was not a crypto problem at all. The customer gateway sat behind NAT, the ISP’s idle timeout was shorter than the VPN keepalive behavior, and DPD was set too aggressively. The fix was to adjust NAT-T keepalives and make DPD less trigger-happy. No AWS-side change was needed.

That is why I always separate the problem into three buckets: crypto negotiation, liveness detection, and path behavior. If you skip that order, you end up changing the wrong thing first.

Frequently asked questions

Why does the AWS VPN tunnel drop at the same time every hour?

That pattern almost always points to rekey timing, especially Phase 2 lifetime mismatch or a vendor device that fails to renegotiate cleanly. Start by aligning lifetimes and reducing the number of IPsec proposals.

AWS PayPal Top-up Should I use IKEv1 or IKEv2?

Use the version that is most stable on your customer gateway and fully supported by your peer device. If your firewall vendor’s IKEv2 implementation has quirks, a clean IKEv1 setup can sometimes be more reliable than a “modern” config that keeps renegotiating badly.

Does DPD keep the tunnel alive?

Not by itself. DPD helps detect whether the peer is alive, but it does not fix NAT expiration or path instability. If the gateway is behind NAT, you also need proper keepalive behavior.

Why is one tunnel up and the other down?

That is often a peer-side routing or policy issue. Check whether both tunnels use the same encryption profile, whether the same public IP is being reused incorrectly, and whether your outbound routing is forcing all traffic to one link.

Can AWS account problems cause tunnel outages?

Yes, indirectly. Billing failures, access restrictions, or compliance review can stop configuration changes or delay tunnel replacement. The tunnel may not be the actual failing component; the account may be the blocker.

What logs should I collect before opening a support case?

Collect AWS tunnel timestamps, customer gateway logs, IPsec proposal details, DPD settings, route mode, and any billing or account alerts. Without the exact failure time on both sides, support will usually ask you to reproduce it first.

If you want the tunnel to stop flapping, use this order

Confirm the account is in good standing and not under payment or verification restriction.
Check whether the issue is a real tunnel drop or only a route/BGP interruption.
Simplify the IPsec policy to one stable proposal set.
Align Phase 1 and Phase 2 lifetimes.
Relax DPD if the link is idle or behind NAT.
Lower MTU and clamp MSS if the problem appears under load.
Only then consider changing device models or redesigning the network path.

If you are evaluating a new AWS account for this VPN, do not start with a cheap pre-sold account or a mismatched billing profile. Set up a clean company account, verify ownership properly, use a payment method the bank will not reject for recurring cloud charges, and make sure the people who operate the tunnel can also access billing and compliance notifications. That is the difference between a tunnel that can be fixed in 15 minutes and one that keeps failing for reasons nobody can see in the firewall logs.