Troubleshooting VPC connectivity: SOA-C03 study notes and practice questions
What to know about Troubleshooting VPC connectivity for the SOA-C03 exam, from the Networking and Content Delivery domain (18% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
Connectivity troubleshooting is one of the most tested skills on this exam. Work through the path one hop at a time.
The checklist
Route tables at every hop, in both directions: subnet routes, transit gateway route tables (associations and propagations), peering routes on both sides.
Security groups: inbound on the destination; outbound on the source. Stateful, so return traffic is automatic.
Network ACLs: stateless, so both directions need rules, including ephemeral ports (1024-65535) for responses.
Gateways: internet gateway attached, NAT gateway in a public subnet, endpoints in the right subnets.
Public IP when going to the internet directly.
DNS: does the name resolve to the address you expect (private hosted zone associated, private DNS on endpoints)?
The application: is it listening on that port and interface?
Reading the symptom
Symptom
Usually
Timeout
Traffic is dropped: a route, security group, network ACL or missing gateway
Connection refused
Traffic arrives but nothing listens on the port
Works one way only
Network ACL missing the return rule, or an asymmetric route
Works by IP, not by name
DNS
Tools
Tool
Does
VPC Flow Logs
Records accepted and rejected flows at VPC, subnet or ENI level; a REJECT shows where traffic was dropped
VPC Reachability Analyzer
Tests a path between two resources without sending traffic and names the blocking component
Network Access Analyzer
Finds unintended network access paths against your rules
Traffic Mirroring
Copies packets for deep inspection
CloudWatch Internet Monitor
Internet-side performance and availability for your users
Transit Gateway Network Manager / route analyzer
Checks transit gateway routes
Common traps
Fixing IAM for a timeout.
Network ACL allows inbound 443 but not outbound ephemeral ports.
A transit gateway attachment with no route back to the source VPC.
A regional bank placed its public web servers in a subnet with a custom network ACL.
The inbound rules allow TCP 443 from 0.0.0.0/0, and the outbound rules allow TCP 443 to 0.0.0.0/0; everything else is denied. The security groups allow inbound 443.
Customers' browsers time out. VPC Flow Logs show the inbound packets on port 443 as ACCEPT, and the servers' reply packets to client ports such as 51544 as REJECT.
What should a CloudOps engineer change?
Choose one answer.
AA. Add an outbound rule to the security group that allows TCP traffic to 0.0.0.0/0 on ports 1024 to 65535.
BB. Add an outbound rule to the network ACL that allows TCP traffic to 0.0.0.0/0 on ports 1024 to 65535.
CC. Add an inbound rule to the network ACL that allows TCP traffic from 0.0.0.0/0 on ports 1024 to 65535.
DD. Replace the custom network ACL with a security group rule on the subnet that allows all return traffic.
Network ACLs evaluate each direction on its own. A rule that allows inbound 443 does not allow the response, which goes from port 443 to the client's ephemeral port. Flow logs that show ACCEPT inbound and REJECT for outbound replies are the classic sign, and an outbound rule for ports 1024 to 65535 fixes it.
A public library connects two VPCs, Catalog (10.10.0.0/16) and Archive (10.20.0.0/16), through a transit gateway.
Both attachments are associated with the same transit gateway route table. Each VPC's route table sends the other VPC's CIDR to the transit gateway, and security groups allow the traffic.
Packets from Archive reach Catalog but no replies return, and requests from Catalog to Archive time out. The transit gateway route table contains only a propagated route for 10.10.0.0/16.
What should a CloudOps engineer do?
Choose one answer.
AA. Create a VPC peering connection between the two VPCs and remove both attachments from the transit gateway.
BB. Propagate the Archive attachment to the transit gateway route table, or add a static route to it.
CC. Associate the Archive VPC attachment with a second, separate transit gateway route table.
DD. Add a route for 10.10.0.0/16 to the Catalog VPC's route table that points to the transit gateway attachment.
Show the answer and explanation
Answer: B
A. Wrong: Peering would work, but it replaces the existing design instead of fixing a missing route. The transit gateway is already in place for this connection. Learn more: What is VPC peering? (opens in a new tab)
B. Right: Correct. The transit gateway route table has no route to 10.20.0.0/16, so traffic toward Archive is dropped at the transit gateway. Propagating the Archive attachment, or adding a static route, completes the path. Learn more: Transit gateway route tables (opens in a new tab)
C. Wrong: Association decides which route table is used for traffic arriving from an attachment. The problem is that no route table has a route to Archive, so a new empty table would not help. Learn more: Transit gateway route tables (opens in a new tab)
Transit gateway traffic needs a route at every hop: in the source VPC's route table, in the transit gateway route table associated with the source attachment, and back again for replies. Here the transit gateway route table lacks the Archive CIDR. Propagation from the Archive attachment, or a static route, fixes it. Reachability Analyzer can find this kind of missing route quickly.
Want more on Troubleshooting VPC connectivity? The 5 full-length practice sets have 9 more Troubleshooting VPC connectivity questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →