# Test Connectivity to Confluent Cloud Test connectivity to Confluent Cloud with `netcat`, `openssl`, or `telnet` to verify reachability to the Kafka cluster and the Kafka REST endpoint before whitelisting those endpoints. Kafka broker hosts in Confluent Cloud don’t respond to `ping`. Note that you need to whitelist both endpoints (ports `9092` and `443`) on your firewall for the Confluent CLI. And you need to whitelist the endpoint on port `443` to ensure that the Terraform Provider for Confluent and the Kafka REST API to work properly. ## Confluent Cloud bootstrap server and REST endpoint ports Confluent Cloud Kafka clusters use port `9092` for the bootstrap server, typically over SASL_SSL, and port `443` for the Kafka REST endpoint. The bootstrap server and REST endpoint use the same host address and differ only by port. | Endpoint | Port | Protocol | |------------------------|--------|--------------------| | Kafka bootstrap server | `9092` | SASL_SSL (or mTLS) | | Kafka REST endpoint | `443` | HTTPS | Run through the following steps to validate Confluent Cloud connectivity is working correctly. 1. Test connectivity to the Confluent Cloud cluster bootstrap endpoint: * [For public endpoints, VPC peering, VNet peering, and AWS Transit Gateway](#test-tcp-connectivity) * [For AWS PrivateLink, Azure Private Link, and Google Cloud Private Service Connect](#private-link-validate) 2. If connectivity can be successfully established, test data plane operations by producing/consuming using: * [Confluent CLI](#validate-connectivity-using-cli) * [Other tools](#validate-connectivity-using-other-clients) ## Test public, peering, and Transit Gateway connectivity to Confluent Cloud For public networking, VPC peering, VNet peering, and AWS Transit Gateway, test connectivity to the Confluent Cloud cluster using one of the tools, openSSL, Netcat, or Telnet. For public endpoint clusters, run the command from any computer that has internet access. For the cluster in private network environments, such as VPC peering, VNet peering, and AWS Transit Gateway, run the tests from within your VPC or VNet that is connected to the Confluent Cloud cluster. Note that the host addresses of the Kafka bootstrap server and the REST endpoint are the same, and only the port numbers differ: * Use port `9092` to test the connection to the Kafka bootstrap server. * Use port `443` to test the connection to the Kafka REST endpoint. To only test TCP connectivity, use Telnet and Netcat (or its successor Socat): * **Netcat** ```bash nc -zv 9092 nc -zv 443 ``` * **Telnet** ```text telnet 9092 telnet 443 ``` In addition to TCP connectivity, to also test TLS handshake and the certificate, use openSSL. With openSSL, you can send an SNI header: * **openSSL** ```bash openssl s_client -servername -connect :9092 openssl s_client -servername -connect :443 ``` For details, see the OpenSSL documentation for the [-connect option](https://www.openssl.org/docs/man3.0/man1/openssl-s_client.html#connect-host:port). It is recommended that you use OpenSSL to test TCP and TLS because with the TCP testing only, it is difficult to make the distinction among the various causes when a connection fails, such as: * Timeout because of routing problems * Established connection, but you, as the client, are not initiating the TLS handshake * Confluent Cloud proxy disconnecting your connection because you do not send the SNI header For the TLS SNI extension requirement in Kafka clients, see [TLS SNI extension requirement](../client-apps/client-configs.md#client-tls-sni-requirement). ### Troubleshoot connectivity issues If connectivity to the bootstrap endpoint cannot be established, check your firewalls and other security configurations and restrictions that could prevent the connection to the Confluent Cloud cluster bootstrap endpoint. ## Test private link connectivity to Confluent Cloud From an instance within your VPC or VNet, or anywhere the DNS is set up, run through the following steps to validate Kafka connectivity through PrivateLink, Private Link, or Private Service Connect is working correctly. 