NAT traversal encapsulates ESP-protected traffic in UDP 4500 so a translating intermediate router can handle the session; that addresses IPsec connectivity across translating perimeter devices, rather than stable VPN encapsulation across NAT devices.

AWS sends IKE negotiation to the configured customer endpoint, so an unreachable or incorrect outside address prevents establishment; this belongs to accurate public termination identity for a hybrid VPN, while the problem is stable VPN encapsulation across NAT devices.

In the perimeter firewall support for both VPN tunnels workflow, VPN resilience depends on reachability of both independently addressed AWS tunnel endpoints, not merely having two configured AWS tunnels; the current case needs stable VPN encapsulation across NAT devices.

The private VPN tunnel rides the private Direct Connect connectivity toward the transit gateway rather than attaching directly to a public VIF; that addresses underlying private transport for encrypted TGW connectivity, rather than supported physical membership of a DX link aggregation group.

Direct Connect VIFs identify their layer-two sessions by VLAN tag; untagged frames do not enter the expected BGP peer context; this changes correct VLAN tagging for a Direct Connect virtual interface, not the necessary supported physical membership of a DX link aggregation group.

In the carrier handoff documentation for a physical DX circuit workflow, the LOA-CFA gives the facility details and authorization necessary for the carrier's physical cross-connect; the current case needs supported physical membership of a DX link aggregation group.

Independent tunnel peerings expose route availability to BGP so routing can respond when one encrypted path fails; this belongs to dual-tunnel BGP monitoring and failover, while the problem is proactive visibility into hybrid tunnel outages.

VPN resilience depends on reachability of both independently addressed AWS tunnel endpoints, not merely having two configured AWS tunnels; this changes perimeter firewall support for both VPN tunnels, not the necessary proactive visibility into hybrid tunnel outages.

In the propagation of corporate networks using VPN BGP workflow, an established IPsec security association does not by itself exchange dynamic networks; BGP must originate acceptable prefixes across the tunnel; the current case needs proactive visibility into hybrid tunnel outages.

The transit VIF architecture reaches transit gateways through a Direct Connect gateway; VGW connectivity uses a private VIF pattern; that addresses correct gateway attachment for transit virtual interfaces, rather than underlying private transport for encrypted TGW connectivity.

The gateway association uses an explicit proposal and acceptance workflow across accounts to authorize the connectivity relationship; this changes ownership-aware DX gateway association approval, not the necessary underlying private transport for encrypted TGW connectivity.

In the dedicated routing plane for private VPC prefixes workflow, public VIFs expose AWS public address reachability; private VPC CIDRs use the VIF type and gateway designed for private connectivity; the current case needs underlying private transport for encrypted TGW connectivity.

This produces controlled BGP advertisement via DX gateway allowed prefixes: Transit Gateway associations originate explicitly allowed prefixes toward Direct Connect BGP peers; missing allowed prefixes can leave no AWS route advertisements; the stem instead tests underlying private transport for encrypted TGW connectivity.

Transit Gateway associations originate explicitly allowed prefixes toward Direct Connect BGP peers; missing allowed prefixes can leave no AWS route advertisements; that addresses controlled BGP advertisement via DX gateway allowed prefixes, rather than IPsec connectivity across translating perimeter devices.

VPN resilience depends on reachability of both independently addressed AWS tunnel endpoints, not merely having two configured AWS tunnels; this belongs to perimeter firewall support for both VPN tunnels, while the problem is IPsec connectivity across translating perimeter devices.

In the accurate public termination identity for a hybrid VPN workflow, AWS sends IKE negotiation to the configured customer endpoint, so an unreachable or incorrect outside address prevents establishment; the current case needs IPsec connectivity across translating perimeter devices.

This produces stable VPN encapsulation across NAT devices: NAT-T encapsulates IPsec in UDP when NAT is present and keepalives help retain mappings needed for bidirectional traffic; the stem instead tests IPsec connectivity across translating perimeter devices.

For accurate BGP origination of corporate reachable networks, route origin and accepted prefixes determine what traffic AWS can return over the VIF; claiming unrelated blocks creates misleading routes; however, the present requirement is IPsec connectivity across translating perimeter devices.

