# Test 12 — VPN #1 automatic VTI active/standby failover

Date: **5 August 2026 (SGT)**
Environment: **school AWS account 427617722186**
Connection: **eg334s-team2-vpn1-connection**
Result: **PASS — automatic failover with measured interruption**

## Objective

Prove that the existing Virginia strongSwan EC2 router can automatically move
the `10.1.0.0/16` data path from the preferred AWS-managed endpoint to the
preconfigured standby endpoint when the primary SA disappears.

## Accepted implementation

- Route-based IKEv1/IPsec with `0.0.0.0/0` traffic selectors.
- `vti1`, mark `101`, preferred primary endpoint `34.247.246.9`.
- `vti2`, mark `102`, standby endpoint `176.34.108.143`.
- Primary route: `10.1.0.0/16 dev vti1 metric 100`.
- A systemd-supervised controller checks the SAs every five seconds, withdraws
  the unavailable route, initiates the standby, and installs the replacement
  route only after that SA is established.
- Controlled failback is separate. The controller does not automatically
  pre-empt a healthy standby path.

## Failure injection and observed sequence

The test started a timestamped continuous private probe from Virginia test host
`10.0.1.104` to Ireland Web Node 1 `10.1.1.119`. UDP/500 and UDP/4500 to the
primary peer were temporarily blocked and the primary SA was withdrawn.

| Event | UTC | SGT |
|---|---:|---:|
| Failure injected | 05:43:28 | 13:43:28 |
| Controller reported no active route and initiated standby | 05:43:32 | 13:43:32 |
| AWS reported standby endpoint UP | 05:43:50 | 13:43:50 |
| Controlled safety failback completed | 05:45:41 | 13:45:41 |
| Preferred primary route restored | 05:45:46 | 13:45:46 |

The continuous probe recorded an approximately **8.16-second service gap**:
the last reply before failover was sequence 42 and replies resumed at sequence
50. Across the retained run, 90 probes were transmitted and 83 replies were
received. After restoration, a six-packet acceptance check returned **6/6
replies**, and private HTTP returned **200** in approximately **0.139 seconds**.

## Important design boundary

Persistent UP/UP was tested and rejected for this static-VGW, single-router
implementation. Although both IKE/IPsec SAs can be established, AWS may return
traffic on either managed endpoint independently of the Linux forward-route
metric. That produced asymmetric blackholing during acceptance testing.

The accepted low-cost design is therefore **automatic active/standby with one
established data path**, not active/active and not interruption-free. AWS may
briefly continue to display a withdrawn endpoint as UP while its managed
telemetry converges.

## Final steady state

- Controller service: active.
- Preferred primary SA: established.
- Standby: configured, not established.
- Route: `10.1.0.0/16 dev vti1 metric 100`.
- AWS telemetry: primary UP, standby DOWN.
- Private acceptance: ICMP 6/6, HTTP 200.
- Protected rollback archive retained on the router and outside the public
  repository.