Equal-Cost Multipath Routing

Equal-Cost Multipath Routing is a forwarding technique that uses multiple equally preferred routes to the same destination prefix. Here, “cost” means routing preference or metric, not the financial price of a connection. Depending on the routing protocol and implementation, routes must have compatible metrics and path attributes before they can participate in ECMP. Two connections reaching the same network do not automatically form an ECMP group.

Most implementations distribute traffic using a hash of packet fields, such as source and destination addresses, protocol, and transport ports. Packets belonging to a flow normally follow the same path, reducing packet reordering. With enough independent flows, several links can carry traffic simultaneously. However, traffic distribution is not necessarily even: a few large transfers can saturate one path while another remains underused.

For example, two eligible 1 Gbps paths can provide close to 2 Gbps of aggregate capacity under favorable conditions when many flows are distributed across them. A single TCP connection usually remains limited to one path’s capacity. Protocol overhead, packet loss, latency, encryption processing, and endpoint performance can reduce achieved throughput further. Adding paths therefore helps a workload containing many independent connections more predictably than a workload consisting of one large transfer.

In cloud networks, ECMP commonly applies to hybrid connectivity through multiple VPN tunnels or private connectivity circuits. Dynamic routing, frequently using Border Gateway Protocol, advertises destination prefixes and withdraws routes when connectivity fails. The cloud routing service and the customer router must both support the intended multipath behavior. Forward and return traffic are selected independently, so engineers must also consider asymmetric routing through stateful firewalls or other appliances.

For AWS architectures, AWS Transit Gateway supports ECMP across eligible dynamically routed AWS Site-to-Site VPN tunnels when VPN ECMP support is enabled. Static-routing VPN connections do not support this ECMP capability. A virtual private gateway does not support ECMP for Site-to-Site VPN, so simply adding VPN connections to that gateway does not aggregate their bandwidth. The two tunnels included with a VPN connection provide redundancy, but their presence alone does not establish that both will carry traffic concurrently.

Bandwidth selection should start with aggregate demand, largest-flow requirements, and the capacity required during a failure. Multiple VPN paths can be appropriate when parallel application traffic needs more aggregate throughput than one tunnel provides. A higher-speed private connection, such as AWS Direct Connect, may be more appropriate when a workload needs greater per-path capacity or more consistent network performance. Multiple Direct Connect connections can also support ECMP in supported configurations, but their routing attributes and gateway topology must qualify.

Cost optimization requires comparing the complete architecture rather than counting links alone. Include VPN connection charges, transit processing, private circuit and port charges, data transfer, customer equipment, and operational effort. Also avoid provisioning only enough combined capacity for normal operation: if two paths are both nearly full, losing one causes congestion even though routing successfully fails over. Validate the design with multiple concurrent flows, inspect utilization per path, and test route withdrawal and recovery before relying on the advertised aggregate bandwidth.