A Site-to-Site VPN between a transit gateway and on-premises uses BGP over two tunnels with active/active ECMP on the transit gateway. Traffic from on-premises goes out over tunnel A, but the EC2 return traffic comes back over tunnel B and is dropped at the customer gateway. The engineer must fix this without lowering total VPN bandwidth. What should be done?

The core issue is asymmetric routing, where traffic enters via one VPN tunnel and attempts to return via another, but the customer gateway (CGW) is dropping the return traffic. This often happens when the CGW is configured to expect return traffic on the same interface it sent the outbound traffic from, or has stateful firewall rules that block unexpected return paths. The solution is to configure the CGW to allow asymmetric routing, meaning it will accept return traffic on either tunnel, regardless of which tunnel the outbound traffic used. This maintains the active/active ECMP benefit for full bandwidth utilization. Configuring AS path prepending or local preference on the CGW would force traffic to prefer one tunnel, effectively making it active/passive and reducing total bandwidth, which the question explicitly forbids. Marking a tunnel as primary on the AWS side doesn't directly control how the CGW handles return traffic. Switching to static routing in active/active mode doesn't inherently solve the asymmetric routing problem at the CGW; the CGW still needs to be configured to accept return traffic on any active tunnel.