# VPN #2 static active-standby acceptance evidence — 6 August 2026

## Decision and scope

VPN #2 was simplified from a four-tunnel Azure active-active BGP topology to
one AWS static-routed Site-to-Site VPN connection with two AWS tunnel endpoints
and an Azure active-standby `VpnGw1AZ` gateway. The change reduces recurring
public-IP and connection complexity while retaining tunnel redundancy.

## Reconciled provider state

| Control | Accepted state |
|---|---|
| AWS VPN #2 | `vpn-0106da6f9a20b1302`, static routing, available |
| AWS tunnel 1 | `52.51.60.239`, `UP`, one accepted route |
| AWS tunnel 2 | `52.211.121.132`, `UP`, one accepted route |
| Azure gateway | `eg334s-team2-vpngw`, `VpnGw1AZ`, `Succeeded` |
| Azure gateway mode | active-active disabled; BGP disabled; one public IP `20.24.123.36` |
| Azure connection 1 | `eg334s-team2-vpn2-connection`, `Connected`, routing weight 10 |
| Azure connection 2 | `eg334s-team2-vpn2-tunnel2-connection`, `Connected`, routing weight 0 |

The Azure gateway mode conversion completed successfully in 45 minutes 3
seconds. The superseded AWS BGP stack, four BGP connections/local gateways and
second Azure gateway public IP were removed only after static-path acceptance.

## Private data-plane acceptance

Tests ran from the Azure VM at `2026-08-06T07:01:58Z`:

| Destination | ICMP result | HTTP result |
|---|---|---|
| Ireland Web Node 1 `10.1.1.119` | 5/5 replies, 0% loss, 226.356 ms average | HTTP 200 |
| Ireland Web Node 2 `10.1.2.191` | 5/5 replies, 0% loss, 225.414 ms average | HTTP 200 |

## Evidence boundary

- Pre-shared keys were consumed only through a protected temporary parameter
  file and were neither printed nor committed. The file was removed after the
  deployment completed.
- This acceptance proves normal-path connectivity and both tunnel control-plane
  states. A separate controlled outage is required to measure failover loss.
- The AWS VGW remains non-transitive. VPN #2 does not create a Virginia-to-Azure
  path through Ireland.