Ytukyg

I'm using a partner connection (hybrid connectivity) to my VPC where I do manage the BGP peering. The router entity is automatically created by GCP in MANAGED_BY_ATTACHMENT mode so I cannot specify which addresses are used for peering.

From my router (169.254.61.250) I can ping a host in the VPC but the return traffic is filtered. I don't know if this is expected:

• The next trace is captured in a host in the VPC

root@bd-ecs-gcp-host1:~# tcpdump -nl -i ens4 "( tcp port 22 or icmp ) and host 169.254.61.250"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens4, link-type EN10MB (Ethernet), capture size 262144 bytes
18:19:37.263045 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 29, length 64
18:19:37.263102 IP 10.3.0.2 > 169.254.61.250: ICMP echo reply, id 27711, seq 29, length 64
18:19:38.262916 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 30, length 64
18:19:38.262967 IP 10.3.0.2 > 169.254.61.250: ICMP echo reply, id 27711, seq 30, length 64


• The return traffic towards my router (169.254.61.250) is dropped somewhere. The next trace is captured in my router:


19:19:35.240929 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 27, length 64 out slot1/tmm0 lis=
19:19:36.240934 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 28, length 64 out slot1/tmm0 lis=
19:19:37.240878 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 29, length 64 out slot1/tmm0 lis=
19:19:38.240724 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 30, length 64 out slot1/tmm0 lis=
19:19:39.240767 IP 169.254.61.250 > 10.3.0.2: ICMP echo request, id 27711, seq 31, length 64 out slot1/tmm0 lis=


I understand that using 169.254.x.x addresses is not ideal for monitoring because they are meant that they are link local. Ideally the customer should be able to specify a range for the peering.

Alternatively, could be possible to allow such traffic to be allowed? I don't need this only for testing initial connectivity but also for continious monitoring.

Any comments would be greatly appreciated

Thanks

Have you created the route for your custom IP address? Can you define the steps how you created the routes? Want to confirm if you are restricting the advertisement of subnets, which might be causing the issue. You can also check this document[1] for more details.

[1] https://cloud.google.com/solutions/custom-public-ip-addresses-on-compute-engine

Are you using Dedicated Interconnect attachments? To establish Hybrid connectivity?

Are you using any third-party firewall in between? I guess this could be related and that's why the return traffic is being filtered.

I also suspect that using 169.254.x.x is not appropriate, can you change the IP and check if it makes any difference on your ping result and returned traffic? I suspect it is not possible to ping a VPC host directly, there are no routes back to the 169.254.0.0 subnet.