Scenario: Troubleshooting a Communication Path Through a Transit Gateway

// Systematic hop-by-hop checklist
package com.bank.troubleshooting;

import java.util.List;

public class TgwTroubleshootingChecklist {
    public static final List<String> FORWARD_HOPS = List.of(
        "1. Source VPC subnet route table -> route to dest CIDR via TGW",
        "2. Source TGW attachment -> exists, state=available",
        "3. Source attachment -> associated with which TGW route table?",
        "4. TGW route table -> has route to dest CIDR (propagated or static)?",
        "5. Dest security group -> allows inbound from source?",
        "6. Dest NACL -> allows inbound AND outbound (stateless!)",
        "7. Source NACL -> allows outbound AND inbound (stateless!)"
    );

    public static final List<String> RETURN_HOPS = List.of(
        "8. Dest VPC subnet route table -> route BACK to source CIDR via TGW",
        "9. Dest TGW attachment -> exists, state=available",
        "10. Dest attachment -> associated TGW route table has source CIDR?"
    );

    public static void main(String[] args) {
        System.out.println("=== FORWARD PATH ===");
        FORWARD_HOPS.forEach(System.out::println);
        System.out.println();
        System.out.println("=== RETURN PATH (most commonly missed!) ===");
        RETURN_HOPS.forEach(System.out::println);
    }
}

# Source VPC subnet route table
Destination       Target
10.0.0.0/16       local           (VPC internal)
10.3.0.0/16       tgw-0hub        (dest VPC via Transit Gateway)
172.16.0.0/16     tgw-0hub        (on-prem via Transit Gateway)

// Checking route table programmatically
package com.bank.troubleshooting;

public class RouteTableCheck {
    public static boolean hasRouteToDestination(String destCidr, String expectedTarget) {
        // In reality: call ec2.describeRouteTables() and search routes
        System.out.println("Checking: route to " + destCidr + " via " + expectedTarget);
        return true; // placeholder
    }
}

// Checking TGW attachment and route table association
package com.bank.troubleshooting;

public class TgwAttachmentCheck {
    public static void verify(String attachmentId) {
        System.out.println("Attachment: " + attachmentId);
        System.out.println("  State: available (OK) or pending/failing (PROBLEM)");
        System.out.println("  Associated TGW route table: tgw-rtb-prod");
        System.out.println("  Routes in tgw-rtb-prod:");
        System.out.println("    10.3.0.0/16 -> attach-shared (propagated)");
        System.out.println("    172.16.0.0/16 -> attach-onprem (propagated)");
        System.out.println("  Missing route? That destination is UNREACHABLE.");
    }
}

# Both directions MUST have routes

Forward:
  Source VPC RT:      10.3.0.0/16 -> tgw-0hub
  Source TGW table:   has 10.3.0.0/16 propagated

Return:
  Dest VPC RT:        10.1.0.0/16 -> tgw-0hub      <-- RETURN ROUTE
  Dest TGW table:     has 10.1.0.0/16 propagated    <-- RETURN ROUTE

// The classic mistake: checking only the source side
package com.bank.troubleshooting;

public class ReturnPathMistake {
    public static void main(String[] args) {
        System.out.println("Classic mistake: engineer only checks source route table.");
        System.out.println("Forward path is fine -- request arrives at destination.");
        System.out.println("But destination has NO return route to source CIDR.");
        System.out.println("Reply is DROPPED. TCP handshake fails.");
        System.out.println("Looks like total failure, not half-working.");
        System.out.println();
        System.out.println("Fix: add return route in dest VPC RT and dest TGW table.");
    }
}

// NACL stateless behavior
package com.bank.troubleshooting;

public class NaclStatelessExplainer {
    public static void main(String[] args) {
        System.out.println("Security Group: STATEFUL");
        System.out.println("  Allow inbound -> return traffic automatically allowed");
        System.out.println();
        System.out.println("NACL: STATELESS");
        System.out.println("  Allow inbound -> return traffic NOT automatically allowed");
        System.out.println("  Must explicitly allow BOTH inbound and outbound");
        System.out.println("  On BOTH source and destination subnets");
    }
}

// Using diagnostic tools
package com.bank.troubleshooting;

public class DiagnosticTools {
    public static void main(String[] args) {
        System.out.println("VPC Reachability Analyzer:");
        System.out.println("  Input: source ENI, destination ENI");
        System.out.println("  Output: reachable or not, and WHERE the packet drops");
        System.out.println();
        System.out.println("TGW Network Manager Route Analyzer:");
        System.out.println("  Input: source attachment/CIDR, dest attachment/CIDR");
        System.out.println("  Output: whether a route path exists in TGW tables");
    }
}

// Real troubleshooting scenario
package com.bank.troubleshooting;

public class RealScenario {
    public static void main(String[] args) {
        System.out.println("Problem: Settlement VPC cannot reach Shared-Services VPC");
        System.out.println();
        System.out.println("Step 1: Settlement RT has 10.3.0.0/16 -> tgw-0hub  OK");
        System.out.println("Step 2: Settlement attachment available              OK");
        System.out.println("Step 3: TGW table has 10.3.0.0/16 propagated        OK");
        System.out.println("Step 4: Shared-Services SG allows inbound            OK");
        System.out.println();
        System.out.println("Step 5: Shared-Services RT has route to 10.1.0.0/16? MISSING!");
        System.out.println("  -> Reply has no return path. TCP handshake fails.");
        System.out.println();
        System.out.println("Fix: Add 10.1.0.0/16 -> tgw-0hub to Shared-Services RT");
        System.out.println("Result: Connection works immediately.");
    }
}