3266162 - SAP Cloud Connector: Error 111 - Connection Refused | Host Region Cannot Be Reached

The subaccount in the cloud connector shows that it is not connected to the host region, and following error is displayed in the Cloud Connector UI.

From SCC trace ljs_trace.log / scc_core.trc, following is perceived:

#ERROR#com.sap.core.connectivity.tunnel.client.reconnect.AbstractReconnectableClient#notification-client-7-1#          #Connect client to 'connectivitynotification.us3.hana.ondemand.com/130.214.33.92:443' failed: 
io.netty.channel.AbstractChannel$AnnotatedConnectException: error 111 - Connection refused: connectivitynotification.us3.hana.ondemand.com/130.214.33.92:443
[...]
Caused by: java.net.ConnectException: error 111 - Connection refused

or

#ERROR#com.sap.core.connectivity.tunnel.client.application.ApplicationClientConnectTask#Thread-100#          #Unexpected exception while establishing application tunnel connection for tunnelId: account:///<subaccount_id>
io.netty.channel.AbstractChannel$AnnotatedConnectException: error 111 - Connection refused: connectivitytunnel.cf.ap10.hana.ondemand.com/3.105.95.184:443
Caused by: java.net.ConnectException: error 111 - Connection refused
    at sun.nio.ch.SocketChannelImpl.checkConnect(Native Method)
....

 Note: Image/data in this KBA is from SAP internal systems, sample data, or demo systems, and any resemblance to real data is purely coincidental.

SAP Cloud Connector versions between 2.16.2 and 2.18.

SCC, error 111, Connection refused, proxy, network, subaccount, add, refresh, region, host, failed, connect, client, BTP, business technology platform, connector, cloud connector, region, region host, proxy, firewall, tls-inspection, tls-termination,  , KBA , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem