Using Reachability Analyzer

Using Reachability Analyzer

ℹ️ Overview

VPC Reachability Analyzer is a configuration analysis tool that helps you:

• Verify network connectivity between resources in your VPC
• Troubleshoot connectivity issues without sending actual packets
• Validate security group and network ACL configurations
• Analyze both forward and reverse paths

💡 Key Benefits:

• No packet sending: Static analysis of configuration
• Cost-effective: Pay only for analysis runs (~$0.10 per analysis)
• Fast results: Analysis completes in minutes
• Detailed insights: Shows exact path and potential blockers

🏗️ What We’ll Test: We’ll verify connectivity between EC2 Public and EC2 Private to ensure our VPC configuration is correct.

Create Reachability Analysis

1. Access the VPC interface

   • Navigate to Network Manager in the left sidebar
   • Select Reachability Analyzer
   • Click Create and analyze path

   

2. Configure Path Analysis

   Source Configuration:

   • Name tag: Enter EC2 Public to EC2 Private
   • Source type: Select Instances
   • Source: Select EC2 Public

   💡 Tip: The source is where the connection originates (in this case, EC2 Public).

   

3. Destination Configuration:

   • Destination type: Select Instances
   • Destination: Select EC2 Private
   • Destination port: Leave default (analyzes all ports)
   • Protocol: Leave default (TCP)

   

4. Review and Create

   • Leave remaining parameters at default values
   • Click Create and analyze path

   ⏱️ Analysis Time: The analysis typically takes 1-5 minutes to complete.

   

Review Analysis Results

5. Check Analysis Status

   • Wait for the status to change to Reachable
   • Reachable means connectivity is possible based on current configuration
   • Not reachable would indicate a configuration issue

   ✅ Expected Result: Status should be Reachable since we configured security groups to allow traffic between the instances.

   

6. View Analysis Summary

   • Click on the analysis to see detailed results
   • Review the summary information

   

Analyze Network Path Details

7. View Forward Path Details

   • Click Path details tab
   • Review the network components in the path:
     • Source: EC2 Public instance
     • Source ENI: Network interface of EC2 Public
     • Source Security Group: Rules allowing outbound traffic
     • Destination Security Group: Rules allowing inbound traffic
     • Destination ENI: Network interface of EC2 Private
     • Destination: EC2 Private instance

   💡 Understanding the Path:

   EC2 Public → ENI → Security Group (outbound) → 
   VPC Routing → Security Group (inbound) → ENI → EC2 Private
   

   

8. Analyze Reverse Path

   • Click Reverse path details tab
   • Verify that return traffic can flow from EC2 Private back to EC2 Public
   • This confirms bidirectional connectivity

   🔒 Security Note: Both forward and reverse paths must be open for successful two-way communication.

   

Understanding the Results

💡 What Reachability Analyzer Checks:

• ✅ Security group rules (inbound and outbound)
• ✅ Network ACL rules
• ✅ Route table configurations
• ✅ Internet Gateway and NAT Gateway settings
• ✅ VPC peering and Transit Gateway routes
• ✅ Network interface configurations

⚠️ What It Doesn’t Check:

• ❌ Instance-level firewalls (iptables, Windows Firewall)
• ❌ Application-level issues
• ❌ DNS resolution problems
• ❌ Actual network performance

🏗️ Use Cases:

1. Pre-deployment validation: Verify connectivity before launching applications
2. Troubleshooting: Identify why connections are failing
3. Security audits: Verify that only intended paths are open
4. Change validation: Confirm that security group changes work as expected

💰 Cost Considerations:

• Per analysis: ~$0.10 per path analysis
• No ongoing charges: Pay only when you run analyses
• Cost-effective troubleshooting: Cheaper than trial-and-error debugging

💡 Best Practices:

1. Run analysis after major network configuration changes
2. Test both forward and reverse paths
3. Document analysis results for compliance
4. Use descriptive names for analyses
5. Delete old analyses to keep the console clean

✅ Completed: You’ve successfully used VPC Reachability Analyzer to verify connectivity between EC2 Public and EC2 Private instances!