Possible causes
After cross-account authorization is complete, VPC connectivity failures are most commonly caused by one of the following issues. Check them in order — the most frequent causes appear first.
|
No. |
Possible cause |
Solution |
|
1 |
VPC1 and VPC2 are not attached to a CEN instance |
Attach both VPCs to a CEN instance |
|
2 |
VPC1 and VPC2 are attached to different CEN instances |
Move both VPCs to the same CEN instance |
|
3 |
The vSwitch CIDR blocks in VPC1 and VPC2 overlap |
Resolve overlapping vSwitch CIDR blocks |
|
4 |
The VPC CIDR blocks overlap |
Resolve overlapping VPC CIDR blocks |
|
5 |
VPC1 and VPC2 are in different regions with no inter-region connection |
Establish an inter-region connection |
Solutions
Solution 1: Attach both VPCs to a CEN instance
Cross-account authorization alone does not establish connectivity. Both VPC1 and VPC2 must be attached to a Cloud Enterprise Network (CEN) instance. Without this step, traffic cannot flow between the VPCs regardless of authorization status.
Attach both VPCs to the same CEN instance. For instructions, see Create a VPC connection.
Solution 2: Move both VPCs to the same CEN instance
VPCs can communicate only when they are attached to the same CEN instance, even when the VPCs belong to different Alibaba Cloud accounts. If VPC1 and VPC2 are each attached to a separate CEN instance, attach both VPCs to the same CEN instance.
Solution 3: Resolve overlapping vSwitch CIDR blocks
Even when both VPCs are attached to the same CEN instance, overlapping vSwitch CIDR blocks block traffic between those subnets. Non-overlapping subnets in the same VPC pair continue to communicate normally.
Example: VPC1 (Account A) has vSwitches 192.168.1.0/24 and 192.168.2.0/24. VPC2 (Account B) has vSwitches 192.168.2.0/24 and 192.168.3.0/24. After both VPCs are attached to the same CEN instance, only 192.168.1.0/24 ↔ 192.168.3.0/24 traffic is routed. The 192.168.2.0/24 subnet on each side cannot communicate because the CIDR blocks overlap.
To fix this, replan the overlapping subnets. For guidance, see Plan networks. For a detailed explanation of partial-overlap behavior, see Overlapping vSwitch CIDR blocks.
Solution 4: Resolve overlapping VPC CIDR blocks
If the top-level CIDR blocks of VPC1 and VPC2 overlap, replan the VPC address space so the blocks do not overlap. See Plan networks.
If an ECS instance needs to move to a different VPC as part of the replan, see Change the VPC of an ECS instance.
Solution 5: Establish an inter-region connection
If VPC1 and VPC2 are in different regions, attaching them to the same CEN instance is not enough. You must also establish an inter-region connection between those regions.
Basic Edition transit router: See Use Basic Edition transit routers to connect VPCs across regions.
Enterprise Edition transit router: See Use Enterprise Edition transit routers to connect VPCs across regions and accounts.
Overlapping vSwitch CIDR blocks
When two VPCs share some overlapping and some non-overlapping vSwitch CIDR blocks, CEN routes only the non-overlapping subnets.
Example of partial overlap: VPC1 has 192.168.1.0/24 and 192.168.2.0/24; VPC2 has 192.168.2.0/24 and 192.168.3.0/24. After both VPCs are attached to the same CEN instance, 192.168.1.0/24 and 192.168.3.0/24 can communicate. The 192.168.2.0/24 subnets on each side cannot, because the CIDR block is duplicated across both VPCs.
Applicable scope
CEN