Troubleshooting
Use this guide to diagnose connectivity issues between an on-premises data center and an Elastic Compute Service (ECS) instance in a Virtual Private Cloud (VPC).
Work through the diagnostic layers in order, starting from the top. Each section describes the symptoms that indicate you are at that layer, and the checks to perform before moving on.
| Step | Layer | Symptom |
|---|---|---|
| 1 | Network routing | BGP peering is up, VBR ping succeeds, but on-premises and ECS cannot communicate |
| 2 | Layer 3 and Layer 4 | VBR ping succeeds, but BGP peering session cannot be established |
| 3 | Layer 2 | On-premises gateway indicator is normal, but VBR ping fails |
| 4 | Layer 1 | On-premises gateway indicator is off |
Diagnose network routing issues
Symptom: A Border Gateway Protocol (BGP) peering session is established between a Virtual Border Router (VBR) and a VPC, and you can ping the VBR IP address from your on-premises device, but your on-premises server and the ECS instance cannot communicate.
Check the following:
Health check status — If you use Express Connect peering connections, check the health check status for the connection between the VBR and the VPC. If you use Cloud Enterprise Network (CEN), check the health check status for VBRs on the CEN instance.
BGP advertisement — If you use BGP routing, confirm that your on-premises gateway is advertising your on-premises CIDR block over BGP. The limit is 110 BGP route entries; excess entries are discarded, but BGP peering sessions remain established.
On-premises gateway route table — Confirm there is a route to the VPC, with the next hop set to the IP address of the VBR.
VBR route table — Confirm there are two routes: one to the on-premises CIDR block (next hop: physical connection interface) and one to the VPC (next hop: VPC instance ID).
VPC route table — Confirm there is a route to the on-premises CIDR block, with the next hop set to the VBR.
Security group and network ACL — Confirm that the ECS security group and network access control list (ACL) allow inbound and outbound traffic between the VPC and your on-premises data center.
If the issue persists, submit a ticket.
Diagnose issues at Layer 3 and Layer 4
Symptom: After you send ping packets to the VBR, the on-premises gateway and the VBR can communicate with each other, but the BGP peering session cannot be established.
Work through the following steps:
Confirm that valid autonomous system numbers (ASNs) are configured for both the on-premises side and Alibaba Cloud.
Confirm that the peering IP addresses at both ends of the BGP peering session are correctly configured.
Confirm that the MD5 authentication key matches the key in the downloaded router configuration file exactly.
NoteNote: Check for extra spaces or characters — even a single trailing space causes a mismatch.
Confirm that no firewall or ACL rules block TCP port 179 or any temporary TCP port numbers that are greater than 1024. Both are required for BGP peers to establish TCP connections.
Review your BGP logs for errors or warnings.
If the BGP peering session still cannot be established, submit a ticket.
Diagnose issues at Layer 2
Symptom: The previous step confirmed Layer 1 connectivity — the on-premises gateway indicator shows a normal state — but you cannot ping the VBR IP address.
Work through the following steps:
Confirm that the IP addresses are valid, belong to the same CIDR block, and are in a valid VLAN.
Confirm that IP addresses are configured on a VLAN subinterface (for example,
GigabitEthernet 0/0.123), not a physical interface (for example,GigabitEthernet 0/0).Check your Address Resolution Protocol (ARP) table for MAC address entries from the VBR node in the cloud.
Confirm that 802.1Q VLAN tag trunking is enabled on all devices between the VBR and your on-premises gateway.
Clear the ARP table cache on your on-premises devices and on your connectivity provider's equipment.
If ARP communication still cannot be established or ping packets cannot reach the VBR, submit a ticket.
Diagnose issues at Layer 1
Symptom: The indicator on your on-premises gateway — which is connected to the leased line — is off.
Work through the following steps:
Check that the customer-premises equipment (CPE) is powered on and that the port is activated.
Confirm with your connectivity provider that a VBR-to-VPC peering connection has been provisioned. Request a Proof of Completion and a connectivity test report.
Check the optical modules at both ends of the leased line:
Both ends must support the same transmission distance. Mismatched transceivers prevent the port indicator from turning on.
Both ends must support the same bandwidth. Mismatched bandwidth causes the port indicator to remain off.
Optical fiber connections require single-mode optical modules: 1000Base-LX for 1 GB Ethernet, 10GBase-LR for 10 GB Ethernet, 40GBase-LR for 40 GB Ethernet, and 100GBase-LR for 100 GB Ethernet. Configure the same parameters on both ends.
Disable auto-negotiation on the CPE and manually configure the port rate and full-duplex mode.
NoteNote: Most network devices, including Juniper, enable auto-negotiation by default. Disable it manually.
Work with your connectivity provider to run leased line segmentation tests:
Conduct in-building cable tests between the optical distribution frames (ODF) and the on-premises access devices. Run fiber optic loopback tests if needed.
Test the connection from the on-premises data center to the gateway at the connectivity provider site. Run fiber optic loopback tests if needed.
Have the connectivity provider test the internal network link with the service provider.
Test the in-building cable between the ODF and the Alibaba Cloud access devices at the on-premises data center where the Alibaba Cloud access point is deployed.
To test the pigtail cable, submit a ticket.
For the actual network topology, contact your connectivity provider.
