Network troubleshooting - Unable to Ping server (Hint - icmp).

In Oracle Cloud Infrastructure (OCI), if we are unable to ping a server, the root cause is almost always related to ICMP traffic being blocked. Ping relies on ICMP Echo Request/Reply, and by default OCI blocks ICMP unless we explicitly allow it in our Security Lists or Network Security Groups (NSGs).

In this lab we create own security list and troubleshoot the main issue of ping by using icmp protocol

Steps to create security list

1. GO TO Networking and click on virtual Cloud network

2. Click on HUB_NETWORK

3. click on security and after click on create security list

4. Now we give the same of our security list hub_publicsubnet_SL.

In this security list we give specific namespace name to our public subnet to identify by "SL" mean security list for public subnet. create the security list without adding any ingress rules or egress rules.

5. Now we add new security list to our public subnet network and remove the default security list. before removing old list we can first add new security list and after it we can remove the old security list.

we can add new security list by clicking on "add security list"

Now we remove Default security list

6. Now we try to login in our putty application but we can't login due an error come over the login the screen as "Network Error : Connection time out" because here ingree ssh rule not available to communication.

7. In this step we add Ingress rules in security list

Here we can add a customize Source CIDR as our individual Public IP address and select IP Protocol as TCP for communication and Destination Port Range 22 to connection.

8. After Adding ingress rules in security list we can again try to login into the putty application. This time we can successfully login into out server without facing any issue. due to we added ingress rules in our security list.

9. Now we try to ping google.com and we see we are not able to ping google because we have only allow incoming traffic in our server. we have not give permission to outgoing traffic. so to add this we need to add egress rules in our security list.

To add Egress rules in security list go to security list and click on add egress rules.

Added the Destination CIDR as "0.0.0.0/0" and IP Protocol as "ICMP" to allow all the port to ping.

10. Now we again ping the google.com and this time its ping properly but here some connectivity packet loss found due to security list missing here.

Now we again try to ping google.com and in this time its response properly and here no packet loss showing.

server to server ping

Here we try to ping Bastion_server with Bastion_test_server but we are not able to ping.

We add here ingress and egress rule in our security list for ping.

First we add ingress rule and here we add our source ip from bastion_server private ip 10.0.0.70/32 and select ip protocol as ICMP for ping.

Now we add egress rules and here we add our destination ip from bastion_test_server private ip 10.0.0.54/32 and select ip protocol as ICMP for ping.

Now we try again to ping and this time we are successfully ping the bastion_server with bastion_test_server.