AWS Networking · VPC · Transit Gateway · Real Incident

Stop Guessing.
Start Tracing.
How AWS Reachability Analyzer
Found Our Broken Network in Minutes

A complete walkthrough of diagnosing a silent Transit Gateway routing failure across 10 VPCs — using AWS Reachability Analyzer to pinpoint the exact broken hop without touching a single security group rule.

10 VPCs · 1 Transit Gateway
1 missing route · root cause
Reachable in < 2 minutes
🔍
FREE

Reachability Analyzer

Logical path analysis — walks your real network config hop by hop. No traffic sent. $0.10 per analysis.

🌐
10 VPCs

Transit Gateway Hub

Hub-and-spoke TGW connecting all VPCs across regions. Route tables, attachments, propagations.

⚠️
ROOT CAUSE

Missing Return Route

Destination VPC subnet route table had no route back through TGW — traffic arrived and had nowhere to go.

AWS networking is deceptively quiet when it's broken. No alarms. No flashing red lights. Just a ping that never returns, a replication agent going offline, and a jump server that's an island in its own VPC. That's exactly what we faced last week.

The environment: a hub-and-spoke Transit Gateway connecting 10 VPCs. A Windows jump server at 10.110.10.174 that couldn't reach anything in the 10.13.0.0/16 range. The routing looked correct everywhere we checked. The security groups looked open. The TGW route tables looked fine. Everything looked fine — until we actually traced it.

The starting point

10 VPCs, 1 TGW, and a jump
server that couldn't talk to anything

The complaint was simple: connectivity from the jump server (10.110.0.0/16 VPC) to the target network (10.13.0.0/16) was completely broken. No error messages, no timeout logs — just silence. Before touching anything, we needed to understand the full picture.

01

Jump server VPC — 10.110.0.0/16

Windows jump server at 10.110.10.174, hosted in vpc-dummy-hub-01. Subnet route table had a route for 10.13.0.0/16 pointing at the TGW. Looked correct.

02

Transit Gateway — tgw-dummy-hub-01

Central hub with 10 VPC attachments. TGW route table tgw-rtb-dummy-01 had a propagated active route for 10.13.0.0/16. Also looked correct.

03

Destination VPC — AZ-CORENET-SPOKE (10.13.0.0/16)

Target network hosting the internal network appliance. VPC attachment tgw-attach-dummy-corenet was active and propagated. Still looked fine on paper.

04

Security groups and NACLs — all permissive

Jump server SG allowed all outbound. NACLs on both sides had Rule 100: Allow ALL. No obvious blocks anywhere in the chain.

05

Manual inspection failed to find the issue

After checking 6 separate console sections across two AWS accounts, the network still appeared correctly configured. Time to stop guessing.

The old way

Manual AWS network debugging means checking Security Groups → NACLs → Route Tables → TGW Route Tables → Destination SGs → return path. That's 6+ console hops per direction, and you're still only as confident as your ability to read static config. Human error loves static config.

The tool

AWS Reachability Analyzer —
logical path execution

AWS Reachability Analyzer doesn't send real traffic. It performs logical path analysis — walking your actual network configuration as AWS sees it, hop by hop, and telling you exactly where a packet would die. It evaluates Security Groups, NACLs, route tables, TGW route tables, peering connections, and VPN attachments in a single analysis run.

VPC → Reachability Analyzer → Create path
source_type instance
source i-0dummy12345abcdef # Windows Jump Server
destination_type instance
destination i-0dummy98765fedcba # Target in 10.13.10.x
protocol TCP
destination_port 22
 
# Analysis runs in ~90 seconds
✓ Analysis complete — path ID: nip-0dummy1b35057d8b20
⚠ Reachability status: NOT REACHABLE
✗ ExplanationCode: NO_ROUTE_TO_DESTINATION
RouteTable: rtb-0dummy8b7fd02136c64be
VPC: vpc-0dummy4602d8c81581a19 (AZ-CORENET-SPOKE)

One analysis. One definitive answer. The route table rtb-0dummy8b7fd02136c64be in the destination VPC had no route back to the TGW for the 10.110.0.0/16 network. Traffic was arriving at the spoke VPC correctly — but the return path was completely absent.

Cost: $0.10

That's the cost of one Reachability Analyzer run. Ten cents for a definitive, auditable, hop-by-hop network trace that would have taken an experienced network engineer an hour of console archaeology. Run it before you touch a single security group rule.

