How many IPsec tunnels does one AWS S2S VPN connection include?

Correct: b. AWS docs: two tunnels for HA.

Where do Tunnel 1 / Tunnel 2 outside IPs come from?

Correct: b. Do not invent tunnel IPs.

Multi-vendor · IPsec / SSL-VPN · Lesson 7 of 8

FortiGate to AWS: one CGW, two tunnels, then a route

AWS Site-to-Site is IPsec with two tunnels per VPN connection. The customer gateway is on-prem 203.0.113.10. The target is a virtual private gateway or a transit gateway attachment. Static prefixes or BGP. Copy Tunnel 1 and Tunnel 2 outside IPs from the AWS download - do not invent them. This dummy lab labels the VGW identity 203.0.113.60.

Updated 2026-08-18·20 min read·L2 primary·Quiz at end

After this page you can

Create a Customer Gateway for 203.0.113.10.
Build two FortiGate Phase-1s from the AWS config file.
Choose static 10.20.30.0/24 or BGP without inventing ASNs you were not given.
Prove both tunnels, and that 10.50.0.0/16 uses the VTI.

The ticket

EC2 in hub VPC 10.50.0.0/16 cannot reach 10.20.30.80. Junior built one FortiGate Phase-1 to “the VGW” and called HA done. AWS gave two tunnel outside IPs in the download file. Tunnel 2 was never configured. One ISP blip and the VPN is gone.

Quick interview answer

AWS S2S: Customer Gateway = your device (IP 203.0.113.10, optional BGP ASN), target gateway = VGW attached to one VPC or TGW for many VPCs, VPN connection = two IPsec tunnels. Routing is Static (prefix 10.20.30.0/24) or Dynamic (BGP). FortiOS: two route-based IKEv2 tunnels, two routes or BGP, policies on both tunnel interfaces. Download the vendor file from the AWS console and use those outside IPs and PSKs. This dummy lab’s VGW public identity is 203.0.113.60 - still configure both tunnels from the file.

FortiGate Customer Gateway to AWS VGW two IPsec tunnels — One CGW. Two IKE SAs. That is the HA unit AWS actually gives you.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

AWS object	Job	This lab
Customer Gateway	Tells AWS your public IP	203.0.113.10, device fgt-hq
Virtual private gateway	VPN endpoint on one VPC	Attached to 10.50.0.0/16, dummy public 203.0.113.60
Transit gateway	Hub for many VPCs + VPN	Use when spokes exist; same two-tunnel VPN
VPN connection	Two tunnels + PSKs + inside /30s	Copy from AWS download - do not invent inside CIDRs
Static or BGP	How AWS learns 10.20.30.0/24	Static prefix or BGP if you have an ASN to use

HA is the second tunnel, not a second wizard

AWS assigns the two tunnel outside IPs. The lab VGW label is not a license to configure only one Phase-1.

https://console.aws.amazon.com/vpc/home#CustomerGateways:

Training mock · not live

AWS console

VPCSite-to-Site VPNCustomer Gateways

VPC → Site-to-Site VPN → Customer Gateways

Customer gateway cgw-fgthq

Name

cgw-fgthq

IP Address

203.0.113.10

Certificate ARN

(blank - PSK from the VPN connection)

Device

fgt-hq

Target gateway type

Virtual private gateway (or Transit gateway)

Routing options

Static · Static IP Prefixes 10.20.30.0/24

Tunnels

Two - copy Outside IP / PSK from the AWS configuration download

AWS Site-to-Site VPN. Training mock. Dummy account, not yours.

How to choose

Single VPC, simple prefixes: VGW + static 10.20.30.0/24. Many VPCs: TGW attachment, still two tunnels. BGP when you already run BGP on the FortiGate and have an ASN you are allowed to use - do not invent an ASN in the interview. Always two FortiGate tunnels.

Runbook

Side A - AWS objects
CGW 203.0.113.10. VGW attached to 10.50.0.0/16 (or TGW). VPN connection: static prefix 10.20.30.0/24. Download the Fortinet configuration. Note Tunnel 1 and Tunnel 2 outside IP + PSK.
Side B - two FortiGate tunnels
vpn-aws-t1 and vpn-aws-t2, IKEv2, route-based, those outside IPs, those PSKs. Routes to 10.50.0.0/16 on both (or BGP). Policies LAN ↔ each tunnel if, NAT off.
Side C - prove
Both IKE SAs up. AWS tunnel status UP/UP (or UP/DOWN while you finish tunnel 2). Sourced ping to a hub test IP. Disable tunnel 1 in a change window and confirm tunnel 2 forwards.

fgt-hq · AWS two-tunnel proof

diagnose vpn ike gateway list
# vpn-aws-t1  remote: (Tunnel 1 Outside IP from AWS file)  IKE SA: established
# vpn-aws-t2  remote: (Tunnel 2 Outside IP from AWS file)  IKE SA: established

diagnose vpn tunnel list name vpn-aws-t1
diagnose vpn tunnel list name vpn-aws-t2

get router info routing-table details 10.50.0.0
# 10.50.0.0/16  via vpn-aws-t1   (and/or vpn-aws-t2 / BGP)

execute ping-options source 10.20.30.1
execute ping 10.50.0.10
# only if that dummy host exists - do not invent an ACS value

Four failures

1 · Only one tunnel configured

AWS still shows a VPN connection. You do not have the HA AWS documented. Build both Phase-1s.

2 · CGW IP is 203.0.113.60

Customer Gateway is on-prem 203.0.113.10. The VGW/TGW outside IPs come from the download.

3 · Static prefix missing 10.20.30.0/24

IKE up. AWS has no route back to Priya. Add the prefix or bring up BGP correctly.

4 · Invented inside /30 or second public

Use the AWS file. Do not guess tunnel inside CIDRs or a second “VGW public.”

How to prove it

Close only when

1) CGW = 203.0.113.10. 2) Two IKE SAs from the AWS file. 3) 10.50.0.0/16 via a tunnel if. 4) Sourced ping works. 5) You can say what happens if tunnel 1 dies.

Traps

Symptom	Look at	Wrong fix
One tunnel UP, one DOWN	Second Phase-1 / second PSK	“AWS is up” and walk away
Both UP, no return	Static prefix / VPC route table / SG	New CGW with Azure’s IP
Phase-2 selector fight	Route-based 0/0 both sides	Policy-based to “match AWS”

VPN scenario class series: S2S vs RA vs ZTNA · Phase-1 down · Phase-2 / proxy ID · Route vs policy · SSL split tunnel · FGT → Azure · FGT → AWS · VPN interview

Sources

Related: FortiGate IPsec · Azure hub-spoke · AWS TGW.