Study Guide: Testing and Validating AWS Network Connectivity

This guide covers the essential tools and methodologies for validating network paths and troubleshooting connectivity within AWS and hybrid environments, focusing on the VPC Reachability Analyzer and Transit Gateway Route Analyzer.

Learning Objectives

After studying this guide, you should be able to:

• Differentiate between logical path analysis and data plane testing.
• Configure and interpret results from the VPC Reachability Analyzer.
• Utilize the Route Analyzer to validate Transit Gateway (TGW) configurations.
• Identify the appropriate tool for troubleshooting specific connectivity issues (e.g., Security Groups vs. Route Tables).
• Automate connectivity intent verification using AWS native tooling.

Key Terms & Glossary

• VPC Reachability Analyzer: A configuration analysis tool that enables you to perform connectivity testing between a source and a destination in your VPCs.
• Route Analyzer: A specific utility within the Transit Gateway service used to analyze the routing path between specified IP addresses across TGW route tables.
• Connectivity Intent: The desired state of network access (e.g., "Subnet A should reach Subnet B") that can be validated against the actual configuration.
• Logical Model: A representation of the network configuration used by Reachability Analyzer to calculate paths without sending actual packets.
• Forward and Return Path: The two-way traffic flow; Route Analyzer is unique in its ability to explicitly analyze the return path from destination back to source.

The "Big Idea"

In traditional networking, troubleshooting often relies on "active" testing like ping or traceroute, which require the infrastructure to be fully operational and security rules to allow ICMP. In AWS, Reachability Analysis shifts this to a "static" or "logical" validation. By analyzing the configuration (code) rather than the traffic (forwarding plane), AWS allows engineers to verify connectivity before traffic even flows, ensuring that security groups, ACLs, and route tables are aligned with the intended design without risking security exposure or relying on intermittent packet success.

Formula / Concept Box

Hierarchical Outline

• I. VPC Reachability Analyzer
  • Functionality: Traces path from source to destination (ENI, VPC Peering, VPN Gateway).
  • Analysis Type: Hop-by-hop breakdown (Security Groups, Network ACLs, Route Tables).
  • Limitations: Does not test actual data transfer (MTU issues or application-level errors).
• II. Transit Gateway Route Analyzer
  • Focus: Deep dive into TGW-specific routing logic.
  • Capabilities: Supports both IPv4 and IPv6; analyzes multi-hop TGW paths.
  • Requirement: Does NOT check VPC-level security groups or ACLs (requires Flow Logs for that).
• III. Traditional Tooling (Data Plane)
  • ICMP Ping: Validates host reachability and basic latency.
  • VPC Flow Logs: Captures "Accept/Reject" outcomes for actual traffic flows.
  • Traffic Mirroring: Analyzes raw packets for deep inspection (e.g., packet shaping issues).

Visual Anchors

The Reachability Analysis Process

Scope Comparison: Reachability vs. Route Analyzer

\begin{center} \begin{tikzpicture}[node distance=2cm, every node/.style={rectangle, draw, rounded corners, minimum width=3cm, minimum height=1cm, align=center}]

\end{tikzpicture} \end{center}

Definition-Example Pairs

• Hop-by-Hop Analysis: A detailed report showing every intermediate gateway or security check a packet encounters.
  • Example: Using Reachability Analyzer to see exactly which Network ACL rule (e.g., Rule #100) is dropping traffic from a web server to a database.
• Automation of Connectivity Intent: Using code to verify that network changes haven't broken required paths.
  • Example: Running a Lambda function that triggers a Reachability Analyzer test via the SDK every time a CloudFormation stack updates a Route Table.

Worked Examples

Scenario: Troubleshooting a "Timed Out" Connection

Problem: An EC2 instance in Subnet A cannot reach an RDS instance in Subnet B via Port 3306.

1. Step 1: Initiation: Open VPC Reachability Analyzer. Select the source (EC2 ENI) and destination (RDS ENI). Specify Protocol (TCP) and Port (3306).
2. Step 2: Analysis: The tool runs a logical trace. It reports "Not Reachable."
3. Step 3: Identification: The analysis results highlight the Destination Security Group. It shows that while the Outbound rule from the EC2 is correct, the Inbound rule on the RDS Security Group only allows traffic from a different CIDR block.
4. Step 4: Resolution: Update the RDS Security Group to allow 3306 from Subnet A. Re-run the analyzer to confirm the path is now "Reachable."

Checkpoint Questions

1. Does the VPC Reachability Analyzer send actual ICMP or TCP packets across the network?
2. Which tool would you use to specifically validate the return path of a packet through a Transit Gateway?
3. True or False: The TGW Route Analyzer provides information about Security Group rules within a VPC.
4. What AWS service provides a single dashboard to visualize global network operations and SD-WAN integrations?

▶View Answers

1. No, it uses a logical model and analyzes configurations in code.
2. AWS Route Analyzer.
3. False; it only analyzes TGW route tables. You need VPC Reachability Analyzer or Flow Logs for Security Groups.
4. Transit Gateway Network Manager.

Muddy Points & Cross-Refs

• Reachability Analyzer vs. Flow Logs: Remember that Reachability Analyzer is predictive/logical (tells you if it should work), whereas Flow Logs are historical/factual (tells you if it did work). If Reachability Analyzer says "Reachable" but traffic fails, check for application-level issues or MTU mismatches.
• MTU and Packet Size: These tools generally do not detect MTU (Maximum Transmission Unit) mismatches. If you suspect packet drops due to size, use VPC Traffic Mirroring or CloudWatch Network Performance Metrics.

Comparison Tables

Tool Selection Matrix

[!IMPORTANT] Reachability Analyzer charges per analysis. For high-frequency testing, consider automating tests only on significant infrastructure changes to manage costs.