Why is the traffic not reaching my VNF appliance with a public address range?

When you're using Public Address Ranges for VPC, traffic might fail to flow as expected due to issues in either the control path or the data path. These issues can manifest during the attachment of the public address range or during runtime routing of traffic to/from the VNF appliance.

You might notice that traffic that is intended for a VNF appliance does not reach its destination or response traffic is dropped. The problem typically presents in two ways:

  • If it's a control path issue, the lifecycle state is not stable, often showing Failed, Pending, or Updating status.
  • If it's a data path issue, the lifecycle state of the range is stable and appears correctly attached, but traffic is not routed or forwarded as expected.

Routing issues with a range can arise from improper lifecycle management (attach failure or misconfiguration) or misconfigured routing rules or next-hop appliances, even when the public address range appears successful.

Follow these steps to troubleshoot this issue:

  1. Verify the public address range lifecycle state:

    1. Check whether the public address range is in a stable state by using the IBM Cloud console or CLI.
    2. If not in a stable state, it's a control path issue. Retry the attach process or check for configuration or IAM permission errors.

  2. Validate the routing configuration:

    1. If the public address range is stable, make sure that the route table correctly maps the public address range to the VNF appliance as the next hop.
    2. Confirm that public ingress routing is set up properly and that the VNF is reachable.

  3. Verify that the VNF appliance is correctly processing traffic, preserving source IP addresses on egress, and that firewall/security rules allow the traffic.

  4. If this issue persists, gather logs and routing details and contact IBM Cloud support.