Path details

10 hops traced — the full
verified path

The forward path from the jump server to the TGW attachment was fully reachable. Here's every hop the analyzer walked, with all identifiers replaced with dummy values:

Analysis Summary — nia-0dummy34b64a96621d6

✓ Forward: Reachable
Analysis ID
nia-0dummy34b64a96621d6
Path ID
nip-0dummy1b35057d8b20
Source
i-0dummy12345abcdef
Windows Jump Server
Destination
tgw-attach-0dummy607148015
transit-gateway-corenet
Protocol
TCP · all ports
Analysis date
March 28, 2026 · 17:59 UTC+5:30

Path Components (10 hops)

All succeeded
1 💻
EC2 Instance · Source
i-0dummy12345abcdef (Windows Jump Server)
Src: 10.110.10.174/32 → Dst: 10.13.0.0/16 · TCP
2 🔌
Network Interface
eni-0dummy8c6ee50faa83c
VPC: vpc-0dummy hub · Subnet: subnet-0dummy2edef17759ba1ed
3 🛡️
Security Group · Outbound
sg-0dummy53442a155f21136e (launch-wizard-4)
Rule: Allow ALL · CIDR: 0.0.0.0/0
4 🚧
Network ACL · Outbound
acl-0dummy49fdb76feab45ab
Rule 100: Allow ALL · CIDR: 0.0.0.0/0
5 🗺️
Route Table
rtb-0dummy0ea803a46035428cc (internet-route)
10.13.0.0/16 → tgw-0dummy8a75e8d36b34e481 · Active
6 🚧
Network ACL · Inbound
acl-0dummy49fdb76feab45ab
Rule 100: Allow ALL · CIDR: 0.0.0.0/0
7 🔌
Network Interface · TGW ENI
eni-0dummy10cec6f44e66fdc7
Attached to tgw-attach-0dummy f47e6199b8fa84a3 · Subnet: subnet-0dummy
8 🌐
Transit Gateway Attachment
tgw-attach-0dummyf47e6199b8fa84a3 (hub-attachment)
TGW: tgw-0dummy8a75e8d36b34e481
9 🗺️
TGW Route Table
tgw-rtb-0dummy625a5c9492e01380
Route for 10.13.0.0/16 → tgw-attach-0dummycorenet · Active, Propagated
10 🎯
Transit Gateway Attachment · Destination
tgw-attach-0dummycorenet (transit-gateway-corenet)
Inbound: 10.13.0.0/16 · Src: 10.110.10.174/32 · TCP

Forward path: fully reachable. But the analyzer also ran the reverse path — and that's where it found the break.

Root cause

NO_ROUTE_TO_DESTINATION —
the exact broken hop

The reverse path analysis returned a definitive error code pointing to a single resource. No ambiguity, no guesswork:

Reverse path analysis result
ExplanationCode NO_ROUTE_TO_DESTINATION
RouteTable rtb-0dummy8b7fd02136c64be
VPC vpc-0dummy4602d8c81581a19
VPC Name AZ-CORENET-SPOKE
 
# Route table had only 2 routes:
0.0.0.0/0 → igw-0dummy6bda2b518458269b (internet gateway)
10.13.0.0/16 → local
 
MISSING: 10.110.0.0/16 → tgw-0dummy8a75e8d36b34e481
RESULT: Return traffic dropped. Connection fails.

The destination VPC's subnet route table was pointed entirely at an internet gateway for external traffic and had a local route for its own CIDR — but no route back through the Transit Gateway for any of the internal 10.x.x.x networks. Traffic from the jump server was arriving at the spoke VPC successfully. The response packets had nowhere to go.

Classic TGW gotcha

Asymmetric routing is the most common Transit Gateway mistake. Forward path and return path use different route tables — both must be configured correctly. Reachability Analyzer exposes this instantly. Manual inspection almost always misses it.

What we checked manually vs. what the analyzer found

ComponentManual checkAnalyzer result
Jump server Security GroupLooks open ✓✓ Confirmed open
Jump server NACLLooks open ✓✓ Rule 100 Allow ALL
Source subnet route tableHas TGW route ✓✓ 10.13.0.0/16 → TGW
TGW route tableHas 10.13 route ✓✓ Propagated, Active
Destination VPC attachmentActive ✓✓ Reachable
Destination subnet route tableNot checked ✗✗ NO_ROUTE_TO_DESTINATION
The fix

One route entry. Problem solved.

Navigate to VPC → Route Tables → rtb-0dummy8b7fd02136c64be → Edit routes → Add route:

rtb-0dummy8b7fd02136c64be · Edit routes
# Before (2 routes — broken)
0.0.0.0/0 → igw-0dummyb (internet gateway)
10.13.0.0/16 → local
 
# After (3 routes — fixed)
0.0.0.0/0 → igw-0dummyb
10.13.0.0/16 → local
10.0.0.0/8 → tgw-0dummy8a75e8d36b34e481 ← ADD THIS
 
# 10.0.0.0/8 covers all internal VPCs via TGW
# local route for 10.13.0.0/16 takes priority automatically

Navigate to destination subnet route table

VPC → Route Tables → filter by VPC vpc-0dummy4602d8c81581a19 (AZ-CORENET-SPOKE)

Add route: 10.0.0.0/8 → Transit Gateway

Destination: 10.0.0.0/8 · Target: Transit Gateway → select tgw-0dummy8a75e8d36b34e481 · Save

Re-run Reachability Analyzer

Create a new analysis on the same path. Status changes from NOT REACHABLE to REACHABLE within 90 seconds.

