Troubleshoot task connection failures

Overview

When you configure a data migration task, you can test the database connection. This topic covers common causes of connection test failures by instance type and their solutions.

Details

A connectivity precheck may fail for the following reasons:

Diagnosis item	Possible cause	Solution
JDBC	The database account, password, IP address, or port is incorrect. The database account permissions restrict connections from the source IP address.	Verify and correct the database connection information. Allow connections from all source IP addresses.
Ping	Network connectivity to the database instance is blocked. The database IP address is incorrect.	Check your network connectivity. Verify and correct the database IP address.
Telnet	Access to the database instance is restricted. The database port is incorrect.	Allow access from the DTS server CIDR blocks in your database instance's firewall settings or IP whitelist. Verify and correct the database port.

If the DTS connection test fails, first verify that the database is active and the connection details are correct by connecting with a database client. If confirmed, use the following methods to resolve the issue:

Self-hosted databases with a public IP

Select the solution that matches your test result.

Test result 1

Symptom

During the connection test, the ping test, telnet test, and JDBC connection all fail.

Cause

Access to the database is restricted at the source, for example, by iptables rules on the database server.

Solution

1. Log on to the database server and run iptables -L to check for rules. If rules exist, add the CIDR blocks of DTS servers for your destination region to allow access from DTS.

2. If your network has a hardware firewall, ensure it is not blocking the connection.

3. If the preceding checks find no issues, verify that your route settings are correct.

Test result 2

Symptom

During the connection test, the ping test succeeds, but the telnet test and JDBC connection fail.

Cause

Access to the database port is restricted at the source, for example, by iptables or ACL rules.

Solution

1. Add the CIDR blocks of DTS servers for your destination region to your iptables or ACL to allow DTS access.

2. If your network has a hardware firewall, ensure it is not blocking the connection.

3. If the preceding checks find no issues, verify that your route settings are correct.

Test result 3

Symptom

During the connection test, the ping and telnet tests succeed, but the JDBC connection fails.

Cause

• The database account, password, IP address, or port is incorrect.

• The database account permissions restrict connections from the source IP address.

• For a self-hosted database on an ECS instance, a route for the 11.0.0.0/8 CIDR block is not added automatically and must use the same gateway as the 10.0.0.0/8 CIDR block.

Solution

• Verify and correct the database connection information.

• Allow connections from all source IP addresses.

• Run the route -n command to view gateway information. Run the sudo route add -net 11.0.0.0/8 gw <gateway_for_10.0.0.0/8_CIDR_block> command to add the route.

Test result 4

Symptom

During the connection test, the ping test fails, the telnet test succeeds, but the JDBC connection fails.

Cause

Ping requests to the ECS instance may be blocked, and the database account credentials are incorrect.

Solution

1. Allow ping requests to the ECS instance. For example, check the value of the /proc/sys/net/ipv4/icmp_echo_ignore_all parameter. A value of 1 indicates that ping requests are ignored.

2. See Test result 3 to verify that the password and authorized IP addresses are correct.

Self-hosted databases on ECS instances

Select the solution that matches your test result.

Test result 1

Symptom

During the connection test, the ping test, telnet test, and JDBC connection all fail.

Cause

DTS cannot access the ECS instance.

Solution

1. Source access to the ECS instance may be restricted by iptables rules. Log on to the ECS instance and run the following command. If rules are returned, add the CIDR blocks of DTS servers for your destination region to allow access from DTS.

   iptables -L

2. Log on to the ECS console and check if the security group rules block the CIDR blocks of DTS.

Test result 2

Symptom

During the connection test, the ping test succeeds, but the telnet test and JDBC connection fail.

Cause

The ECS security group may restrict access to the database port.

Solution

Find the CIDR blocks of DTS servers for your destination region. Log on to the ECS console and verify that the security group rules allow the DTS CIDR blocks.

Test result 3

Symptom

During the connection test, the ping and telnet tests succeed, but the JDBC connection fails.

Cause

• The database account, password, IP address, or port is incorrect.

• The database account permissions restrict connections from the source IP address.

Solution

• Verify and correct the database connection information.

• Allow connections from all source IP addresses.

Test result 4

Symptom

During the connection test, the ping test fails, the telnet test succeeds, but the JDBC connection fails.

Cause

Ping requests to the ECS instance may be blocked, and the database account credentials are incorrect.

Solution

1. Allow ping requests to the ECS instance. For example, check the value of the /proc/sys/net/ipv4/icmp_echo_ignore_all parameter. A value of 1 indicates that ping requests are ignored.

2. See Test result 3 to verify that the password and authorized IP addresses are correct.

On-premises databases connected through Express Connect

Express Connect requires static routes on your on-premises IDC device and in the virtual border router route table. Verify your route configuration against the Express Connect User Guide.

Cloud instances

The database account or password may be incorrect. Verify and correct the credentials.