Why Does Communication Fail Between Two ECSs in the Same VPC or Packet Loss Occur When They Communicate?
Symptom
Two ECSs in the same VPC cannot communicate with each other or there is packet loss when they communicate.
Troubleshooting
The issues here are described in order of how likely they are to occur.
Troubleshoot the issue by ruling out the causes described here, one by one.
Possible Cause |
Solution |
---|---|
Security group rules |
|
Network ACL rules |
|
ECS NIC configuration |
|
Port unreachable |
See Port Unreachable |
Security Group Rules
Check whether the ECS NIC security group allows the outbound and inbound ICMP traffic.
Take the inbound direction as an example. The security group rules must contain at least one of the following rules.
If packets of other protocols are tested, configure the security group rules to allow the corresponding protocol traffic. For example, if UDP packets are tested, check whether the security group allows the inbound UDP traffic.
Network ACL Rules
- Check whether the subnet of the ECS NIC has an associated network ACL.
- Check the network ACL status in the network ACL list.
- Click the network ACL name and configure rules on the Inbound Rules and Outbound Rules tabs to allow the ICMP traffic.
- If the network ACL is disabled, all packets in the inbound and outbound directions are discarded by default. In this case, delete the network ACL or enable the network ACL and allow the ICMP traffic.
ECS NIC Configuration
- Check whether multiple NICs are configured for the ECS. If the ECS has multiple NICs and the EIP is bound to an extension NIC, configure policy-based routing for the ECS.
For details, see How Do I Configure Policy-Based Routes for an ECS with Multiple NICs?
- Log in to the ECS and run the following command to check whether the NIC has been created and obtained a private IP address. If there is no NIC information or the private IP address cannot be obtained, contact technical support.
Figure 3 NIC IP address
- If the CPU usage exceeds 80%, the ECS communication may be adversely affected. Run the following command to check whether the CPU usage of the ECS is too high:
- Run the following command to check whether the ECS has any restrictions on security group rules:
- Run the following command to check whether the /etc/hosts.deny file contains the IP addresses that limit communication:
vi /etc/hosts.deny
If the hosts.deny file contains the IP address of another ECS, delete the IP address from the hosts.deny file and save the file.
Port Unreachable
- If a port of the ECS cannot be reached, check whether the security group rules and network ACL rules enable the port.
- On the Linux ECS, run the following command to check whether the ECS listens on the port: If the ECS does not listen on the port, the ECS communication may be adversely affected.
Submitting a Service Ticket
If the problem persists, submit a service ticket.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot