What causes INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG?

A security group or network security group does not allow inbound traffic from the Databricks control plane to cluster nodes. The cluster subnet routing table does not have a route back to the Databricks control plane or VPC endpoint. An asymmetric routing configuration where requests can reach the instance but responses cannot return. A misconfigured network appliance (firewall, NAT) between the cluster and the Databricks control plane. A VPC peering or Private Link misconfiguration that allows the VM to launch but blocks Databricks communication

How do I fix INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG?

Verify that inbound security group rules allow traffic from the Databricks control plane CIDR ranges. Check routing tables in the cluster subnet for correct routes back to the Databricks VPC endpoint or internet gateway. Test bidirectional connectivity — the cluster VM must be able to both reach out to and receive connections from the control plane. Check for any asymmetric routing: ensure all traffic in and out of the subnet uses the same path. Review recent VPC/VNet or security group changes and roll back if the change correlates with this error appearing

High severitycluster

Power BI Refresh Error:
INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG

What does this error mean?

Databricks cannot reach the cluster instance after it was launched. The VM started but the Databricks control plane cannot communicate with it, and the root cause is a network or infrastructure misconfiguration.

Common causes

1A security group or network security group does not allow inbound traffic from the Databricks control plane to cluster nodes
2The cluster subnet routing table does not have a route back to the Databricks control plane or VPC endpoint
3An asymmetric routing configuration where requests can reach the instance but responses cannot return
4A misconfigured network appliance (firewall, NAT) between the cluster and the Databricks control plane
5A VPC peering or Private Link misconfiguration that allows the VM to launch but blocks Databricks communication

How to fix it

1Verify that inbound security group rules allow traffic from the Databricks control plane CIDR ranges
2Check routing tables in the cluster subnet for correct routes back to the Databricks VPC endpoint or internet gateway
3Test bidirectional connectivity — the cluster VM must be able to both reach out to and receive connections from the control plane
4Check for any asymmetric routing: ensure all traffic in and out of the subnet uses the same path
5Review recent VPC/VNet or security group changes and roll back if the change correlates with this error appearing

Frequently asked questions

What is the difference between this and NETWORK_CHECK_CONTROL_PLANE_FAILURE?

NETWORK_CHECK_CONTROL_PLANE_FAILURE means the cluster cannot reach the control plane (outbound blocked). INSTANCE_UNREACHABLE_DUE_TO_MISCONFIG means the control plane cannot reach the cluster instance (inbound blocked).

Does this error affect the cluster data plane?

Potentially yes — if the control plane cannot communicate with the cluster, job scheduling and monitoring fail. The cluster may technically have compute running but be ungovernable.