Routing between Availability Zones in a single VPC

0

Hello

We have two availability zones with /24 subnets each from the same /16 VPC subnet. We see the subnets in the VPC routing table, but we can't ping devices from one zone to the other.

How to set up routing between availability zones.

Thank you.

asked 7 months ago156 views
2 Answers
1

Hello.

Do you allow ICMP in the inbound rules of the EC2 security groups running in each subnet?
Please try configuring each EC2 security group as described in the document below.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html#sg-rules-ping

Also, check that the VPC CIDR route is registered as local in the subnet route table.
Please check that the network ACL allows all communication.
https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

profile picture
EXPERT
answered 7 months ago
profile picture
EXPERT
reviewed 7 months ago
1

Firstly regarding Routing between subnets in different AZ of same VPC: You don't need to configure Routing between Subnets. Every route table contains a local route for communication within the VPC. This route is added by default to all route tables. If your VPC has more than one IPv4 CIDR block, your route tables contain a local route for each IPv4 CIDR block. More details can be found here: https://docs.aws.amazon.com/vpc/latest/userguide/subnet-route-tables.html#route-table-routes

Secondly regarding communication not working: This could be due to following reasons.

  1. Security Groups on Source and Destination: Please verify the SG rules (Inbound and Outbound) are configured correctly on Source and Destination to allow the desired communication. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
  2. NACL Rules on subnet level: Please verify the NACL rules on Source and Destination subnets are configured correctly to allow the desired communication. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
  3. OS Firewall: Verify if there are any OS level Firewall rules which are blocking the connectivity.

You can utilize AWS VPC flow logs to verify if restrictive SG or NACL rules are blocking the connectivity. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-security-groups

AWS
answered 7 months ago
profile pictureAWS
EXPERT
reviewed 7 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions