[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Identify and fix ICMP issues\n\n| **Note:** Connectivity Tests performs a [static analysis](/network-intelligence-center/docs/connectivity-tests/concepts/overview#no-data-plane-testing) of the resource configurations in your VPC network. This analysis does not represent the actual condition of the network data plane.\n\nThis tutorial shows you how to iteratively use Connectivity Tests\nto identify and fix an issue with network connectivity.\n\nIn this case, Virtual Private Cloud (VPC) firewall rules prevent the external\nIP address of one virtual machine (VM) instance from\nusing the ICMP protocol to ping the external IP address of another VM.\n\nBecause VM-to-VM communication problems are often network connectivity issues,\nConnectivity Tests can give you information about possible\nconfiguration problems so that you can fix them. You can then run\nConnectivity Tests again to verify your fix.\n\nOverview\n--------\n\nIn this case, you have configured two VM instances in the same subnet of your\nVPC network. Both VMs have external IP addresses. When you test\nconnectivity between them by sending a ping packet from `vm1` to\nthe external IP address of `vm2`, the ping doesn't work.\n\n\n[](/static/network-intelligence-center/docs/connectivity-tests/images/tutorial-denied-ping.svg) Troubleshooting a denied ping between two VMs\n\n\u003cbr /\u003e\n\nBefore you begin\n----------------\n\nBefore you start the tutorial, follow all of the steps in\nthe `Before you begin` section of\n[Create and run Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests#before-you-begin).\n\nIt can also be helpful to review\n[how VPC firewall rules work](/vpc/docs/firewalls).\n\nConfigure network resources\n---------------------------\n\nIn this section you configure the Google Cloud resources in the testing path.\n\n### Configure a VPC network\n\nYou can use an existing network and subnet that contain the VMs, or\nyou can [create a new network and subnet](/vpc/docs/create-modify-vpc-networks).\n\n### Configure two VM instances\n\n| **Note:** This tutorial refers to the VMs that you use or create as `vm1` and `vm2`.\n\n1. The VM instances in this tutorial are located in the same VPC network and subnet. You can use existing VMs or [create\n new ones](/compute/docs/instances/create-start-instance).\n2. Assign `vm1` and `vm2` an external IP address when you create them. Note the addresses because you will use them later.\n\n### Create a firewall rule `default-deny-outgoing-ping`\n\nAfter you have created the VMs, [create an egress VPC firewall\nrule](/vpc/docs/using-firewalls) called\n`default-deny-outgoing-ping`. This rule denies the ICMP protocol from\n`vm1` to `vm2`. Make sure that there are no existing firewall rules in this\nnetwork that would override this rule. Additionally, make sure that no\nhierarchical firewall policy rules would override this rule. For details, see the\n[Hierarchical firewall policies overview](/vpc/docs/firewall-policies).\n\nUse the values in the following table to configure this\nVPC firewall rule.\n\n### Create a firewall rule `default-deny-ingress-to-vm2`\n\nCreate an ingress firewall rule called `default-deny-ingress-to-vm2` to deny the\nICMP protocol to the external IP address of `vm2`. Make sure that there are no\nexisting firewall rules in this\nnetwork that would override this rule. Additionally, make sure that no\nhierarchical firewall policy rules would override this rule. For details, see the\n[Hierarchical firewall policies overview](/vpc/docs/firewall-policies).\n\nUse the values in the following table to create the rule.\n\nRun the first trace\n-------------------\n\nUsing the Google Cloud console,\n[run a trace](/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests#testing-between-ips)\nto determine if an ICMP (ping) packet can travel from `vm1` to the external\nIP address of `vm2`. After running this trace, Connectivity Tests\ntells you that the trace packet has been dropped due to the VPC\nfirewall rule `default-deny-outgoing-ping`.\n\nUse the following table for input values for the trace.