Skip to content

Single vs Dual VPN Tunnels

Overview

AWS recommends configuring two VPN tunnels per connection to provide redundancy and ensure uninterrupted connectivity. This configuration allows AWS to perform maintenance on one tunnel without impacting your overall connection. This page outlines the implications of using a single tunnel and provides recommendations to minimize potential service disruptions.

Please note that in some cases, customers may only be able to operate with a single VPN tunnel. Using a single tunnel does not impact normal functionality and is an acceptable configuration. The recommendation for dual tunnels is primarily for added resiliency in the event of a network or connection failure, but if maintaining one tunnel is the preferred or only option, you can proceed with confidence that it will work as intended.

Background

Each AWS Site-to-Site VPN connection includes two tunnels between your network and AWS. This dual-tunnel design allows one tunnel to remain active if the other is taken down for maintenance or experiences an unexpected failure.

If only one tunnel is used, there is no redundancy. AWS may occasionally perform maintenance on the VPN endpoint, which can temporarily disrupt connectivity when a single tunnel is configured.

Impact

Customers using a single VPN tunnel may experience temporary connection interruptions during:

  • Scheduled or unscheduled AWS maintenance activities

  • Network reconfiguration events

  • Endpoint failover scenarios

These interruptions are typically brief, but they can affect systems that rely on continuous connectivity.

To help mitigate potential downtime, we recommend implementing the following practices:

  1. Enable Retry Mechanisms
    Ensure all downstream systems, data feeds, and integrations implement continuous retry logic for network or connection failures.

    • Retry attempts should continue until the connection is re-established.

    • Avoid manual restart requirements for automated systems.

  2. Configure Reasonable Timeouts
    Adjust retry intervals and timeouts to accommodate temporary disruptions (for example, 5–10 minutes).

  3. Monitor Tunnel Health
    Use AWS CloudWatch or your existing monitoring solution to alert your operations team when the VPN connection goes down.

  4. Plan for Reduced Redundancy
    Understand that with a single tunnel, availability depends entirely on that single path. Maintenance events or outages will result in temporary downtime.

Summary

Operating with one VPN tunnel is supported but not recommended. The AWS best practice remains to configure two VPN tunnels to ensure high availability.

If only one tunnel is possible, ensure that all dependent systems are configured with automatic retry logic to reconnect once AWS maintenance is complete and the tunnel is restored.

Additional Resources