Resolve Telnet port connectivity failures between VPC instances that can be pinged successfully over Cloud Enterprise Network (CEN).
Description
After you connect two VPCs through CEN, you can ping peer ECS, SLB, and RDS instances but cannot use Telnet to connect to their ports.
Cause
Common causes:
-
The security group associated with the ECS instance has restrictive rules.
-
An access control policy restricts access to the SLB instance.
-
The IP address whitelist for the RDS instance is restrictive.
-
If the two VPC-connected instances are in different regions, an inter-region connection is not created between them.
Solutions
-
Before you perform risky operations, such as modifying instances or data, make sure that you have a disaster recovery and fault tolerance plan in place to ensure data security.
-
Before you modify the configurations or data of instances, such as ECS and RDS instances, create a snapshot or enable a feature such as RDS log backup.
-
If you have granted permissions or submitted security information, such as logon credentials, on the Alibaba Cloud platform, change your password promptly.
-
Check the security group configurations for the VPC-connected instances.
Make sure the security group rules allow Telnet access to the ECS, SLB, and RDS instances. For more information, see Query security groups and Add a security group rule.
-
Check the access control policy of the SLB instance. Make sure the IP address or CIDR block used to access the SLB instance is added to the access control policy and is granted access. For more information, see Access control overview.
-
Check the IP address whitelist for the RDS instance. Make sure the IP address or CIDR block used to access the RDS instance is added to the whitelist. For more information, see Set a whitelist.
-
If the two VPC-connected instances are in different regions, make sure that an inter-region connection is created between them. For more information, see Inter-region connections.
-
If both VPC-connected instances are connected to Basic Edition transit routers, create an inter-region connection between the transit routers. For more information, see Create an inter-region connection using a Basic Edition transit router.
By default, a Basic Edition transit router provides 1 Kbps of cross-region bandwidth. This bandwidth is for connectivity tests only and does not support production traffic.
-
If at least one of the transit routers connected to the cross-region VPC-connected instances is an Enterprise Edition transit router, create an inter-region connection between the transit routers. For more information, see Create an inter-region connection using an Enterprise Edition transit router.
-
Applicable to
-
Cloud Enterprise Network