Question

Your company has two custom-mode VPCs, prod-vpc and analytics-vpc, connected via VPC Network Peering. After the peering is established and reported as ACTIVE, engineers in analytics-vpc can reach existing instances in prod-vpc. A network admin later creates a brand-new subnet (10.30.0.0/20) in prod-vpc and launches instances there, but analytics-vpc instances cannot reach the new subnet. No firewall rules are blocking the traffic, and the peering state is still ACTIVE. What is the most likely explanation?

Accepted Answer

Subnet routes for new subnets are exchanged automatically across active peering connections, so the new subnet's /20 range likely overlaps with a range already in analytics-vpc, causing the route to be dropped.

Answer

Subnet routes for newly created subnets are automatically exchanged across an active peering, so the issue must be a missing custom route import setting that only affects new subnets.

Answer

VPC Network Peering does not automatically propagate subnet routes created after peering; the peering must be deleted and re-created to pick up the new subnet range.

Answer

The new subnet needs a manually created static route in analytics-vpc pointing to the peering connection, because peering only exchanges routes for subnets that existed at creation time.