1. Set an environment variable with the cluster bootstrap URL. ```bash export BOOTSTRAP=$ ``` The Bootstrap URL displayed in Confluent Cloud Console includes the port (`9092`). The `BOOTSTRAP` value should include the full hostname, but do not include the port. This is so that you can run the `openssl s_client -connect :` command with the required values. For example: ```bash # Public DNS resolution for AWS export BOOTSTRAP=lkc-abcdef-12345.us-west-2.aws.glb.confluent.cloud # Public DNS resolution for Azure export BOOTSTRAP=lkc-ghidef-67890.centralus.azure.glb.confluent.cloud # Public DNS resolution for GCP export BOOTSTRAP=lkc-xxxxxx-xxxxxx.asia-southeast1.gcp.glb.confluent.cloud # Private DNS resolution export BOOTSTRAP=lkc-abcdef.xxxxxxxxx.us-west-2.aws.confluent.cloud ``` 2. Test connectivity to your cluster by running the `openssl s_client -connect :` command, specifying the `$BOOTSTRAP` environment variable for the `` value. To run the `openssl s_client -connect` command, the `-connect` option requires that you specify the host and the port number. For details, see the [openssl s_client](https://www.openssl.org/docs/man3.0/man1/openssl-s_client.html#connect-host:port) documentation. Test the connection to the Kafka bootstrap server using the port, `9092`: ```bash openssl s_client -connect $BOOTSTRAP:9092 -servername $BOOTSTRAP -verify_hostname $BOOTSTRAP /dev/null | grep -E 'Verify return code|BEGIN CERTIFICATE' | xargs ``` 3. If the return output is `-----BEGIN CERTIFICATE----- Verify return code: 0 (ok)`, connectivity to the bootstrap is confirmed. 4. Test the connection to the Kafka REST endpoint using the port `443`: ```bash openssl s_client -connect $BOOTSTRAP:443 -servername $BOOTSTRAP -verify_hostname $BOOTSTRAP /dev/null | grep -E 'Verify return code|BEGIN CERTIFICATE' | xargs ``` 5. If the return output is `-----BEGIN CERTIFICATE----- Verify return code: 0 (ok)`, connectivity to the bootstrap is confirmed. ### Troubleshoot private link connectivity issues If connectivity to the bootstrap endpoint cannot be established, check the following: * Your security group has inbound/outbound rules for ports 443 and 9092 from your desired source (your VPC CIDR). The Protocol should be TCP for all the rules. * You created a Private DNS zone with the correct Confluent Cloud DNS Domain Name. The Domain Name can be found in the Confluent Cloud Console, under the Network page. * Check your firewalls and other security configurations and restrictions that could prevent the connection to the Confluent Cloud cluster bootstrap endpoint. * If your VPC is not configured to use the standard DNS resolver of the cloud provider, the instance won’t be able to resolve the private DNS zone. As a test, run `dig` with the resolver to use. For example: ```bash dig @ ``` If resolution fails, re-configure the VPC to resolve using the standard DNS server. The cloud provider’s standard resolvers are: * For AWS: `169.254.169.253` * For Azure: `168.63.129.16` * For Google Cloud: `169.254.169.254` If you still have issues with private link connectivity after addressing the above items, run the debug connectivity script (`debug-connectivity.sh`) for your provider in [Confluent Cloud Networking repo](https://github.com/confluentinc/ccloud-connectivity/blob/master/privatelink/) and provide the output to Confluent Support for assistance with your private link connectivity setup. ## Test connectivity to Kafka using Confluent CLI After connectivity is successfully established, test data plane operations by producing/consuming using the [Confluent CLI](https://docs.confluent.io/ccloud-cli/current/index.html). If using private networking, run the steps from an instance within the VPC or VNet to validate Kafka connectivity works correctly. 1. Sign in to Confluent CLI with your Confluent Cloud credentials. ```text confluent login ``` 2. List the clusters in your organization. ```text confluent kafka cluster list ``` 3. Select the cluster you wish to test. ```text confluent kafka cluster use ... ``` For example: ```text confluent kafka cluster use lkc-abcdef ``` 4. Get the endpoint to test with when using a cluster with PNI. If you are using a cluster with PNI, you need to use the PNI endpoint to test connectivity. 1. List the endpoints in your cluster. For example: ```text confluent kafka cluster endpoint list --cluster lkc-123456 ``` In the output, PNI endpoints will have the `Connection Type` of `PRIVATE_NETWORK_INTERFACE`. 