AWS IPSec tunnel active/active HA with BGP

[jdemares]

Looking for some help here.  I have an ongoing case with support concerning AWS tunnel issues.  My production FWs are active/active but not in sync.  Just always been that way, it's the way I inherited it.  I have 4 tunnels to AWS (2 on each FW) BGP all works fine but if I reboot one FW when it comes back it blows up all the tunnels.  So support says I need to have the FWs in sync and then build them with a floating IP on each side and that will fix all my issues.  So in my lab I have the same setup, got the FWs in sync but the documentation to build this is pretty much nonexistent.  Support gave me a doc from 2011 which has about a page on the topic and doesn't mention dynamic routing at all.  

So my first question is anyone doing this?  

From there my questions are a bit more all over the place.  First the document says a tunnel interface on each device needs to be defined with a unique IP.  Do you add the /30 network AWS gives you for each side and then create a floating IP for the BGP peer in your VR?  I have tried to build this a few different ways and can't get it to work.  The best I have had was 2 of the 4 tunnels up and none of the BGP to come up.  Meanwhile the tunnels I build the other way are all still up so with BGP peers working (just don't reboot).  

With them in sync it is strange what gets synced and what doesn't and then what will break the sync and need to be forced or fixed to get them back in sync.  Do you build all this from one side and just change the priority of the floating IP to the other device if you want some of the tunnels to live on the other FW?  Do you replicated everything to the other FW if it doesn't get synched?  Sorry like I said I am all over the place at the end of a frustrating day.

Thanks for any help.