This topic describes how to troubleshoot the connection between an on-premises data center and an Elastic Compute Service (ECS) instance in a Virtual Private Cloud (VPC).
Background information
- Diagnose network routing issues.
- Diagnose issues at Layer 3 and Layer 4.
- Diagnose issues at Layer 2.
- Diagnose issues at Layer 1.
Diagnose network routing issues
You are able to use the local device to ping the IP address of the VBR. A Border Gateway Protocol (BGP) peering session has been established between the VBR and the VPC. If your on-premises server and the ECS instance in the VPC still cannot communicate with each other after you send ping packets to the ECS instance, perform the following operations to troubleshoot the connection:
- If you use Express Connect-Peering connections to connect your on-premises data center to the VPC, check the status of the health check for the connection between the VBR and the VPC.
- If you use Cloud Enterprise Network (CEN) to connect your on-premises data center to the VPC, check the status of the health check for VBRs on the CEN instance.
- If you use BGP routing, make sure that the local gateway has advertised your local CIDR block over BGP.
- Make sure that no more than 110 BGP route entries have been advertised. Additional advertised route entries will be discarded, but BGP peering sessions can still be established.
- Make sure that your on-premises gateway has a route in the route table that maps the on-premises gateway to the VPC. The next hop is the IP address of the VBR.
- Make sure that your VBR route table has a route that maps the VBR to the CIDR block of the on-premises data center. The next hop is the physical connection interface.
- Make sure that your VBR route table has a route that maps the VBR to the VPC. The next hop is the ID of the VPC instance.
- Make sure that your VPC route table has a route that maps the VPC to the CIDR block of the on-premises data center. The next hop is the VBR.
- Make sure that your ECS security group and network access control list (ACL) are configured to allow inbound and outbound network traffic transmitted between the VPC and your on-premises data center.
If the issue persists, submit a ticket.
Diagnose issues at Layer 3 and Layer 4
The on-premises gateway and the VBR can communicate with each other after you send ping packets to the VBR, but the on-premises BGP peering session cannot be established. To resolve this issue, perform the following operations:
If BGP peering sessions still cannot be established, submit a ticket.
Diagnose issues at Layer 2
The indicator of the on-premises gateway shows the normal state, but you cannot use the on-premises gateway device to ping the IP address of the VBR. To resolve this issue, perform the following operations:
- Check whether you have configured valid IP addresses. Make sure that the IP addresses reside within the same CIDR block and belong to a valid VLAN.
- Make sure that the IP address is configured in a VLAN subinterface such as GigabitEthernet 0/0.123 instead of a physical interface such as GigabitEthernet 0/0.
- Verify that the router has MAC address entries from the VBR node in the cloud in your Address Resolution Protocol (ARP) table.
- Make sure that VLAN trunking is enabled for your 802.1Q VLAN tag on all devices between the VBR in the cloud and the on-premises gateway.
- Clear ARP table cache of your local devices and your Internet service provider (ISP).
If ARP communication still cannot be established or ping packets cannot be sent to the VBR in the cloud, submit a ticket.
Diagnose issues at Layer 1
If the indicator of the on-premises gateway connected to the leased line is off, perform the following operations: