How do I troubleshoot connectivity between on-premises resources and Amazon VPC through Transit Gateway?

Resolution

To troubleshoot connectivity between on-premises resources and a VPC through Transit Gateway, complete the following actions:

Check instance security group and network ACL rules

Complete the following steps:

1. Open the Amazon Elastic Compute Cloud (Amazon EC2) console.
2. In the navigation pane, choose Instances.
3. Select the Amazon EC2 instance.
4. Choose the Security tab.
5. Check whether Inbound rules and Outbound rules allow traffic to and from your on-premises network.
6. Open the Amazon VPC console.
7. In the navigation pane, choose Network ACLs.
8. Select the network access control list (network ACL) for your instance's subnet.
9. Select Inbound rules and Outbound rules. Then, check if these rules allow traffic to and from your on-premises network.

Check transit gateway attachments

Complete the following steps:

1. In the navigation pane, choose Transit Gateway Attachments.
2. Select the VPC attachment.
3. Under Details, check if the VPC attachment includes a Subnet ID from your Amazon EC2 instance's Availability Zone.
4. If the VPC attachment doesn't include a subnet from your instance's Availability Zone, then select a subnet from your instance's Availability Zone. For instructions, see Modify a VPC attachment in AWS Transit Gateway.
   Note: The modification state might affect data traffic when you add or modify a VPC attachment subnet.

Check network ACLs for transit gateway interfaces

Complete the following steps:

1. Open the Amazon EC2 console.
2. In the navigation pane, choose Network Interfaces.
3. In the search bar, enter Transit Gateway.
4. Note the subnet IDs where Transit Gateway created the interfaces.
5. Open the Amazon VPC console.
6. In the navigation pane, choose Network ACLs.
7. In the search bar, enter a subnet ID that you noted earlier. The results show the network ACL for the subnet.
8. Check if the Inbound rules and Outbound rules allow the VPC CIDR block and on-premises network CIDR block.
9. Repeat steps 6-8 for each transit gateway network interface that's associated with the VPC.

Note: Traffic from a VPN or Direct Connect connection might enter the VPC through a different Availability Zone or subnet than your instance's Availability Zone. Check network ACLs for all subnets that have network interfaces. For more information about network ACL rule application, see Network ACLs for transit gateways in AWS Transit Gateway.

Verify the subnet route table configuration

Complete the following steps:

1. Open the Amazon VPC console.
2. In the navigation pane, choose Route Tables.
3. Select the route table for your source instance.
4. Choose the Routes tab.
5. Check if Destination shows on-premises network.
6. Check if Target shows the transit gateway ID.

Check for a route entry for the destination CIDR block that points to the transit gateway. If you don't see a route entry then add an entry to the respective route table that points to the transit gateway.

Check Transit Gateway route tables for VPC attachments

Complete the following steps:

1. In the navigation pane, choose Transit Gateway Route Tables.
2. Select the route table that's associated with the VPC attachment.
3. On the Routes tab, check if a route exists for your on-premises network. Also check if Target shows DXGW/VPN attachment.
4. If you use Site-to-Site VPN with a static route, then create a static route for your on-premises network and choose VPN attachment as the target.

Check Transit Gateway route table for a Direct Connect gateway or VPN attachment

Complete the following steps:

1. In the navigation pane, choose Transit Gateway Route Tables.
2. Select the route table that's associated with the AWS Direct Connect gateway or VPN attachment.
3. On the Routes tab, check if a route exists for your VPC CIDR block. Then, check if the route's target is the correct transit gateway VPC attachment.

Check Direct Connect gateways for allowed prefixes

Complete the following steps:

1. Open the Direct Connect console.
2. In the navigation pane, choose Direct Connect gateways.
3. Select the Direct Connect gateway that's associated with the transit gateway.
4. Under Gateway association, verify that the Allowed prefixes field includes your VPC CIDR block.

Check the Network Firewall configuration or third-party firewall appliance configuration

Verify if you implemented a centralized inspection model to inspect the North-South traffic. If you implemented a centralized inspection model then verify that the AWS Network Firewall has Suricata rules that allow all necessary traffic. For more information about Suricata, see Suricata on the official Suricata website. For more information about centralized inspection models, see Deployment models for AWS Network Firewall and VPC-to-on-premises traffic inspection.

If you use a third-party virtual appliance for inspection, then make sure that the firewall rules allow all necessary traffic.

Check on-premises firewall devices for VPC traffic rules

Verify that your on-premises firewall devices allow all necessary traffic between both networks. For instructions, refer to your firewall vendor documentation.

Check the on-premises server’s firewalls

If the on premises server uses an operating system (OS) firewall, then verify that it allows traffic to and from the VPC CIDR block.

Analyze routes with Route Analyzer

Prerequisite: Create a global network with AWS Global Networks.

To analyze your routes with Route Analyzer for AWS Network Manager, complete the following steps

1. Open the Amazon VPC console.
2. In the navigation pane, choose Network Manager.
3. Choose the global network where you registered your transit gateway.
4. In the navigation pane, choose Transit Gateway Network. Then, choose Route Analyzer.
5. For Source and Destination, enter a transit gateway, the transit gateway attachment, and an IP address. Make sure that you use the same transit gateway in both Source and Destination fields.
6. Choose Run route analysis.

Note: After you run the route analysis, Route Analyzer shows a Connected or Not Connected status. If the status is Not Connected, then apply the routing recommendations that Route Analyzer provides, and then run the analysis again.

Related information

How do I troubleshoot VPC-to-VPC connectivity through a transit gateway?

Diagnosing traffic disruption using AWS Transit Gateway Network Manager Route Analyzer