Intermittent issues connecting from a AWS Client VPN to a VPC Peering connection?

0

Hello, I'm seeing something weird and am looking for suggestions of places I should continue to look.

VPC A (10.1.0.0/16) is peered to VPC B (10.91.0.0/16) via a VPC Peering Connection. This connection is working perfectly for instances in VPC A's Subnet A (10.1.4.0/22).

We have an AWS Client VPN Endpoint in VPC A:

  • Client VPN IP Range: 10.90.0.0/22
  • Target Subnet Association: Subnet A (10.1.4.0/22)
  • Authorization Rules to allow access to 10.1.0.0/16 and 10.91.0.0/16
  • VPN Route Table set to 10.1.0.0/16 and 10.91.0.0/16

Visual depiction of the networking issue

Now for the weird part / question. The VPN is only able to connect to Instance B sometimes! I've disconnected and reconnected from the Client VPN Endpoint 21 times, and it's worked for 16 of those attempts:

  • The VPN IPs for working attempts: 10.90.1.2 (x6), 10.90.1.3, 10.90.1.34 (x7), 10.90.1.35
  • The VPN IPs for failed attempts: 10.90.0.2 (x3), 10.90.0.37 (x2)

So this leads me to notice that the AWS Client VPN seems to only be able to access the VPC Peering connection when it gives the client VPN an IP address in the 10.90.0.0/24 sub-range!?

We don't have any networking in VPC that does anything regarding the 10.90.x.x range so I believe this is an issue on the client-side with the AWS official VPN client. Nothing appears to be different with the local routing between when it works and doesn't work.

Any help would be greatly appreciated! Thanks!

2 Risposte
1
Risposta accettata

The issue seems to have resolved itself! 🫠

con risposta un anno fa
profile picture
ESPERTO
verificato 11 giorni fa
profile picture
ESPERTO
verificato 10 mesi fa
0

Can not see any obvious error above, but details on VPC B are bit limited. Have you followed these steps when configuring this https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

profile picture
ESPERTO
Kallu
con risposta un anno fa
profile picture
ESPERTO
verificato 10 mesi fa
  • Thanks for taking a look. VPC B is maintained by a PaaS company and we have no visibility into it. However, my understanding is that all the traffic it sees should be coming from the subnet IPs (10.1.4.0/22).

    And yeah, I did all the steps in that article above.

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande