Unexpected route chosen when using a Group Route

[galda01]

Hello all,

We have a pfsense running the latest version (as of yesterday) that has two Internet services each with one VPN connection to AWS. We have Group Routing configured to use whichever route (Internet service) is up and prioritizes the faster service.

We expect the primary internet service to be the ONLY route used to get to the Internet and/or AWS unless that fails. However, we're finding that both routes are used to get to AWS. I suspect this is due to there being two VPN connections up all the time (one for each internet service) between the pfsense and AWS, and because there are two, there must be two routes to AWS. We expect (or, would hope) that the VPN running over the primary Internet service would be the only VPN connection used while the primary Internet service is up.

Obviously i'm wrong and need a way to ensure only the primary Internet service and its VPN connection is used at a time.

Any ideas?

Andrew G