Why Did Communication Fail Between VPCs That Were Connected by a VPC Peering Connection?

Symptom

After a VPC peering connection is created, the local and peer VPCs cannot communicate with each other.

Troubleshooting

The issues here are described in order of how likely they are to occur.

If the problem persists, submit a service ticket.

Overlapping CIDR Blocks of Local and Peer VPCs

If the CIDR blocks of VPCs connected by a VPC peering connection overlap, the connection may not take effect due to route conflicts.

Figure 1 Networking diagram (IPv4)

Figure 2 Networking diagram (IPv4)

If CIDR blocks of VPCs overlap and some of their subnets overlap, you can create a VPC peering connection between their subnets with non-overlapping CIDR blocks. Figure 3 shows the networking diagram of connecting Subnet-A02 and Subnet-B02. Table 3 describes the routes required.

Figure 3 Networking diagram (IPv4)

• If a VPC peering connection between VPCs with overlapping CIDR blocks does not take effect, see Unsupported VPC Peering Configurations.
• If two VPCs want to use their IPv6 CIDR blocks for communication through a VPC peering connection but their IPv4 CIDR blocks or subnets overlap, the connection is not usable.

Incorrect Route Configuration for Local and Peer VPCs

Check the routes in the route tables of the local and peer VPCs by referring to Viewing Routes Configured for a VPC Peering Connection. Table 4 lists the items that you need to check.

Incorrect Network Configuration

1. Check whether security group rules of the ECSs that need to communicate allow inbound traffic from each other by referring to Viewing the Security Group of an ECS.
   • If the ECSs are associated with the same security group, you do not need to check their rules.
   • If the ECSs are associated with different security groups, add an inbound rule to allow access from each other by referring to Enabling ECSs in Different Security Groups to Communicate with Each Other Through an Internal Network.
2. Check whether the firewall of the ECS NIC blocks traffic.

   If the firewall blocks traffic, configure the firewall to allow inbound traffic.

3. Check whether network ACL rules of the subnets connected by the VPC peering connection deny inbound traffic.

   If the network ACL rules deny inbound traffic, configure the rules to allow the traffic.

4. If an ECS has more than one NIC, check whether correct policy-based routing has been configured for the ECS and packets with different source IP addresses match their own routes from each NIC.
   If an ECS has two NICs (eth0 and eth1):

   • IP address of eth0: 192.168.1.10; Subnet gateway: 192.168.1.1
   • IP address of eth1: 192.168.2.10; Subnet gateway: 192.168.2.1
   Command format:

   • ping -l IP address of eth0 Subnet gateway address of eth0
   • ping -l IP address of eth1 Subnet gateway address of eth1
   Run the following commands:

   • ping -I 192.168.1.10 192.168.1.1
   • ping -I 192.168.2.10 192.168.2.1

   If the network communication is normal, the routes of the NICs are correctly configured.

   Otherwise, you need to configure policy-based routing for the ECS with multiple NICs by referring to How Do I Configure Policy-Based Routes for an ECS with Multiple NICs?

ECS Network Failure

1. Log in to the ECS.

   Multiple methods are available for logging in to an ECS. For details, see Logging In to an ECS.

2. Check whether the ECS NIC has an IP address assigned.
   • Linux ECS: Use the ifconfig or ip address command to view the IP address of the NIC.
   • Windows ECS: In the search box, enter cmd and press Enter. In the displayed command prompt, run the ipconfig command.

   If the ECS NIC has no IP address assigned, see Why Does My ECS Fail to Obtain an IP Address?

3. Check whether the subnet gateway of the ECS can be pinged.
   1. In the ECS list, click the ECS name.

      The ECS details page is displayed.

   2. On the ECS details page, click the hyperlink of VPC.

      The Virtual Private Cloud page is displayed.

   3. In the VPC list, locate the target VPC and click the number in the Subnets column.

      The Subnets page is displayed.

   4. In the subnet list, click the subnet name.

      The subnet details page is displayed.

   5. Click the IP Addresses tab and view the gateway address of the subnet.
      Figure 4 Gateway address
      
   6. Check whether the gateway communication is normal:

      ping Subnet gateway address

      Example command: ping 172.17.0.1

      If the gateway address cannot be pinged, see Why Does My ECS Fail to Communicate at a Layer 2 or Layer 3 Network?