Can not ping from secondary ENI to office pc

0

Hi, I have established a s2s VPN connection between aws and office. The route table has entry to the Virtual private gateways 192.168.10.0/24 vgw-xxxx

I can ping to and receive ping from office pc, but for the second ENI, I can only receive ping:

I can ping the second ENI from office: C:\Users\Robbert>ping 172.31.43.97

Pinging 172.31.43.97 with 32 bytes of data: Reply from 172.31.43.97: bytes=32 time=25ms TTL=63 Reply from 172.31.43.97: bytes=32 time=24ms TTL=63 Reply from 172.31.43.97: bytes=32 time=24ms TTL=63

Ping statistics for 172.31.43.97: Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 24ms, Maximum = 25ms, Average = 24ms

and I can ping to office using the first ENI: ubuntu@ip-172-31-34-10:~$ ping -I ens5 192.168.10.50 -w 2 PING 192.168.10.50 (192.168.10.50) from 172.31.34.10 ens5: 56(84) bytes of data. 64 bytes from 192.168.10.50: icmp_seq=1 ttl=127 time=24.3 ms 64 bytes from 192.168.10.50: icmp_seq=2 ttl=127 time=23.9 ms

--- 192.168.10.50 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms

However I can not ping it using the second ENI: ubuntu@ip-172-31-34-10:~$ ping -I ens6 192.168.10.50 PING 192.168.10.50 (192.168.10.50) from 172.31.43.97 ens6: 56(84) bytes of data. From 172.31.43.97 icmp_seq=1 Destination Host Unreachable From 172.31.43.97 icmp_seq=2 Destination Host Unreachable ...

and here is the route table ubuntu@ip-172-31-34-10:~$ ip r default via 172.31.32.1 dev ens5 proto dhcp src 172.31.34.10 metric 100 172.31.32.0/20 dev ens6 proto kernel scope link src 172.31.43.97 172.31.32.0/20 dev ens5 proto kernel scope link src 172.31.34.10 172.31.32.1 dev ens5 proto dhcp scope link src 172.31.34.10 metric 100 172.31.43.97 dev ens6 proto static scope link

How do I resolve this one way communication issue? Thank you! Robbert

Robbert
已提問 9 個月前檢視次數 319 次
1 個回答
0
已接受的答案

Hello.
Does the secondary ENI use a different subnet than the primary ENI?
If the subnets are different, you would need to set up a static route to the default gateway.
The following command is an example, but it is a command to add routing.

ip route add 192.168.10.0/24 via 172.31.43.1 dev ens6
profile picture
專家
已回答 9 個月前
profile pictureAWS
專家
已審閱 9 個月前
profile picture
專家
已審閱 9 個月前
  • Thank you, both are in the same subnet, but when I tried your example with the real default gateway , It did work:

    ip route add 192.168.10.0/24 via 172.31.32.1 dev ens6

    ping -I ens6 192.168.10.50

    PING 192.168.10.50 (192.168.10.50) from 172.31.43.97 ens6: 56(84) bytes of data

    64 bytes from 192.168.10.50: icmp_seq=1 ttl=127 time=24.7 ms ...

    not clear why it work as both ENI have same gateway, see below:

    ip r

    default via 172.31.32.1 dev ens5 proto dhcp src 172.31.34.10 metric 100

    172.31.32.0/20 dev ens6 proto kernel scope link src 172.31.43.97

    172.31.32.0/20 dev ens5 proto kernel scope link src 172.31.34.10

    172.31.32.1 dev ens5 proto dhcp scope link src 172.31.34.10 metric 100

    172.31.43.97 dev ens6 proto static scope link

    192.168.10.0/24 via 172.31.32.1 dev ens6

    and another related question, From the second ENI I canot ping 8.8.8.8

    ping -I ens6 8.8.8.8

    PING 8.8.8.8 (8.8.8.8) from 172.31.43.97 ens6: 56(84) bytes of data.

    From 172.31.43.97 icmp_seq=1 Destination Host Unreachable

    Do you know why? Thanks again for your help!

    Robbert

  • I believe the following route is to be used when the sender is the primary ENI. In other words, I thought it was not used in the secondary ENI.

    default via 172.31.32.1 dev ens5 proto dhcp src 172.31.34.10 metric 100
    

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南