VPC Peering Connection Status Abnormal Alert

The VPC Peering Connection Status Abnormal alert indicates that a VPC peering connection configured for the deployment is in an abnormal state, typically Failed.

This condition usually interrupts network communication between EMQX Cloud and external systems such as MySQL, Redis, PostgreSQL, and HTTP services. It may also cause data integration actions or external authentication and authorization requests to fail.

Peer VPC Deleted or Recreated

Symptom

If the peer VPC is deleted or replaced by a new VPC, for example, one with a different CIDR or VPC ID, the existing VPC peering connection becomes invalid and appears in an abnormal state in EMQX Cloud.

Even if EMQX Cloud retains the peering configuration, the network link cannot be established when the peer VPC no longer exists or its configuration has changed substantially.

Common Causes

• The peer VPC was deleted by mistake.
• The peer VPC was recreated with a different CIDR or VPC ID.

Resolution

• Check whether the peer VPC still exists and is operational.
• If the peer VPC was recreated, create a new VPC peering connection and configure the route tables on both sides correctly.

VPC Peering Connection Deleted on the Peer Side

Symptom

If the peer manually deletes the VPC peering connection in the cloud provider console, EMQX Cloud may retain its configuration record even though the underlying network link no longer exists. The peering connection then enters an abnormal state.

Common Cause

• The peer manually deleted the VPC peering connection in the cloud provider console.

Resolution

• Send a new VPC peering request.
• Make sure both the requester and accepter accept the request and complete the peering configuration.

Troubleshooting

1. Log in to the relevant cloud provider console and go to VPC -> Peering Connections. Verify that the peer VPC and peering connection both exist and are in a normal state.

2. Check the route tables for the VPCs that contain the requester and accepter instances. Verify that each route table has a route to the peer CIDR.

3. Check the security groups for the requester and accepter instances and verify the following:

   • The requester instance allows traffic from the accepter instance's VPC.
   • The accepter instance allows traffic from the requester instance's VPC.
   • Ports for critical services such as databases, HTTP services, and Kafka allow traffic from the peer CIDR.

4. Test network connectivity. Work with EMQX Cloud Technical Support to use tools such as ping, telnet, or nc to test connectivity and port reachability from the requester instance to the accepter instance.