Intermittent issues connecting from a AWS Client VPN to a VPC Peering connection?

0

Hello, I'm seeing something weird and am looking for suggestions of places I should continue to look.

VPC A (10.1.0.0/16) is peered to VPC B (10.91.0.0/16) via a VPC Peering Connection. This connection is working perfectly for instances in VPC A's Subnet A (10.1.4.0/22).

We have an AWS Client VPN Endpoint in VPC A:

  • Client VPN IP Range: 10.90.0.0/22
  • Target Subnet Association: Subnet A (10.1.4.0/22)
  • Authorization Rules to allow access to 10.1.0.0/16 and 10.91.0.0/16
  • VPN Route Table set to 10.1.0.0/16 and 10.91.0.0/16

Visual depiction of the networking issue

Now for the weird part / question. The VPN is only able to connect to Instance B sometimes! I've disconnected and reconnected from the Client VPN Endpoint 21 times, and it's worked for 16 of those attempts:

  • The VPN IPs for working attempts: 10.90.1.2 (x6), 10.90.1.3, 10.90.1.34 (x7), 10.90.1.35
  • The VPN IPs for failed attempts: 10.90.0.2 (x3), 10.90.0.37 (x2)

So this leads me to notice that the AWS Client VPN seems to only be able to access the VPC Peering connection when it gives the client VPN an IP address in the 10.90.0.0/24 sub-range!?

We don't have any networking in VPC that does anything regarding the 10.90.x.x range so I believe this is an issue on the client-side with the AWS official VPN client. Nothing appears to be different with the local routing between when it works and doesn't work.

Any help would be greatly appreciated! Thanks!

2回答
1
承認された回答

The issue seems to have resolved itself! 🫠

回答済み 1年前
profile picture
エキスパート
レビュー済み 11日前
profile picture
エキスパート
レビュー済み 10ヶ月前
0

Can not see any obvious error above, but details on VPC B are bit limited. Have you followed these steps when configuring this https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

profile picture
エキスパート
Kallu
回答済み 1年前
profile picture
エキスパート
レビュー済み 10ヶ月前
  • Thanks for taking a look. VPC B is maintained by a PaaS company and we have no visibility into it. However, my understanding is that all the traffic it sees should be coming from the subnet IPs (10.1.4.0/22).

    And yeah, I did all the steps in that article above.

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