HCX Manager unreachable after deployment in Amazon EVS environment
Article ID: 402215
Updated On:
Products
Issue/Introduction
After deploying HCX Manager in Amazon Elastic VMware Service (EVS), the HCX Manager appears to be down or unreachable when attempting to connect from virtual machines located in a different subnet on a separate VPC. While the HCX deployment completes successfully, VMs in other VPCs cannot establish connectivity to the HCX Manager, making it appear as though the service is offline.
Symptoms:
- HCX Manager is unreachable from VMs in different subnets/VPCs
- Cannot access HCX Manager web console from another VPC
- HCX Manager appears offline when accessed from a separate VPC
- Ping tests to HCX Manager fail from VMs in different VPCs
- Network connectivity times out when crossing VPC boundaries
- HCX Manager works within its own VPC but not from external VPCs
Environment
- Amazon Elastic VMware Service (EVS)
- VMware HCX Manager
- VMware vCenter Server
- AWS VPC environment
Cause
The HCX Manager is running correctly but cannot be reached due to network isolation between VPCs in Amazon EVS. As documented in Getting started with Amazon Elastic VMware Service, Amazon EVS does not support connectivity via an AWS Direct Connect private virtual interface (VIF) or via an AWS Site-to-Site VPN connection that terminates directly into the underlay VPC. Management VMs (jumpbox) and HCX Manager residing in separate VPCs cannot communicate without additional AWS networking configuration using Transit Gateway.
Resolution
To restore connectivity to the HCX Manager when management VMs are in a different VPC:
- Deploy AWS Transit Gateway (Required)
- Access the AWS EVS portal
- Navigate to VPC configuration
- Create a Transit Gateway - this is mandatory for cross-VPC communication
- Attach the HCX Manager's VPC to the Transit Gateway
- Attach the VPC containing management VMs/jumpbox to the Transit Gateway
- Configure Transit Gateway route tables
- AWS will create route tables for the Transit Gateway
- Verify routes are properly configured between attached VPCs
- Ensure security groups allow required ports for HCX communication
- Verify HCX Manager connectivity
- Test connectivity from management VMs to HCX Manager
- Access the HCX Manager web console
- Confirm HCX services are accessible
- Proceed with HCX configuration
- Complete HCX setup and configuration
- Configure workload migration paths using the Transit Gateway connection as described in Migrate workloads to Amazon EVS using VMware Hybrid Cloud Extension (VMware HCX)
Important Note: Transit Gateway is currently the only supported method for enabling communication between VPCs in Amazon EVS. Direct VPC peering or routing without Transit Gateway is not supported. As Amazon EVS is in public preview, this requirement may change when the service reaches general availability (GA).
Alternative deployment option:
- Deploy all management components (jumpbox, HCX Manager) within the same VPC to avoid the Transit Gateway requirement
Feedback
