Troubleshoot site connections
Resolve common Site-to-Site VPN problems, from refused creates and changes and objects in use to tunnels that aren't Active and traffic that doesn't pass.
This article lists common problems with Site-to-Site VPN, what causes them, and how to resolve them. When the platform refuses a request, the console shows The request was refused with the platform's message, followed by a code such as (VALIDATION_FAILED). The messages below are quoted without the code.
VPN isn't offered in the region
| Symptom | Cause | Resolution |
|---|---|---|
| VPN is missing from the menu, or a VPN page shows a notice that VPN isn't offered or isn't available in the region | The project's region doesn't offer Site-to-Site VPN. | This project's region cannot be changed. To use it, open a project in a region that offers it. Anything you already have in other projects is unaffected. |
| "network/vpn is not available in region" followed by the region | The same, refused by the API. | Use a project in a region that offers Site-to-Site VPN. |
Creating an object is refused
Nothing is created when the platform refuses a request. Messages marked "under the field" appear on the form before anything is sent.
| Message | Cause | Resolution |
|---|---|---|
| No router with an external gateway in the router list | No router in the project has an external gateway. | Set an external gateway on a router. See Set or clear the external gateway. |
| "the selected router has no external gateway; a VPN service can only terminate tunnels on a router that has one" | The router lost its external gateway, or the request named a router without one. | Select a router with an external gateway. |
| "a VPN site connection with this name already exists", or the same message for another type of object | The name is taken by an object of the same type in the project, also by one in Error. | Enter another name, or delete the old object. |
| 172.16.0.0/16 is listed twice — each subnet or CIDR can appear in a group only once., under the field | A subnet or CIDR appears twice in the group. | Remove the repeated entry. |
| "not a valid CIDR:" followed by the entry | An entry in Remote CIDRs isn't a valid IP network. | Write each remote network as an address and a prefix length, such as 172.16.0.0/16. |
| Must be at least 8 characters., under the field | The pre-shared key has fewer than 8 characters. | Enter a longer key. |
| "the selected local endpoint group is not provisioned yet; wait for it to become ready and try again", or the same message for another object | An object the connection refers to hasn't finished creating, or its creation failed. | Wait until the object is Ready, and try again. If it's in Error, delete it and create it again. |
| A message that every subnet in the local endpoint group must be attached to the VPN service's router, ending with "Not attached:" and the subnet IDs | A subnet in the local endpoint group isn't attached to the router that the VPN service is on. | Attach the subnet to that router, or use a local endpoint group with only the router's subnets. |
| "dpdTimeout must be greater than dpdInterval" | The dead peer detection timeout is equal to or less than the interval. | Enter a timeout greater than the interval. |
| A message that the MTU must not exceed the deployment's tenant network MTU, with the number in parentheses | The MTU is larger than the deployment allows. | Enter that number or a smaller one. |
A message that localId or peerId can't be set through this API | An API request set an IKE identity. | Leave both out: the identities are always the gateway addresses. |
If guided setup stopped part-way, see If the run stops part-way.
A change or deletion is refused
| Message or symptom | Cause | Resolution |
|---|---|---|
| This policy is referenced by 1 site connection, so the platform refuses every change to it. Delete the connections that use it, or create a new policy instead. | Site connections use the policy. A policy in use can't be changed, not even renamed. | Create a new policy, create a new site connection on it, and delete the old connection. |
| Delete is unavailable with Referenced by 1 site connection — while that is true the platform refuses to delete it, and refuses to change a policy. | Site connections refer to the object. The count includes connections in Error. | Delete those site connections first. |
| "this VPN service cannot be deleted while 1 site connection(s) use it", or the same message for another object, with Blocked by 1 site connection: and the connections | Site connections use the object. | Delete those site connections first — the platform releases the object as soon as nothing references it. |
| "this VPN site connection is busy and cannot be updated yet", or the same message for another object or action | The object's previous operation is still running. | Wait until its status is no longer pending, and try again. |
A message that a field such as ikePolicyId or localEndpointGroupId can't be changed after the connection is created | An API request tried to change a field that's fixed at creation. | Create a new site connection with the objects you want, and delete the old one. |
| "Your role is read-only — ask an owner to grant write access." | Your role, for example Reader, doesn't allow changes. | Ask for the Owner or Contributor role, or a custom role with Manage access to Networking. |
For the steps to change and delete objects, see Edit, disable, and delete VPN objects.
A tunnel action is unavailable
| Hint on the action | Cause | Resolution |
|---|---|---|
| Already enabled — there is nothing to enable. | The connection is enabled. | No action needed. |
| Already disabled — there is nothing to disable. | The connection is disabled. | To bring the tunnel back, select Enable. |
| The connection is disabled, so there is no tunnel to restart. | The connection is disabled. | Select Enable; enabling negotiates the tunnel again. |
| No hint, and the action is unavailable | The connection's last operation is still running. | Wait until its provisioning status is no longer pending. |
For what each action does, see Disable, enable, or restart a tunnel.
The tunnel status isn't Active
If the provisioning status is Error, see The connection shows Error. Otherwise, a tunnel status of Not reported yet or pending means that the provider hasn't reported a settled status yet. The platform reads the status from the provider at regular intervals; Refresh only reloads the platform's record. Wait, and check again.
Compare every setting of the remote device with the site connection, its policies, and its endpoint groups: the gateway addresses, the pre-shared key, the IKE version and phase 1 mode, the algorithms, the PFS groups, the lifetimes, and the networks on both sides. See Configure the peer device.
If Initiator is response-only, the remote device must start the negotiation.
After you correct a setting on the remote device, select Restart on the connection's page. The tunnel is dropped and renegotiated. Traffic to the peer network stops until the new security association comes up.
To correct a setting on the platform side, see Change a site connection. The policies can't be changed while the connection uses them; create a new policy and a new connection instead. See Reuse and changes.
The connection shows Error
| What the page shows | Cause | Resolution |
|---|---|---|
| What the provider reported with the provider's own message | The last create, change, or deletion failed at the provider. | Correct the cause that the message names. If the creation failed, delete the connection and create a new one. |
| What the provider reported with "neutron reported the connection ERROR at import" | The provider reports the connection in error. | Check the settings on both sides, and select Restart. If the error stays, delete the connection and create it again. |
| Operation cancelled — leftover resources may remain | The creation was canceled after it had started. | Select Clean up. |
The tunnel is Active, but traffic doesn't pass
| Symptom | Cause | Resolution |
|---|---|---|
| A second site connection to the same peer gateway shows a status but carries nothing. | Two connections between the same two gateways share one IKE session, and the second one's tunnel is refused. | Delete the connections to that peer, and create one connection whose local endpoint group holds every subnet that should reach the peer. |
| Traffic from one of your subnets doesn't reach the remote network. | The subnet isn't in the connection's local endpoint group. Endpoint groups can't be changed. | Delete the connection, and create a new one on a local endpoint group that holds all the subnets. |
| Small packets pass, but large ones fail. | ESP adds a header, a trailer, and authentication data to every packet, so the packets that fit inside the tunnel are smaller than its MTU. A packet that's too large fails with an error. | Lower the MTU of the workloads, or clamp their TCP MSS. |
| Traffic from the remote network doesn't reach your servers. | Security groups filter the traffic to your servers. | Check that the servers' security groups allow traffic from the remote CIDRs. See Security Groups. |