2. Select the endpoint you retrieved in the previous step to test. For example: ```text confluent kafka cluster endpoint use ":443" ``` 5. Create a cluster API key to authenticate with the cluster. ```text confluent api-key create --resource ... --description ... ``` For example: ```text confluent api-key create --resource lkc-abcdef --description "connectivity test" ``` 6. Select the API key you just created. ```text confluent api-key use ... --resource ... ``` For example: ```text confluent api-key use WQDMCIQWLJDGYR5Q --resource lkc-abcdef ``` 7. Create a test topic. ```text confluent kafka topic create test ``` 8. Start consuming events from the test topic. ```text confluent kafka topic consume test ``` 9. Open another terminal tab or window. 10. Start a producer. ```text confluent kafka topic produce test ``` 11. Type anything into the produce tab and hit `Enter`; press `Ctrl+D` or `Ctrl+C` to stop the producer. 12. The tab running consume will print what was typed in the tab running produce. ### Troubleshoot connectivity to Kafka brokers #### Failed connection to Kafka brokers in private link cluster **Issue**: You get an error message similar to the following from a data plane operation over a private link, such as produce or consume. ```text |FAIL|Confluent-CLI_v3.8.0#producer-1| [thrd:sasl_ssl://e-000d.europe-west2-b.dom8w9ed2pn.europe-west2.gcp.c]: sasl_ssl://e-000d.europe-west2-b.dom8w9ed2pn.europe-west2.gcp.confluent.cloud:9092/2: SSL handshake failed: Disconnected: connecting to a PLAINTEXT broker listener? (after 0ms in state SSL_HANDSHAKE) ``` **Possible causes**: * The private endpoint in use does not correspond to the correct availability zone. * Zonal affinity between your VPC and Confluent Cloud is not respected. See [Provision PrivateLink endpoints in AWS](private-links/aws-privatelink.md#aws-privatelink-create-connection). * The private DNS zone is not configured correctly. See [Create a DNS zone and DNS records](private-links/aws-privatelink.md#aws-create-dns-records). If you need to review your private link connectivity configurations, see: * [Configure connectivity to Confluent Cloud using AWS PrivateLinks](https://docs.confluent.io/cloud/current/networking/private-links/aws-privatelink.html). * [Configure connectivity to Confluent Cloud using Azure Private Links](https://docs.confluent.io/cloud/current/networking/private-links/azure-privatelink.html). * [Configure connectivity to Confluent Cloud using Google Cloud Private Service Connects](https://docs.confluent.io/cloud/current/networking/private-links/gcp-private-service-connect.html). ## Test connectivity to Kafka using other tools After connectivity is successfully established, you can use the other clients and tools to test producing/consuming messages when Confluent CLI is not a viable option. Examples are `kafka-topics`, `kafka-console-consumer`, native command line tools, or Java and other clients. The following are a few of the test workflows you can use as references. Note that some articles require you to log into the Confluent Support portal. * For using Java to test connectivity, see [Simple Java client examples](https://docs.confluent.io/kafka-clients/java/current/overview.html) or [Getting Started with Apache Kafka and Java tutorial](https://developer.confluent.io/get-started/java/?_ga=2.117907402.2116725079.1689551961-999553901.1668659855&_gac=1.82590436.1689131071.CjwKCAjw-7OlBhB8EiwAnoOEk42Mc6Q35Hf3eQZytyTt8mlbDxQwddX2bOtm10X7TJVcQz7XiMuQTRoC8PkQAvD_BwE&_gl=1*xtf056*_ga*OTk5NTUzOTAxLjE2Njg2NTk4NTU.*_ga_D2D3EGKSGD*MTY4OTgxMjY5My42NS4xLjE2ODk4MTI3MTcuMzYuMC4w). * For using the console consumer tools to test connectivity, see [How to produce and consume messages using the console tools](https://support.confluent.io/hc/en-us/articles/360044952772-How-to-produce-and-consume-avro-messages-via-console-tools-with-Confluent-Cloud). * For using the kafka-broker-api-versions utility to test connectivity, see [How to list all the available brokers for your Confluent Cloud cluster](https://support.confluent.io/hc/en-us/articles/33763395098004-How-to-list-all-the-available-brokers-for-your-Confluent-Cloud-cluster). The tool carries out exhaustive tests as it not only connects to the bootstrap endpoint, but also connects and authenticates against each broker.