---
name: containers-ts-sbd-vsi-vpe
title: Why can't my VSIs access VPE gateway?
description: '[Virtual Private Cloud]'
last-updated: 2026-07-27
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

[Virtual Private Cloud]{: tag-vpc}


# Why can't my VSIs access VPE gateway?
{: #ts-sbd-vsi-vpe}

[Virtual Private Cloud]{: tag-vpc}
[1.30 and later]{: tag-blue}


Review the following scenarios for why your VSI can't access your VPE gateway.
{: tsSymptoms}

- You have a VSI that is able to communicate through your registry VPE gateway until a secure by default cluster is added to the VPC, then your VSI can no longer communicate through the gateway.
- You already have a secure by default environment and when you create a new VSI, that VSI cannot communicate through the existing gateways.



If you provision a VSI in a VPC containing [secure by default clusters](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group-reference&format=markdown) several VPE gateways [are created](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group-reference&format=markdown#sbd-managed-vpe-gateways). In a secure by default environment these gateways are attached to a [security group](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group-reference&format=markdown#vpc-sg-kube-vpegw-vpc-id) that, by default, only allows inbound traffic from IBM Cloud Kubernetes Service clusters in the VPC. Any stand-alone VSI will not have access.
{: tsCauses}

Choose from one of the following options to resolve the issue.
{: tsResolve}

- **Attach your `kube-CLUSTERID` security group to your VSI**.
    - Each cluster in your VPC has a security group attached to its worker nodes. The name of this security group is `kube-CLUSTERID`.
    - This security group has already been configured to talk to your VPE gateway. - You can attach any `kube-CLUSTERID` security group to your VSI, which allows the VSI to communicate through the VPE gateway.
    - You can attach security groups to your VSIs from the VPC console.

- **Add an inbound security group rule from your VSI security group to your VPE gateway security group**.
    1. Find the security group IDs for the current VSI and the `kube-vpegw-<vpcID>` security group.
        ```sh
        ibmcloud is security-groups
        ```
        {: pre}

    1. Add the following remote rule to `kube-vpegw-<vpcID>` from your VSI's security group
        ```sh
        ibmcloud is sg-rulec KUBE-VPEGW-VPCID inbound icmp_tcp_udp --remote YOUR-VSI-SG-ID
        ```
        {: pre}

    1. Add a remote rule from your VSI security group to `kube-vpegw-<vpcID>`.
        ```sh
        ibmcloud is sg-rulec YOUR-VSI-SG outbound icmp_tcp_udp --remote  ID_OF_KUBE-VPEGW-VPCID
        ```
        {: pre}

If the issue persists, contact support. Open a [support case](https://cloud.ibm.com/docs/support?topic=support-using-avatar&format=markdown). In the case details, be sure to include any relevant log files, error messages, or command outputs.