During an outage, a city network team must determine whether traffi…

Question

During an outage, a city network team must determine whether traffic is blackholed by a Transit Gateway route table misconfiguration, a network ACL deny, or a security group rule. Which troubleshooting approach is most appropriate?

Accepted Answer

Systematically verify Transit Gateway and VPC routes, then evaluate network ACLs and security groups along the path, using flow logs and reachability analysis to isolate which control drops the packets. — Black holes have layers: wrong TGW route, subnet NACL, then security group. Walk the path in order and let flow logs tell you where packets vanish. Rebuilding the whole city network first is panic, not troubleshooting.

Answer

Immediately recreate all VPCs and Transit Gateways without inspecting routes or security controls.

Answer

Assume DNS is always the cause and change only Route 53 public records.

Answer

Disable CloudTrail organization-wide to reduce noise while guessing at firewall changes.

During an outage, a city network team must determine whether traffic is blackholed by a Transit Gateway route table misconfiguration, a network ACL deny, or a security group rule. Which troubleshooting approach is most appropriate?

Short Explanation

Full Explanation