How do I troubleshoot communication issues between Amazon VPCs over VPC peering?

Short description

VPC peering network connectivity failures might occur for the following reasons:

• There are incorrect or missing route table entries in the route table that you associated with the resources.
• There are firewall rules for your security group and network access control list (network ACL) that prevent the connection.
• The DNS resolves to an incorrect IP address.

The VPCs must communicate as if they're in the same network.

VPC peering doesn't support edge-to-edge routing through gateways or private connections. Resources in a peered VPC can't use the internet gateway, NAT device, VPN connection, or AWS Direct Connect link of the other VPC to access external networks.

Resolution

Use Reachability Analyzer to identify VPC connectivity issues

To check for configuration issues with security groups, network ACLs, and route tables, use Amazon VPC Reachability Analyzer. You can also use Reachability Analyzer to analyze paths across multiple AWS accounts in AWS Organizations. For more information, see How Reachability Analyzer works.

Test the VPC peering connectivity

Complete the following steps:

1. Open the AWS Network Manager console.
2. In the navigation pane, under Monitoring and troubleshooting, choose Reachability Analyzer.
3. Choose Create and analyze path.
4. For Source type, choose VPC Peering Connections. To test between Amazon Elastic Compute Cloud (Amazon EC2) instances in the same AWS Region, choose Instances.
5. For Source, select your source VPC endpoint. Or, select the instance from your source VPC.
6. For Destination type, choose VPC Peering Connections. Or, choose Instances.
7. For Destination, select your destination VPC endpoint. Or, select the instance from your destination VPC.
8. For Protocol, choose TCP or UDP.
9. Choose Create and analyze path.

Note: VPC peering doesn't support transitive peering.

Test the VPC peering connectivity between Amazon EC2 instances in different Regions

Use Reachability Analyzer to run a path analysis for your source instance and another path analysis for your destination instance.

To run a path analysis for your source instance, complete the following steps:

1. Open the Network Manager console in the Region where your source instance is.
2. In the navigation pane, under Monitoring and troubleshooting, choose Reachability Analyzer.
3. Choose Create and analyze path.
4. Under Path configuration, enter a path name, such as Path-1-Source.
5. For Source type, choose Instances.
6. For Source, select the instance from your source VPC.
7. For Destination type, choose VPC peering connection.
8. For Destination, select your peering connection.
9. For Protocol, choose TCP or UDP.
10. Choose Create and analyze path.
11. Review the results for connectivity issues.

To run a second path analysis for your destination instance, open the Network Manager console in the Region where your destination instance is. Choose VPC peering connections for Source type and Instances for Destination type.

Troubleshoot VPC peering connectivity issues

Based on your VPC peering connectivity issues, take one or more of the following actions:

• Verify that the VPC peering connection is in the Active state.
• Update your route tables for your VPC peering connection. Verify that the correct routes exist for connections to the IP address range of your peered VPCs through the appropriate peering ID.
• Verify that an ALLOW rule exists in the network ACL table for the required traffic.
• Verify that the security group rules allow network traffic between the peered VPCs.
• Use VPC Flow Logs to check whether traffic is getting rejected at either the source or destination. A REJECT can occur when security groups or network ACLs are missing the necessary permissions rules.

Related information

Why can't I resolve domain names over my VPC peering connection?