0

I'm settings up google cloud for my works. I have issue related to service account and vpc network. The detail is: 2 GCE instances are created by 2 service accounts on different subnet in same VPC, but they cannot talk each other.

Context:

  • GCE instance with name test01 and test03 are created by one service account but different subnet (sub1/sub2)
  • GCE instance test02 is created by another service account in subnet sub1
  • Firewall allow ping for all targets from all source

Result

  • test01 and test02 can ping each other. Same subnet, different service account
  • test01 and test03 can ping each other. Different subnet, same service account
  • test02 and test03 cannot ping each other. Different subnet, different service account
0

I might start checking if the Services Accounts has the same roles and privileges among the projects.

Also please check if the Network Tags attached to the VM instances are correct (syntax) and the corresponding Firewall rules for ingress/egress are allowing the icmp traffic.

You can check Firewall rules in GCP: Source and Target filtering by Service Account and Filtering by service account vs. network tag for more details. Please note you cannot mix and match service accounts and network tags in any firewall rule.

I recommend you to review the Use Cases for Ingress and Egress described here.

Additionally, in this document are described common scenarios where Multiple Network Interfaces are used. It might help you to build a Networking and virtual appliances by different Nic devices, Shared VPC and so on.

2
  • Thank for your answer. I already mentioned Firewall allow ping for all targets from all source. So firewall is not problem in my case. Furthermore, when apply firewall rule I already can see 3 GCE instances that follow a rule. – Zero May 3 '19 at 3:12
  • 1. For the test02 and test03, on the "Network details", double check each Egress and Ingress firewall rules and Routes configuration. 2. Compare the configuration amoun the 3 VMs. – user10880591 May 6 '19 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.