# Test 11 — VPN #1 active-to-standby resilience

- **Date:** 4 August 2026 (SGT)
- **AWS account:** 427617722186
- **VPN connection:** `vpn-0304048c980934f5a` (`eg334s-team2-vpn1-connection`)
- **Result:** PASS WITH MEASURED CONVERGENCE

## Scope

This was an attended strongSwan selector replacement for VPN #1 between the
Virginia simulated on-premises VPC (`10.0.0.0/16`) and the Ireland application
VPC (`10.1.0.0/16`). It was not an automatic failover, zero-loss test, whole-AZ
failure, VGW failure or regional-disaster test.

## Baseline

- Tunnel 1 AWS endpoint `34.247.246.9`: UP.
- Tunnel 2 AWS endpoint `176.34.108.143`: DOWN / configured standby.
- Virginia test host `10.0.1.104` reached Ireland Web Node 1 `10.1.1.119` by
  private ICMP and HTTP.
- The strongSwan router was `10.0.1.55` / `174.129.120.215`.

## Action and measured result

1. A continuous timestamped private ping ran from `10.0.1.104` to `10.1.1.119`.
2. The operator withdrew `eg334s-team2-vpn1-tunnel1` and established
   `eg334s-team2-vpn1-tunnel2`.
3. AWS converged to Tunnel 1 DOWN and Tunnel 2 UP. Tunnel 2 passed 4/4 private
   ICMP replies at approximately 69 ms and returned the Ireland HTTP page.
4. The retained probe showed an approximately 15-second switchover gap
   (14 missing one-second probes).
5. The operator restored the accepted baseline by withdrawing Tunnel 2 and
   re-establishing Tunnel 1. The retained rollback probe showed an approximately
   29-second gap (27 missing one-second probes).
6. AWS finished with Tunnel 1 UP at 15:00:30 SGT, Tunnel 2 DOWN at 14:59:42 SGT,
   and both endpoints in provisioning state Available.

## Claim boundary

The result proves that the preconfigured standby AWS tunnel endpoint can carry
the intended private ICMP and HTTP traffic when an operator replaces the active
strongSwan policy. It also proves rollback to the accepted baseline. The gaps
are retained as evidence and the result must not be described as seamless,
automatic or interruption-free.

## Recording

[Open the genuine-action Test 11 recording](../../assets/video/11-vpn1-active-standby-resilience.mp4)

The public copy is a 1080p-compatible H.264 transcode of the raw macOS screen
recording. No VPN pre-shared key, SSH private key or cloud credential is included.