skills.rest
aws
awsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

sitetositevpn

Configure AWS Site-to-Site VPN connections, routing, bandwidth, high availability, and tunnel monitoring.

2.5k|282|Updated Apr 23, 2026
Search Tags:#AWS#CloudWatch#transit gateway#ipsec#bgp routing#site-to-site vpn#hybrid networking
One-click install
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill sitetositevpn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sitetositevpn
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/networking-and-content-delivery-skills/sitetositevpn
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill sitetositevpn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Setting up an encrypted IPsec VPN between an on-premises network and AWS involves many interdependent decisions—target gateway, routing type, tunnel bandwidth, device configuration, and monitoring—and mistakes like weak tunnel options, missing route propagation, or single-tunnel setups cause outages that are hard to diagnose.

Core Features & Use Cases

  • Connection Creation: Build a Site-to-Site VPN connection in the correct order (customer gateway, target gateway, route propagation, security group, connection) against a virtual private gateway, transit gateway, or Cloud WAN.
  • Routing and Bandwidth Decisions: Choose between static and dynamic (BGP) routing, and size tunnels at Standard (1.25 Gbps) or Large (5 Gbps), including VPN Concentrator consolidation for 25+ low-bandwidth sites.
  • Resilience and Monitoring: Configure both tunnels for high availability, add a second device for failover, and set up CloudWatch TunnelState alarms and VPN logs to diagnose down tunnels.
  • Use Case: A company needs to connect its data center to a VPC over an encrypted tunnel with BGP failover; the skill walks through gateway selection, connection creation with strong AES-256/SHA-256 tunnel options, device configuration guidance, and CloudWatch alarming.

Quick Start

Ask the agent to create a Site-to-Site VPN connection from your on-premises network to your VPC, specifying the target gateway type, routing preference, and customer gateway public IP.

Frequently Asked Questions about sitetositevpn

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create an AWS Site-to-Site VPN connection to my VPC?▼

Create resources in order: customer gateway with the device public IP and BGP ASN, target gateway (virtual private gateway or transit gateway) attached to the VPC, route propagation and security group rules, then the VPN connection with strong tunnel options. Settle static versus dynamic routing before building.

Should I use static or dynamic BGP routing for Site-to-Site VPN?▼

Use dynamic (BGP) routing when the on-premises device supports BGP, since it provides automatic route exchange and tunnel failover. Choose static routing when the device lacks BGP or when you deliberately need to control which partner prefixes enter your network.

What is the difference between Standard and Large VPN tunnel bandwidth?▼

Standard tunnels support up to 1.25 Gbps per tunnel and work on any target gateway, while Large tunnels support up to 5 Gbps but only on transit gateway or Cloud WAN connections. Large costs more per hour and requires the on-premises device and circuit to handle the throughput.

Why does my Site-to-Site VPN tunnel keep going down?▼

Common causes include configuring only one of the two tunnels, mismatched Weight and Local Preference BGP attributes, or IKE negotiation failures. Enable Site-to-Site VPN tunnel activity and BGP logs in CloudWatch and alarm on the TunnelState metric to identify the cause.

When should I use a VPN Concentrator instead of individual connections?▼

Use a VPN Concentrator when connecting 25 or more low-bandwidth sites (roughly 50 to 100 Mbps each) that can share 5 Gbps aggregate bandwidth on a transit gateway. It requires BGP routing and a unique CIDR block per site, and is cheaper than per-site connections only above the break-even site count.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.3k

enabling-lambda-vpc-internet-access

Provision NAT gateway infrastructure to enable outbound internet access for Lambda functions in VPC private subnets.

Official
Advanced
agents-infrastructureagents-infrastructure
7

alicloud-vpc

Manage Alibaba Cloud VPCs, VSwitches, route tables, and NAT gateways.

Official
Advanced
mashharukimashharuki
2

aws-observability

Configure AWS CloudWatch, X-Ray, CloudTrail, and ADOT observability services.

Community
Advanced
3commas-io3commas-io
4

hybrid-cloud-networking

Configure VPNs and dedicated connections between on-premises networks and cloud platforms.

Official
Advanced