BGP session authentication rejects segments that fail the shared-key validation even when the VLAN and IP interfaces are correct; that addresses consistent BGP authentication on the circuit, rather than DX gateway route advertisement and VPC return routes.

A hosted connection must be accepted by its recipient before that account can configure and use its virtual interface; this belongs to account acceptance of a provider-provisioned hosted circuit, while the problem is DX gateway route advertisement and VPC return routes.

In the propagation of corporate networks using VPN BGP workflow, an established IPsec security association does not by itself exchange dynamic networks; BGP must originate acceptable prefixes across the tunnel; the current case needs DX gateway route advertisement and VPC return routes.

Layer-one connection state does not guarantee a valid VLAN or BGP session; VIF-level configuration determines routing adjacency; that addresses distinction between circuit health and routing session health, rather than carrier handoff documentation for a physical DX circuit.

A hosted connection must be accepted by its recipient before that account can configure and use its virtual interface; this changes account acceptance of a provider-provisioned hosted circuit, not the necessary carrier handoff documentation for a physical DX circuit.

In the supported physical membership of a DX link aggregation group workflow, A LAG aggregates compatible physical links within one facility; geographically separate circuits require independent connections or LAGs; the current case needs carrier handoff documentation for a physical DX circuit.

Tunnel-state metrics expose endpoint availability; route-specific checks distinguish an encrypted tunnel from viable routed destinations; that addresses proactive visibility into hybrid tunnel outages, rather than device-diverse hybrid IPsec termination.

Static VPN routing requires configured destination prefixes; no BGP advertisements populate the list automatically; this belongs to configured prefixes for a statically routed VPN, while the problem is device-diverse hybrid IPsec termination.

AWS sends IKE negotiation to the configured customer endpoint, so an unreachable or incorrect outside address prevents establishment; this changes accurate public termination identity for a hybrid VPN, not the necessary device-diverse hybrid IPsec termination.

Direct Connect VIFs identify their layer-two sessions by VLAN tag; untagged frames do not enter the expected BGP peer context; this belongs to correct VLAN tagging for a Direct Connect virtual interface, while the problem is distinction between circuit health and routing session health.

BGP session authentication rejects segments that fail the shared-key validation even when the VLAN and IP interfaces are correct; this changes consistent BGP authentication on the circuit, not the necessary distinction between circuit health and routing session health.

In the BGP neighbor ASN agreement workflow, BGP opening messages verify peer ASN expectations; a mismatch prevents a stable routing adjacency despite physical reachability; the current case needs distinction between circuit health and routing session health.

The subnet's effective route table must contain a destination route toward the VGW for return traffic, independent of tunnel negotiation; that addresses VPC-side routing for corporate destination prefixes, rather than VPC forwarding toward known corporate networks.

Without VPN route propagation or equivalent static routes, spoke traffic has no transit next hop toward dynamically learned branch prefixes; this belongs to attachment-specific route propagation to spoke forwarding tables, while the problem is VPC forwarding toward known corporate networks.

The transit VIF architecture reaches transit gateways through a Direct Connect gateway; VGW connectivity uses a private VIF pattern; this changes correct gateway attachment for transit virtual interfaces, not the necessary VPC forwarding toward known corporate networks.

In the valid endpoint addressing for TGW Connect GRE peers workflow, connect peers use defined transport endpoints and BGP inside addressing; arbitrary overlapping interface addresses cannot establish the intended GRE peer; the current case needs VPC forwarding toward known corporate networks.

AWS sends IKE negotiation to the configured customer endpoint, so an unreachable or incorrect outside address prevents establishment; this belongs to accurate public termination identity for a hybrid VPN, while the problem is perimeter firewall support for both VPN tunnels.

Tunnel-state metrics expose endpoint availability; route-specific checks distinguish an encrypted tunnel from viable routed destinations; this changes proactive visibility into hybrid tunnel outages, not the necessary perimeter firewall support for both VPN tunnels.

In the propagation of corporate networks using VPN BGP workflow, an established IPsec security association does not by itself exchange dynamic networks; BGP must originate acceptable prefixes across the tunnel; the current case needs perimeter firewall support for both VPN tunnels.