VPN Tunnel Up But No Traffic: Troubleshooting Guide
A network engineer is configuring a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel status shows 'UP' but traffic is not passing. The engineer checks the route tables and finds that the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR. What is the most likely missing configuration?
Quick Answer
The answer is that the on-premises router lacks a route pointing back to the VPC CIDR via the VPN tunnel. Even when the tunnel status shows 'UP', traffic cannot flow bidirectionally unless both sides have reciprocal routing entries; the VPC route table already points to the virtual private gateway for the on-premises CIDR, but the on-premises router must also have a static route directing return traffic for the VPC CIDR into the tunnel interface. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding that a VPN tunnel being 'UP' only confirms Phase 1 and Phase 2 of IPsec are established—it does not guarantee data plane connectivity. A common trap is assuming a misconfigured pre-shared key would still allow the tunnel to show as 'UP', but that would actually prevent the tunnel from establishing at all. Remember the memory tip: "Tunnel UP, traffic stuck? Check the return route—it’s the missing link."
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group of the EC2 instances does not allow inbound traffic from on-premises
Since the VPN tunnel status is 'UP', the pre-shared key and Phase 2 parameters are correctly configured. With the VPC route table already pointing to the virtual private gateway for the on-premises CIDR, the most likely missing configuration is that the security group associated with the EC2 instances in the VPC does not allow inbound traffic from the on-premises network. Security groups act as a virtual firewall for instances, and inbound traffic from on-premises must be explicitly allowed. Option A is incorrect because the stem states the route exists. Option C is incorrect because a tunnel UP status confirms the pre-shared keys match. Option D is less likely because even if the on-premises router is not advertising the VPC CIDR, that would affect return traffic but not necessarily all traffic; also the question does not specify BGP usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPC route table does not have a route for the on-premises CIDR pointing to the virtual private gateway
Why it's wrong here
Incorrect. The stem explicitly states the VPC route table has a route pointing to the virtual private gateway for the on-premises CIDR.
- ✓
The security group of the EC2 instances does not allow inbound traffic from on-premises
Why this is correct
Correct. Security groups are stateful and must allow inbound traffic from the on-premises network. Without this rule, traffic can reach the VPC but will be blocked at the instance level.
- ✗
The VPN tunnel is using the wrong pre-shared key
Why it's wrong here
Incorrect. A tunnel status of 'UP' indicates that the pre-shared keys match during Phase 1 and that Phase 2 parameters are established. Therefore, the PSK is not the issue.
- ✗
The on-premises router is not advertising the VPC CIDR over BGP
Why it's wrong here
Incorrect. While missing route advertisement can cause traffic issues, it is not the most likely cause given the tunnel is UP and the VPC route is correct. Additionally, the question does not specify that BGP is being used.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting a Site-to-Site VPN connection between an on-premises network and AWS. The VPN tunnel is up, but traffic is not flowing from the on-premises network to a VPC. The VPC has a virtual private gateway attached, and the route table has a route pointing to the virtual private gateway for the on-premises CIDR (192.168.0.0/16). The on-premises firewall shows that traffic is being sent to the VPN tunnel. What should the engineer check next?
easy- A.Verify that the virtual private gateway is attached to the VPC.
- ✓ B.Verify that the on-premises route table has a route to the VPC CIDR via the VPN tunnel.
- C.Verify that the on-premises firewall is not blocking UDP port 500 for IKE.
- D.Verify that the VPN tunnel's pre-shared key matches on both sides.
Why B: Since the VPN tunnel is up and the on-premises firewall confirms traffic is being sent to the tunnel, the issue is likely on the on-premises routing side. For traffic to flow from on-premises to the VPC, the on-premises router must have a route pointing to the VPC CIDR via the VPN tunnel interface. Without this route, packets will not be forwarded into the tunnel, even though the tunnel itself is operational.
Variation 2. A network engineer is diagnosing a connectivity issue between an on-premises network and an Amazon VPC connected via a site-to-site VPN. The VPN tunnel is up, but traffic is not reaching the VPC. Which TWO actions should the engineer take to troubleshoot the issue? (Choose two.)
medium- ✓ A.Review the security group rules associated with the VPC resources to ensure they allow traffic from the on-premises network
- B.Confirm the customer gateway is associated with the correct VPC
- ✓ C.Verify that the VPC route tables include routes for the on-premises network pointing to the virtual private gateway
- D.Verify that the on-premises network has a NAT device configured
- E.Check that the VPN tunnel's status is 'UP'
Why A: Security groups act as a virtual firewall for VPC resources. If traffic from the on-premises network is not reaching the VPC, the security group rules must allow inbound traffic from the on-premises IP range. Option C is correct because the VPC route tables need a route for the on-premises network pointing to the virtual private gateway (VGW) to direct traffic correctly. Option B is incorrect because the customer gateway is the on-premises VPN endpoint, and its association with the VPC is already established since the VPN tunnel is up. Option D is incorrect because NAT is not a requirement for site-to-site VPN; the issue is about routing, not address translation. Option E is incorrect because the tunnel is already up, so checking its status again does not help diagnose why traffic is not flowing.
Variation 3. A network engineer is troubleshooting a VPN connection between an AWS Virtual Private Gateway and an on-premises Cisco ASA. The tunnel status shows 'UP' but no traffic passes. The engineer checks the route tables and finds the correct static routes on both sides. What should the engineer check next?
hard- ✓ A.Review the IPsec phase 2 settings, including the traffic selectors.
- B.Check the IKE phase 1 parameters (e.g., encryption, hash).
- C.Verify that the pre-shared keys match.
- D.Confirm that the VPC route table has a route to the on-premises subnet.
Why A: If the tunnel is up but no traffic passes, the issue is often phase 2 IPsec security associations (SAs) or mismatch in encryption domains. Unlike phase 1, phase 2 can fail silently.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.