Question

A developer reports that a VM named app-vm in subnet 10.10.0.0/24 cannot reach a database VM named db-vm on TCP port 5432 in subnet 10.20.0.0/24 within the same VPC. Both VMs are running and have correct IP configurations. You want to quickly determine, without generating live traffic, whether a firewall rule is blocking the connection and identify exactly which rule is responsible. What should you do?

Accepted Answer

Run a Network Intelligence Center Connectivity Test specifying app-vm as the source, db-vm as the destination, protocol TCP, and port 5432, then review the trace result for the rule that dropped the packet.

Answer

Enable VPC Flow Logs on both subnets and wait for the developer to retry the connection, then filter the logs for denied packets between the two VMs.

Answer

Enable Firewall Rules Logging on every rule in the VPC and inspect the hit counts in Cloud Monitoring to find which rule matched the traffic.

Answer

Use the Performance Dashboard in Network Intelligence Center to check packet loss between the two zones hosting the VMs.