Verify connectivity from the jump server

Run ping 10.13.10.1 or traceroute 10.13.10.1 from the Windows jump server. Response arrives. Problem closed.

Final results

What Reachability Analyzer found
in a single analysis run

10
hops traced
full path verified
$0.10
total cost
per analysis run
90s
time to result
vs. 60+ min manual
1
route entry fix
problem closed

What worked exceptionally well

The ExplanationCode: NO_ROUTE_TO_DESTINATION output was the standout — a machine-readable, unambiguous diagnosis pointing to a specific route table in a specific VPC. No interpretation required. Compare this to the manual approach where we had already checked 5 of the 6 components correctly and still had no answer.

The reverse path analysis was equally critical. Forward path was reachable — if we'd stopped there, we would have concluded the network was fine. Always run both directions. Asymmetric routing failures are invisible from one side.

The one rule

Don't touch a security group rule, NACL, or route table until you've run Reachability Analyzer first. It will tell you exactly what's wrong — and exactly what isn't wrong, so you stop changing things that don't need changing and creating new problems in the process.

Bottom line

AWS Reachability Analyzer is the single most underused tool in the VPC console. For $0.10 and 90 seconds you get a hop-by-hop audit trail of your network path — the kind of diagnosis that used to require a senior network engineer, a whiteboard, and an hour of console archaeology. Run it first. Always.

AWS VPCTransit GatewayReachability Analyzer Network TroubleshootingRoute TablesSecurity Groups NACLsHub and SpokeAsymmetric Routing AWS Networking
Official support · verified from AWS docs

What Reachability Analyzer
can actually analyze

Before running an analysis, it helps to know exactly what resource types are supported. Here's the complete list verified directly from the official AWS documentation.

Sources & Destinations

These resource types can be used as either the source or destination of a path:

Resource TypeExample Use CaseNotes
EC2 InstanceInstance A → Instance B✓ Supported
Network Interface (ENI)ENI → RDS ENI · Web → DB✓ Supported
Internet Gateway (IGW)IGW → EC2 instance (inbound)✓ Supported
Transit GatewayTGW → spoke VPC instance✓ Supported
Transit Gateway AttachmentVPC attachment → attachment✓ Supported
Virtual Private Gateway (VGW)On-prem VPN → VPC✓ Supported
VPC EndpointEC2 → S3 VPC endpoint✓ Supported
VPC Endpoint ServicePrivateLink consumer → service✓ Supported
VPC Peering ConnectionPeered VPC A → VPC B✓ Supported
IP AddressAny source → specific IPDestination only

Intermediate Components

These can be included or excluded from analysis when creating a path — useful when you want to test connectivity bypassing a specific appliance:

Intermediate ComponentInclude / Exclude Use Case
Load Balancers (ALB, NLB, CLB, GWLB)Test path through or around a load balancer
NAT GatewayVerify private subnet outbound via NAT
AWS Network FirewallExclude firewall to test underlying routing
Transit GatewayTrace cross-VPC path via TGW
Transit Gateway AttachmentVerify specific VPC attachment routing
VPC Peering ConnectionTest peering path between VPCs

Constraints to know

!

Same Region only

Source and destination must be in the same AWS Region. Cross-region paths are not supported.

!

Same VPC or connected via peering / TGW

Resources must be in the same VPC, or connected through a VPC peering connection or a Transit Gateway.

Cross-account supported

Source and destination can belong to different AWS accounts within the same AWS Organization. Requires trusted access to be enabled.

!

IPv4 only

Reachability Analyzer supports only resources with an IPv4 address. If a resource has both IPv4 and IPv6, only IPv4 is analyzed.

Transit Gateway Connect attachments not supported

Analysis stops at Connect attachments — connectivity through them cannot be verified.

Pro tip — IGW paths

Internet gateways cannot be used as an intermediate component. If your path goes through an IGW, split it into two analyses: source → IGW, then IGW → destination. This is a documented AWS limitation.

Try it yourself

Is your network really reachable?

AWS Reachability Analyzer is available in the VPC console under Network Manager. Create a path, run an analysis, and get a definitive answer in 90 seconds.

Open Reachability Analyzer →