​
Overview

Fabric shows your infrastructure on a world map and manages private connections between your VPCs. A connection is a managed site-to-site VPN link riding the VPN gateway each zone received when it was deployed, so connected VPCs reach each other over private addresses without touching the public internet.
Navigation: Networking → Fabric. Titled Fabric, subtitled “Explore regions and sites, then choose where to deploy and manage your private network.”

​
The constraint that shapes everything

Connections are only possible between VPCs in different availability zones of the same region.Not cross-region, despite the map showing your whole global footprint. Not within a single zone. The console blocks ineligible pairs with specific messages, and the platform enforces it independently — so this isn’t a UI limitation you can work around through the API.The refusals you’ll see:

​
What the map shows

The map renders every region and zone the platform offers, not only the ones you use — regions you haven’t activated appear muted. City markers represent zones, co-located zones cluster into one marker that expands, and your VPCs anchor to their zones. Connection lines overlay the map for every active link. Clicking a city opens a zone panel.
Seeing a region on the map does not mean you can deploy there. It has to be activated for your account first, and the panel offers that when eligible — see Regions and zones.

​
Connection states

A connection creates two coordinated VPN sides, which is why there’s an intermediate state where one end is ready. A link isn’t usable until it reaches Completed.

​
Connections are not transitive

Connecting A↔B and B↔C does not connect A↔C. Each link joins exactly two VPCs, and traffic does not route through an intermediate VPC.For three VPCs to all reach each other you need three links: A↔B, A↔C, B↔C. Plan for that when sizing — the link count grows quadratically, and the console warns when a single VPC accumulates several direct links.

​
Creating a connection

1

Check the button before anything else

The connection button tells you whether you’re ready, and why not if you aren’t:
2

Pick the two endpoints

“Choose two VPCs in different Zones. The Region stays fixed throughout this flow.” Both dropdowns filter to eligible counterparts, so most ineligible pairs are simply unselectable.
3

Check the CIDR warning

Overlapping ranges are refused: “These VPCs have overlapping CIDRs ( / ). A VPN can’t route between overlapping networks — pick VPCs with distinct CIDRs.”
4

Create it

Create connection. Provisioning is asynchronous — the link moves through pending, then one side ready, then completed.
Overlapping CIDRs are the most common blocker, and the hardest to fix. A VPC’s address range can’t be changed after creation, so two VPCs both on 10.0.0.0/16 can never be connected — one has to be rebuilt.Plan distinct ranges per zone before you create the VPCs. See VPC.

​
Managing connections

The sidebar has Fabric insights and Direct connections. A failed link can be retried; an unwanted one disconnected.
Fabric manages these links itself. The VPC’s own VPN tab still has manual customer gateway controls, and the two are separate — don’t manage a Fabric link by hand from there. The panel says as much: “Fabric manages these site-to-site VPN links. Manual customer gateway controls remain available from the VPC VPN tab.”

​
Availability

Fabric depends on a platform capability, and the screen tells you when it isn’t available:
Fabric requires Personal context — it does not work while you’re switched into a tenant: “Phase-one Fabric supports Personal context and USER-owned VPC links only. Switch to Personal context to manage connections.”If the screen says this, change context via the switcher rather than looking for a permission to grant.

​
Features not yet released

Fabric ships as the map plus VPC-to-VPC connections. Four capabilities are built but withheld:
These are deliberate holds rather than unfinished work. The reasoning recorded in the code: proximity is premature while accounts live in one region, and a search that filters the map “hides the footprint it exists to show”. Without the lens, its layers stay switched on — so the map looks the same, minus the toggle panel.

​
Worked example: connect two zones for a replica

A primary database in Zone A and a replica in Zone B, replicating over private addresses.
1

Plan distinct CIDRs first

Zone A’s VPC on 10.0.0.0/16, Zone B’s on 10.1.0.0/16. Do this before creating either VPC — overlap here is unrecoverable.
2

Confirm both zones are available

The connection button reports zone readiness. Two Zones required means you can’t proceed yet.
3

Create the connection

Connect VPCs → select the Zone A VPC and the Zone B VPC → Create connection.
4

Wait for Completed

Side A ready means half-built. Don’t configure replication until it’s Completed.
5

Allow the traffic in both firewall policies

The link provides the path; it doesn’t allow traffic. On the primary’s policy, ingress from 10.1.0.0/16 on the database port; on the replica’s, ingress from 10.0.0.0/16. Plus egress rules on both — the policies are stateless. See Firewall Policies.
6

Verify over private addresses

Connect from the replica to the primary’s private address. If it works, replication traffic never touches the internet.
A Completed connection alone proves nothing about reachability. Firewall policies on both sides still have to allow the traffic, in both directions. A working link with a missing egress rule looks exactly like a broken link.

​
Empty and error states

VPC

Plan CIDRs before you need to connect them.

Regions and zones

Activation, and what each zone receives.

Firewall Policies

A link is a path, not permission.

Site-to-Site VPN

Connecting to networks outside Simnet.