Help Center/ Virtual Private Cloud/ FAQs/ Connectivity/ Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?
Updated on 2024-10-25 GMT+08:00
View PDF
Share

Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?

Symptom

Two ECSs in the same VPC cannot communicate with each other or there is packet loss when they communicate.

Troubleshooting

The issues here are described in order of how likely they are to occur.

Troubleshoot the issue by ruling out the causes described here, one by one.

Figure 1 Troubleshooting
Table 1 Troubleshooting

Possible Cause

Solution

Security group rules

See Security Group Rules

Network ACL rules

See Network ACL Rules

ECS NIC configuration

See ECS NIC Configuration

Port unreachable

See Port Unreachable

Security Group Rules

Check whether the ECS NIC security group allows the outbound and inbound ICMP traffic.

Take the inbound direction as an example. The security group rules must contain at least one of the following rules.

Figure 2 Inbound security group rule

If packets of other protocols are tested, configure the security group rules to allow the corresponding protocol traffic. For example, if UDP packets are tested, check whether the security group allows the inbound UDP traffic.

Network ACL Rules

  1. Check whether the subnet of the ECS NIC has an associated network ACL.
  2. Check the network ACL status in the network ACL list.
    • If Disabled is displayed in the Status column, the network ACL has been disabled. Go to 3.
    • If Enabled is displayed in the Status column, the network ACL has been enabled. Go to 4.
  3. Click the network ACL name and configure rules on the Inbound Rules and Outbound Rules tabs to allow the ICMP traffic.
  4. If the network ACL is disabled, all packets in the inbound and outbound directions are discarded by default. In this case, delete the network ACL or enable the network ACL and allow the ICMP traffic.

ECS NIC Configuration

The following procedure uses a Linux ECS as an example. For a Windows ECS, check the firewall restrictions.
  1. Check whether multiple NICs are configured for the ECS. If the ECS has multiple NICs and the EIP is bound to an extension NIC, configure policy-based routing for the ECS.

    For details, see How Do I Configure Policy-Based Routes for an ECS with Multiple NICs?

  2. Log in to the ECS and run the following command to check whether the NIC has been created and obtained a private IP address. If there is no NIC information or the private IP address cannot be obtained, contact technical support.

    ifconfig

    Figure 3 NIC IP address
  3. If the CPU usage exceeds 80%, the ECS communication may be adversely affected. Run the following command to check whether the CPU usage of the ECS is too high:

    top

  4. Run the following command to check whether the ECS has any restrictions on security group rules:

    iptables-save

  5. Run the following command to check whether the /etc/hosts.deny file contains the IP addresses that limit communication:

    vi /etc/hosts.deny

    If the hosts.deny file contains the IP address of another ECS, delete the IP address from the hosts.deny file and save the file.

Port Unreachable

  1. If a port of the ECS cannot be reached, check whether the security group rules and network ACL rules enable the port.
  2. On the Linux ECS, run the following command to check whether the ECS listens on the port: If the ECS does not listen on the port, the ECS communication may be adversely affected.

    netstat -na | grep <Port number>

Submitting a Service Ticket

If the problem persists, submit a service ticket.

Parent topic: Connectivity