transit vpc doesn't create a VPN connections

[sortiz19]

Hi everyone

I'm doing this procedure to create a transit vpc using a previous creating subscriber vpc, the subscriber vpc already has a IGW and VGW. When I ran the CFT to create a subscriver vpc with the option to tag an existing vpc, the firewalls instances are created but no VPN connection is created. the question is there a way to tell me what I need to modify or what I need to do in order to tag an existing subscriber vpc to work with VPN connections?

[narayan-iyengar]

The subscribing vpc cannot have an existing vgw as the template will create one for you.

…

-- Thanks, /narayan

________________________________ From: sortiz19 <[email protected]> Sent: Monday, September 3, 2018 6:30:03 AM To: PaloAltoNetworks/aws-transit-vpc Cc: Subscribed Subject: [PaloAltoNetworks/aws-transit-vpc] transit vpc doesn't create a VPN connections (#44) Hi everyone I'm doing this procedure to create a transit vpc using a previous creating subscriber vpc, the subscriber vpc already has a IGW and VGW. When I ran the CFT to create a subscriver vpc with the option to tag an existing vpc, the firewalls instances are created but no VPN connection is created. the question is there a way to tell me what I need to modify or what I need to do in order to tag an existing subscriber vpc to work with VPN connections? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_PaloAltoNetworks_aws-2Dtransit-2Dvpc_issues_44&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=yaPPNRHFJOEqZ9-bfG64oiDWvBigyIWTnqkw0GQeLyU&m=OHBf9tGPXr5IHRHiGyqOM0khJRPz8mbNVI9r7UyqJfk&s=7wBjm_CJUwJboDMI3esCko-Rax5CBVY1CPEeBsfqSz0&e=>, or mute the thread<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_ARFcaUMQq0LvPGBS56RnZGh7u-5F6S820kks5uXS7bgaJpZM4WXn5m&d=DwMCaQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=yaPPNRHFJOEqZ9-bfG64oiDWvBigyIWTnqkw0GQeLyU&m=OHBf9tGPXr5IHRHiGyqOM0khJRPz8mbNVI9r7UyqJfk&s=YuooZh0JHxG8jm31DnNKIgJNLTdo5ObjJ9eoBO-6dH0&e=>.

[absbrown]

Actually the lambda in charge of configuring the vpc checks if there's a VGW attached before creating one. If it finds one then it will use that VGW.

In order to debug your problem you can take a look at cloudwatch logs for configureSubscribingVpcVpnLambda .

[Simbec]

Hi, I'm also having issues in a production enviorement with the spin-up of the VPN's inside the same AWS account.

The PA Group deploys just fine, but I never get a VPN in the subscriber VPC.

I tried searching for the logs in configureSubscribingVpcVpnLambd but I couldn't find any. Any suggestions?