\n\nThe following Google Cloud console snapshot shows that the trace packet was\ndropped to the firewall rule `default-deny-outgoing-ping`.\n\n\n[](/static/network-intelligence-center/docs/connectivity-tests/images/tutorial-denied-outgoing-ping.png) Console UI snapshot of the trace containing the denied outgoing ping\n\n\u003cbr /\u003e\n\nRun a second trace after disabling firewall rule `default-deny-outgoing-ping`\n-----------------------------------------------------------------------------\n\n1. To allow the ping test to `vm2`, [temporarily\n disable](/vpc/docs/using-firewalls#updating_firewall_rules) the VPC firewall rule `default-deny-outgoing-ping`.\n2. After the configuration updates successfully, run the trace again.\n3. The trace fails again. The packet was dropped due to this firewall rule denying an ingress ICMP packet to the external IP address of `vm2`.\n\nThe following Google Cloud console snapshot shows that an inbound trace packet\ncan pass through Cloud NAT, but can't reach `vm2` due to the previously\nmentioned firewall rule.\n\n\n[](/static/network-intelligence-center/docs/connectivity-tests/images/tutorial-second-trace.png) Console UI snapshot of the trace failing to reach `vm2`\n\n\u003cbr /\u003e\n\nCreate the firewall rule `allow-ping-from-known-ranges`\n-------------------------------------------------------\n\nTo allow ingress to the external IP address of `vm2`, configure a new\nVPC firewall\nrule called `allow-ping-from-known-ranges`. Because allowing all ingress ICMP\npackets into your VPC network is a security risk, specify only a\nsmall set of source ranges that are allowed to send ICMP packets to the\nexternal IP address of `vm2`.\n\nFor the purposes of this tutorial, this source range includes only the external\nIP address of `vm1`, but check any existing firewall rules or rule priorities to\nmake sure that they don't override this new rule. Additionally, make sure that\nno\nhierarchical firewall policy rules would override this rule. For details, see the\n[Hierarchical firewall policies overview](/vpc/docs/firewall-policies).\n\nUse the values in the following table to configure the rule.\n\nRun a third trace\n-----------------\n\nAfter creating the `allow-ping-from-known-ranges` firewall rule, ping the\nexternal IP address of `vm2` again. The ping works and the problem is resolved.\n\n\n[](/static/network-intelligence-center/docs/connectivity-tests/images/tutorial-allowed-ping.svg) An allowed ping between two VMs\n\n\u003cbr /\u003e\n\nYou can verify this result by performing another trace against the updated\nconfiguration containing the new firewall rule. This time,\nConnectivity Tests tells you that the packet has been delivered to\n`vm2` and that the matched firewall rule, `allow-ping-from-known-ranges`, allows\nan inbound ICMP packet to the external IP address of `vm2`.\n\n\n[](/static/network-intelligence-center/docs/connectivity-tests/images/tutorial-successful-trace.png) Console UI snapshot of a successful trace to `vm2`\n\n\u003cbr /\u003e\n\nClean up\n--------\n\nIf required, you can disable or delete any of the following Google Cloud resources\nthat you created for this tutorial. Make sure that these are not production\nresources. If you decide to disable resources, check the [Compute Engine\npricing page](/compute/all-pricing) and the [All networking pricing page](/vpc/network-pricing)\nto make sure that you won't be billed for them.\n\n1. [Disable](/vpc/docs/using-firewalls#updating_firewall_rules) or [delete](/vpc/docs/using-firewalls#deleting_firewall_rules) firewall rules.\n2. [Disable](/compute/docs/instances/stop-start-instance) or [delete](/compute/docs/instances/deleting-instance) VMs.\n3. [Delete](/vpc/docs/create-modify-vpc-networks#deleting_subnets) VPC subnets.\n4. [Delete](/vpc/docs/create-modify-vpc-networks#deleting_a_network) the VPC network.\n\nWhat's next\n-----------\n\n- [Learn about Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/concepts/overview)\n- [Update or delete Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/how-to/managing-connectivity-tests)\n- [Troubleshoot Connectivity Tests issues](/network-intelligence-center/docs/connectivity-tests/support/troubleshooting)"]]
